Merge rebrand/phase-b: rename Go module path to repo.anhonesthost.net/CyberCoveLLC/threshold

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Rename Go module paths to repo.anhonesthost.net/CyberCoveLLC/threshold
2026-10-12 10:34:24 -07:00 · 2026-10-12 10:33:41 -07:00 · 2026-10-12 10:23:51 -07:00 · 2026-10-12 10:23:50 -07:00 · 2026-10-12 10:21:04 -07:00 · 2026-10-12 10:20:06 -07:00
1909 changed files with 9217 additions and 9019 deletions
@@ -7,7 +7,7 @@ if [[ $remote_url == *"boundary-enterprise"* ]]; then
    exit 0
 fi

-if [ -f cmd/boundary/package_registration_ent.go ]; then
+if [ -f cmd/threshold/package_registration_ent.go ]; then
    echo "Found enterprise file while pushing to oss remote"
    exit 1
 fi
@@ -1,44 +0,0 @@
-# Copyright IBM Corp. 2020, 2026
-# SPDX-License-Identifier: BUSL-1.1
-
-schema = 1
-artifacts {
-  zip = [
-    "boundary_${version}_darwin_amd64.zip",
-    "boundary_${version}_darwin_arm64.zip",
-    "boundary_${version}_freebsd_386.zip",
-    "boundary_${version}_freebsd_amd64.zip",
-    "boundary_${version}_freebsd_arm.zip",
-    "boundary_${version}_linux_386.zip",
-    "boundary_${version}_linux_amd64.zip",
-    "boundary_${version}_linux_arm.zip",
-    "boundary_${version}_linux_arm64.zip",
-    "boundary_${version}_netbsd_386.zip",
-    "boundary_${version}_netbsd_amd64.zip",
-    "boundary_${version}_netbsd_arm.zip",
-    "boundary_${version}_openbsd_386.zip",
-    "boundary_${version}_openbsd_amd64.zip",
-    "boundary_${version}_openbsd_arm.zip",
-    "boundary_${version}_solaris_amd64.zip",
-    "boundary_${version}_windows_386.zip",
-    "boundary_${version}_windows_amd64.zip",
-  ]
-  rpm = [
-    "boundary-${version_linux}-1.aarch64.rpm",
-    "boundary-${version_linux}-1.armv7hl.rpm",
-    "boundary-${version_linux}-1.i386.rpm",
-    "boundary-${version_linux}-1.x86_64.rpm",
-  ]
-  deb = [
-    "boundary_${version_linux}-1_amd64.deb",
-    "boundary_${version_linux}-1_arm64.deb",
-    "boundary_${version_linux}-1_armhf.deb",
-    "boundary_${version_linux}-1_i386.deb",
-  ]
-  container = [
-    "boundary_default_linux_386_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_amd64_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_arm64_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_arm_${version}_${commit_sha}.docker.tar",
-  ]
-}
@@ -1,16 +1,15 @@
-# Boundary Docker Image
+# Threshold Docker Image

-The root of this repository contains the officially supported HashiCorp Dockerfile to build the hashicorp/boundary docker image.
-The dev docker image should be built for local dev and testing,
-while the production docker image is built in CI and makes use of CI-built binaries.
-The official docker image is built using the official binaries from releases.hashicorp.com.
+The root of this repository contains the Dockerfile used to build the Threshold
+docker image. Threshold is a community fork of HashiCorp Boundary Community
+Edition and is not affiliated with or endorsed by HashiCorp or IBM.
+
+The dev docker image is built from a locally built binary (`./bin/threshold`),
+while the production docker image makes use of CI-built binaries.

 ## Build

-See the Makefile targets in the root of this repository
-for building Boundary images in either development or release modes:
+See the Makefile targets in the root of this repository for building images:

  - `make docker-build-dev`
-  - `make docker-multiarch-build`
-  - `make docker-build`
  - `make docker`
@@ -1,46 +1,46 @@
 <!---
-This is used for the Overview tab for the boundary docker image on hub.docker.com
-https://hub.docker.com/r/hashicorp/boundary
+This is used for the Overview tab for the threshold docker image on hub.docker.com
+https://repo.anhonesthost.net/CyberCoveLLC/threshold
 --->

-# Boundary
+# Threshold

 ## Usage

 See the latest updates to the Dockerfile for this image in our
-[GitHub repository](https://github.com/hashicorp/boundary).
+[repository](https://repo.anhonesthost.net/CyberCoveLLC/threshold).

 ### Dev Mode

-Due to the limitations of `boundary dev` running and maintaining a postgres docker container,
+Due to the limitations of `threshold dev` running and maintaining a postgres docker container,
 it's not recommended to run `dev` mode inside docker.
 To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker),
 and the caveats associated with it.

 ### Default Configuration

-The default behavior of the Boundary docker image is to run `boundary server -config /boundary/config.hcl`.
+The default behavior of the Threshold docker image is to run `threshold server -config /threshold/config.hcl`.
 The included `config.hcl` file is meant to serve as an example,
 and is not suitable for actual deployment.
 Please see the comments within the file for more information;
-full configuration details can be found on Boundary's documentation site.
+full configuration details can be found on Threshold's documentation site.

 ### Postgres

-The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run boundary server with.
+The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.
 If you want to get started quickly, you can start a local postgres in docker:

 ```bash
 docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
 ```

-The postgres URL setting is defined with `env://BOUNDARY_POSTGRES_URL` so it can be easily set with `-e` during docker run:
+The postgres URL setting is defined with `env://THRESHOLD_POSTGRES_URL` so it can be easily set with `-e` during docker run:

 ```bash
 docker run \
    --network host \
-    -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-    hashicorp/boundary
+    -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+    repo.anhonesthost.net/cybercovellc/threshold
 ```

 ### Database Init
@@ -52,8 +52,8 @@ initialize the database using the default `config.hcl`:
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary database init -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
 ```

 If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
@@ -61,22 +61,22 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  -v "$(pwd)":/boundary/ \
-  hashicorp/boundary database init -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  -v "$(pwd)":/threshold/ \
+  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
 ```

 ### Database Migration

-If you are updating to a newer version of boundary with a database instance
+If you are updating to a newer version of threshold with a database instance
 that was initialized with an older version,
 you will need to apply the database migrations:

 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary database migrate -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
 ```

 If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
@@ -84,14 +84,14 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  -v "$(pwd)":/boundary/ \
-  hashicorp/boundary database migrate -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  -v "$(pwd)":/threshold/ \
+  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
 ```

 ### Server

-Start a Boundary server using the default `config.hcl`:
+Start a Threshold server using the default `config.hcl`:

 ```bash
 docker run \
@@ -99,11 +99,11 @@ docker run \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold
 ```

-Start a Boundary server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
+Start a Threshold server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:

 ```bash
 docker run \
@@ -111,7 +111,7 @@ docker run \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
-  -v "$(pwd)":/boundary/ \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary
+  -v "$(pwd)":/threshold/ \
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold
 ```
@@ -14,12 +14,12 @@ controller {

  database {
    # This configuration setting requires the user to execute the container with the URL as an env var
-    # to connect to the Boundary postgres DB. An example of how this can be done assuming the postgres 
+    # to connect to the Threshold postgres DB. An example of how this can be done assuming the postgres 
    # database is running as a container and you're using Docker for Mac (replace host.docker.internal with
    # localhost if you're on Linux):
    #
-    #    $  docker run -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] boundary:[version]
-    url = "env://BOUNDARY_POSTGRES_URL"
+    #    $  docker run -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] threshold:[version]
+    url = "env://THRESHOLD_POSTGRES_URL"
  }

  public_cluster_addr = "env://HOSTNAME"
@@ -48,7 +48,7 @@ listener "tcp" {
  tls_disable   = true 
 }

-# Root KMS configuration block: this is the root key for Boundary
+# Root KMS configuration block: this is the root key for Threshold
 # Use a production KMS such as AWS KMS in production installs
 kms "aead" {
  purpose = "root"
@@ -67,7 +67,7 @@ kms "aead" {
  key_id = "global_worker-auth"
 }

-# Recovery KMS block: configures the recovery key for Boundary
+# Recovery KMS block: configures the recovery key for Threshold
 # Use a production KMS such as AWS KMS for production installs
 kms "aead" {
  purpose = "recovery"
@@ -12,24 +12,34 @@ set -e
 # Prevent core dumps
 ulimit -c 0

-# If the user is trying to run Boundary directly with some arguments, then
-# pass them to Boundary.
+# Backwards compatibility: honor legacy BOUNDARY_* environment variables by
+# mirroring them to their THRESHOLD_* equivalents when the latter are unset.
+# (The Threshold CLI itself also falls back to BOUNDARY_* for CLI variables.)
+for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
+    new_name="THRESHOLD_${legacy_name#BOUNDARY_}"
+    if [ -z "$(printenv "$new_name")" ]; then
+        export "$new_name=$(printenv "$legacy_name")"
+    fi
+done
+
+# If the user is trying to run Threshold directly with some arguments, then
+# pass them to Threshold.
 if [ "${1:0:1}" = '-' ]; then
-    set -- boundary "$@"
+    set -- threshold "$@"
 fi

 if [ "$1" = 'server' ]; then
    shift
-    set -- boundary server \
+    set -- threshold server \
        "$@"
-elif boundary --help "$1" 2>&1 | grep -q "boundary $1"; then
+elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
    # We can't use the return code to check for the existence of a subcommand, so
    # we have to use grep to look for a pattern in the help output.
-    set -- boundary "$@"
+    set -- threshold "$@"
 fi

-# If we are running Boundary, make sure it executes as the proper user.
-if [ "$1" = 'boundary' ]; then
+# If we are running Threshold, make sure it executes as the proper user.
+if [ "$1" = 'threshold' ]; then
 	is_root=0
 	if [ "$(id -u)" = '0' ]; then
 		is_root=1
@@ -38,23 +48,23 @@ if [ "$1" = 'boundary' ]; then
    if [ -z "$SKIP_CHOWN" ]; then
        if [ "$is_root" = '1' ]; then
            # If the config dir is bind mounted then chown it
-            if [ "$(stat -c %u /boundary)" != "$(id -u boundary)" ]; then
-                chown -R boundary:boundary /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
+            if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
+                chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
            fi
        else
-            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /boundary"
+            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
        fi
    fi

    if [ -z "$SKIP_SETCAP" ]; then
        if [ "$is_root" = '1' ]; then
-            # Allow mlock to avoid swapping Boundary memory to disk
-            setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))
+            # Allow mlock to avoid swapping Threshold memory to disk
+            setcap cap_ipc_lock=+ep $(readlink -f $(which threshold))

-            # In the case Boundary has been started in a container without IPC_LOCK privileges
-            if ! boundary -version 1>/dev/null 2>/dev/null; then
-                >&2 echo "Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
-                setcap cap_ipc_lock=-ep $(readlink -f $(which boundary))
+            # In the case Threshold has been started in a container without IPC_LOCK privileges
+            if ! threshold -version 1>/dev/null 2>/dev/null; then
+                >&2 echo "Couldn't start Threshold with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
+                setcap cap_ipc_lock=-ep $(readlink -f $(which threshold))
            fi
        else
            >&2 echo "SKIP_SETCAP not set but running non-root; skipping setcap"
@@ -62,7 +72,7 @@ if [ "$1" = 'boundary' ]; then
    fi

    if [ "$is_root" = '1' ]; then
-      set -- su-exec boundary "$@"
+      set -- su-exec threshold "$@"
    fi
 fi

@@ -15,7 +15,7 @@
 #   # supply the url, or "env://" to name an environment variable
 #   # that contains the URL.
 #   database {
-#       url = "postgresql://boundary:boundarydemo@postgres.yourdomain.com:5432/boundary"
+#       url = "postgresql://threshold:thresholddemo@postgres.yourdomain.com:5432/threshold"
 #   }
 # }

@@ -42,7 +42,7 @@
 #   purpose = "cluster"
 # }

-# # Root KMS configuration block: this is the root key for Boundary
+# # Root KMS configuration block: this is the root key for Threshold
 # # Use a production KMS such as AWS KMS in production installs
 # kms "aead" {
 #   purpose = "root"
@@ -61,7 +61,7 @@
 #   key_id = "global_worker-auth"
 # }

-# # Recovery KMS block: configures the recovery key for Boundary
+# # Recovery KMS block: configures the recovery key for Threshold
 # # Use a production KMS such as AWS KMS for production installs
 # kms "aead" {
 #   purpose = "recovery"
@@ -1,23 +0,0 @@
-[Unit]
-Description="HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
-Documentation=https://www.boundaryproject.io/docs
-StartLimitIntervalSec=60
-StartLimitBurst=3
-
-[Service]
-EnvironmentFile=-/etc/boundary.d/boundary.env
-User=boundary
-Group=boundary
-ProtectSystem=full
-ProtectHome=read-only
-ExecStart=/usr/bin/boundary server -config=/etc/boundary.d/boundary.hcl
-ExecReload=/bin/kill --signal HUP $MAINPID
-KillMode=process
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=5
-TimeoutStopSec=30
-LimitMEMLOCK=infinity
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,23 @@
+[Unit]
+Description="Threshold (fork of HashiCorp Boundary CE) - Identity-based access management for dynamic infrastructure"
+Documentation=https://repo.anhonesthost.net/CyberCoveLLC/threshold
+StartLimitIntervalSec=60
+StartLimitBurst=3
+
+[Service]
+EnvironmentFile=-/etc/threshold.d/threshold.env
+User=threshold
+Group=threshold
+ProtectSystem=full
+ProtectHome=read-only
+ExecStart=/usr/bin/threshold server -config=/etc/threshold.d/threshold.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+LimitMEMLOCK=infinity
+
+[Install]
+WantedBy=multi-user.target
@@ -2,7 +2,7 @@

 if [ "$1" = "purge" ]
 then
-  userdel boundary
+  userdel threshold
 fi

 exit 0
@@ -2,7 +2,7 @@

 set -eu

-USER="boundary"
+USER="threshold"

 if ! id -u $USER > /dev/null 2>&1; then
 	useradd \
@@ -1,9 +1,7 @@
 # Copyright IBM Corp. 2020, 2026
 # SPDX-License-Identifier: BUSL-1.1

-url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/boundary"
-url_docker_registry_ecr = "https://gallery.ecr.aws/hashicorp/boundary"
-url_license = "https://github.com/hashicorp/boundary/blob/main/LICENSE"
-url_project_website = "https://www.boundaryproject.io"
-url_release_notes = "https://www.boundaryproject.io/docs/releases/release-notes"
-url_source_repository = "https://github.com/hashicorp/boundary"
+url_license = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/LICENSE"
+url_project_website = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
+url_release_notes = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/CHANGELOG.md"
+url_source_repository = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
@@ -0,0 +1,44 @@
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: BUSL-1.1
+
+schema = 1
+artifacts {
+  zip = [
+    "threshold_${version}_darwin_amd64.zip",
+    "threshold_${version}_darwin_arm64.zip",
+    "threshold_${version}_freebsd_386.zip",
+    "threshold_${version}_freebsd_amd64.zip",
+    "threshold_${version}_freebsd_arm.zip",
+    "threshold_${version}_linux_386.zip",
+    "threshold_${version}_linux_amd64.zip",
+    "threshold_${version}_linux_arm.zip",
+    "threshold_${version}_linux_arm64.zip",
+    "threshold_${version}_netbsd_386.zip",
+    "threshold_${version}_netbsd_amd64.zip",
+    "threshold_${version}_netbsd_arm.zip",
+    "threshold_${version}_openbsd_386.zip",
+    "threshold_${version}_openbsd_amd64.zip",
+    "threshold_${version}_openbsd_arm.zip",
+    "threshold_${version}_solaris_amd64.zip",
+    "threshold_${version}_windows_386.zip",
+    "threshold_${version}_windows_amd64.zip",
+  ]
+  rpm = [
+    "threshold-${version_linux}-1.aarch64.rpm",
+    "threshold-${version_linux}-1.armv7hl.rpm",
+    "threshold-${version_linux}-1.i386.rpm",
+    "threshold-${version_linux}-1.x86_64.rpm",
+  ]
+  deb = [
+    "threshold_${version_linux}-1_amd64.deb",
+    "threshold_${version_linux}-1_arm64.deb",
+    "threshold_${version_linux}-1_armhf.deb",
+    "threshold_${version_linux}-1_i386.deb",
+  ]
+  container = [
+    "threshold_default_linux_386_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_amd64_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_arm64_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_arm_${version}_${commit_sha}.docker.tar",
+  ]
+}
@@ -1,3 +1,17 @@
+# Threshold CHANGELOG
+
+> **Note:** Threshold is a community fork of HashiCorp Boundary Community Edition (CE), which was archived upstream on
+> 2026-10-09. Entries below this note are the upstream Boundary changelog and are kept unchanged for history.
+> Threshold-specific changes are listed under the "Threshold" heading, newest first.
+
+## Threshold
+
+### Unreleased
+
+* Renamed the CLI binary to `threshold` and rebranded user-visible text. `THRESHOLD_*` environment variables are now
+  preferred, with `BOUNDARY_*` honored as a fallback. The client cache directory is `~/.threshold` (falling back to an
+  existing `~/.boundary`), and stored tokens are written under new keyring names while old entries are still read.
+
 # Boundary CHANGELOG

 Canonical reference for changes, improvements, and bugfixes for Boundary.
@@ -1,53 +1,46 @@
-# Contributing to Boundary
+# Contributing to Threshold

-Thank you for contributing to Boundary! Here you can find common questions around reporting issues and opening
-pull requests to our project.
+Thank you for contributing to Threshold! Threshold is a community fork of HashiCorp Boundary Community Edition (CE).
+It is not affiliated with or endorsed by HashiCorp or IBM. Here you can find common questions around reporting issues
+and opening pull requests to the project. The repository lives at
+<https://repo.anhonesthost.net/CyberCoveLLC/threshold>.

-When contributing in any way to the Boundary project (new issue, PR, etc), please be aware that our team identifies with many gender pronouns. Please remember to use nonbinary pronouns (they/them) and gender neutral language ("Hello folks") when addressing our team. For more reading on our code of conduct, please see the [HashiCorp community guidelines](https://www.hashicorp.com/community-guidelines). 
+Please be respectful and inclusive when contributing in any way (new issue, PR, etc).

 ## Issue Reporting
 ### Reporting Security Related Vulnerabilities

-We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue 
-in Boundary, please responsibly disclose by contacting us at security@hashicorp.com. Do not open an issue on 
-our GitHub issue tracker if you believe you've found a security related issue, thank you!
+If you believe you have found a security issue in Threshold, please disclose it responsibly by contacting the
+maintainers privately rather than opening a public issue. Issues that exist in upstream HashiCorp Boundary CE should
+also be treated as security-sensitive.

 ### Bug Fixes

-If you believe you found a bug with Boundary, please:
+If you believe you found a bug with Threshold, please:

-1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible we've already fixed
-the bug, and this is a first good step to ensuring that's not the case.
-1. Take a look at the [Boundary Discuss](https://discuss.hashicorp.com/c/boundary/50) to see if other folks have had
-similar issues.
-1. Ensure a similar ticket is not already opened by searching our opened issues on GitHub.
+1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible it has already been fixed.
+1. Ensure a similar issue is not already opened by searching the open issues in the repository.

-
-Once you've verified the above, feel free to open a bug fix issue template type from our [issue selector](https://github.com/hashicorp/boundary/issues/new/choose)
-and we'll do our best to triage it as quickly as possible. 
+Once you've verified the above, open an issue in the repository describing how to reproduce the problem.

 ## Pull Requests

 ### New Features & Improvements

-Before writing a line of code, please ask us about a potential improvement or feature that you want to write into Boundary. We may already be working on it; even if we aren't, we need to ensure that both the feature and its proposed implementation is aligned with our road map, vision, and standards for the project. We're happy to help walk through that via a [feature request issue](https://github.com/hashicorp/boundary/issues/new/choose).
-
-You can see a public [road map for Boundary](https://github.com/hashicorp/boundary/issues/new/choose) on our docs site and we encourage
-everyone to look this over to understand at a high level what we're working on with Boundary.
+Before writing a line of code, please open an issue to discuss a potential improvement or feature. Threshold is
+focused on maintaining the Community Edition code base, so changes that stay close to upstream behavior and
+compatibility are the easiest to accept.

 ### Submitting a New Pull Request

 When submitting a pull request, please ensure:

 1. You've added a changelog line clearly describing the new addition under the correct changelog sub-section.
-1. You've followed the above guidelines for contributing to Boundary.
-
-Once you open your PR, our auto-labeling will add labels to help us triage and prioritize your contribution. Please
-allow us a couple of days to comment, request changes, or approve your PR. Thank you for your contribution!
+1. You've followed the above guidelines for contributing to Threshold.

 ## Changelog

-The changelog is updated by PR contributors. Each contribution to Boundary should include a changelog update at the contributor or reviewer discretion. 
+The changelog is updated by PR contributors. Each contribution to Threshold should include a changelog update at the contributor or reviewer discretion. 
 The changelog should be updated when the contribution is large enough to warrant it being called out in the larger release cycle. Enhancements, bug fixes,
 and other contributions that practitioners might want to be aware of should exist in the changelog. 

@@ -72,7 +65,7 @@ Any bug fixes fall into this section.

 Most tests require a postgres database instance to successfully run.
 This is provided via docker
-by running a customized postgres image that is optimized for boundary tests.
+by running a customized postgres image that is optimized for Threshold tests.

 Before running the test suite, this docker container must be started:

@@ -109,7 +102,7 @@ once the test database is ready:
 $ make test
 ```

-Before running any test please ensure that Docker is started. Boundary uses a Docker container to initiate a database for testing.
+Before running any test please ensure that Docker is started. Threshold uses a Docker container to initiate a database for testing.
 If a test is interrupted check to make certain that all Docker containers have been properly destroyed. 

 ### Running individual tests
@@ -13,108 +13,53 @@
 # For local dev and testing purposes, please build and use the `dev` docker image.


-# Development docker image
-FROM docker.mirror.hashicorp.services/alpine:3.21 as dev
+# Development docker image (built from the locally built ./bin/threshold)
+FROM alpine:3.21 as dev

 RUN set -eux && \
-    addgroup boundary && \
-    adduser -s /bin/sh -S -G boundary boundary && \
+    addgroup threshold && \
+    adduser -s /bin/sh -S -G threshold threshold && \
    apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

-ADD bin/boundary /bin/boundary
-RUN setcap cap_ipc_lock=+ep /bin/boundary
+ADD bin/threshold /bin/threshold
+RUN setcap cap_ipc_lock=+ep /bin/threshold

-RUN mkdir /boundary/
-ADD .release/docker/config.hcl /boundary/config.hcl
-RUN chown -R boundary:boundary /boundary/
-RUN chmod -R 640 /boundary/*
+RUN mkdir /threshold/
+ADD .release/docker/config.hcl /threshold/config.hcl
+RUN chown -R threshold:threshold /threshold/
+RUN chmod -R 640 /threshold/*

 EXPOSE 9200 9201 9202
-VOLUME /boundary/
+VOLUME /threshold/

 LABEL org.opencontainers.image.licenses="BUSL-1.1"

 COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-COPY bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
+COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt

-USER boundary
+USER threshold
 ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
-
-
-# Official docker image that uses binaries from releases.hashicorp.com
-FROM docker.mirror.hashicorp.services/alpine:3.21 as official
-
-ARG PRODUCT_VERSION
-
-LABEL name="Boundary" \
-      maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
-      vendor="HashiCorp" \
-      version=$PRODUCT_VERSION \
-      release=$PRODUCT_VERSION \
-      summary="Boundary provides simple and secure access to hosts and services" \
-      description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
-      org.opencontainers.image.licenses="BUSL-1.1"
-
-RUN set -eux && \
-    addgroup boundary && \
-    adduser -s /bin/sh -S -G boundary boundary && \
-    apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables && \
-    gpg --keyserver keyserver.ubuntu.com --recv-keys C874011F0AB405110D02105534365D9472D7468F && \
-    cd /tmp && \
-    apkArch="$(apk --print-arch)" && \
-    case "${apkArch}" in \
-        aarch64) boundaryArch='arm64' ;; \
-        armhf) boundaryArch='armhfv6' ;; \
-        x86) boundaryArch='386' ;; \
-        x86_64) boundaryArch='amd64' ;; \
-        *) echo >&2 "error: unsupported architecture: ${apkArch} (see https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/ )" && exit 1 ;; \
-    esac && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
-    gpg --batch --verify boundary_${PRODUCT_VERSION}_SHA256SUMS.sig boundary_${PRODUCT_VERSION}_SHA256SUMS && \
-    grep boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS | sha256sum -c && \
-    unzip -d /bin boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
-    rm boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
-    setcap cap_ipc_lock=+ep /bin/boundary && \
-    cp /bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt && \
-    mkdir /boundary
-
-COPY .release/docker/config.hcl /boundary/config.hcl
-
-RUN chown -R boundary:boundary /boundary/ 
-RUN chmod -R 640 /boundary/*
-
-EXPOSE 9200 9201 9202
-VOLUME /boundary/
-
-COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-
-USER boundary
-ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
+CMD ["server", "-config", "/threshold/config.hcl"]


 # Production docker image
 # Remember, this cannot be built locally
-FROM docker.mirror.hashicorp.services/alpine:3.21 as default
+FROM alpine:3.21 as default

 ARG BIN_NAME
-# NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com
-# and the version to download. Example: NAME=boundary PRODUCT_VERSION=1.2.3.
-ARG NAME=boundary
+# NAME is the name of the software (and of the user/group created in the image);
+# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
+ARG NAME=threshold
 ARG PRODUCT_VERSION
 # TARGETARCH and TARGETOS are set automatically when --platform is provided.
 ARG TARGETOS TARGETARCH

-LABEL name="Boundary" \
-      maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
-      vendor="HashiCorp" \
+LABEL name="Threshold" \
+      vendor="Threshold (fork of HashiCorp Boundary CE)" \
      version=$PRODUCT_VERSION \
      release=$PRODUCT_VERSION \
-      summary="Boundary provides simple and secure access to hosts and services" \
-      description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
+      summary="Threshold provides simple and secure access to hosts and services" \
+      description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
      org.opencontainers.image.licenses="BUSL-1.1"

 # Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
@@ -126,20 +71,20 @@ RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}

 RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

-COPY .release/docker/config.hcl /boundary/config.hcl
+COPY .release/docker/config.hcl /threshold/config.hcl

 COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
-COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
+COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
 RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME

-RUN chown -R ${NAME}:${NAME} /boundary
-RUN chmod -R 640 /boundary/*
+RUN chown -R ${NAME}:${NAME} /threshold
+RUN chmod -R 640 /threshold/*

 EXPOSE 9200 9201 9202
-VOLUME /boundary/
+VOLUME /threshold/

 COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

 USER ${NAME}
 ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
+CMD ["server", "-config", "/threshold/config.hcl"]
@@ -4,7 +4,7 @@ THIS_FILE := $(lastword $(MAKEFILE_LIST))
 THIS_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))

 TMP_DIR := $(shell mktemp -d)
-REPO_PATH := github.com/hashicorp/boundary
+REPO_PATH := repo.anhonesthost.net/CyberCoveLLC/threshold

 TEST_PACKAGE ?= $(shell go list ./... | grep -v '/e2e')
 TEST_TIMEOUT ?= 30m
@@ -55,16 +55,16 @@ dev:
 .PHONY: build
 build: BUILD_TAGS+=ui
 build: build-ui-ifne
-	@echo "==> Building Boundary with UI features enabled"
+	@echo "==> Building Threshold with UI features enabled"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 .PHONY: build-no-ui
 build-no-ui:
-	@echo "==> Building Boundary without UI features"
+	@echo "==> Building Threshold without UI features"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 .PHONY: install
-install: export BOUNDARY_INSTALL_BINARY=1
+install: export THRESHOLD_INSTALL_BINARY=1
 install: build

 .PHONY: install-no-plugins
@@ -74,7 +74,7 @@ install-no-plugins: install
 .PHONY: build-memprof
 build-memprof: BUILD_TAGS+=memprofiler
 build-memprof:
-	@echo "==> Building Boundary with memory profiling enabled"
+	@echo "==> Building Threshold with memory profiling enabled"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 # Format Go files, ignoring files marked as generated through the header defined at
@@ -363,35 +363,14 @@ install-go:
 	./ci/goinstall.sh

 # Docker build and publish variables and targets
-REGISTRY_NAME?=docker.io/hashicorp
-IMAGE_NAME=boundary
+REGISTRY_NAME?=repo.anhonesthost.net/cybercovellc
+IMAGE_NAME=threshold
 VERSION?=0.7.4
 IMAGE_TAG=$(REGISTRY_NAME)/$(IMAGE_NAME):$(VERSION)
 IMAGE_TAG_DEV?=$(REGISTRY_NAME)/$(IMAGE_NAME):latest-$(shell git rev-parse --short HEAD)

 .PHONY: docker
-docker: docker-build
-
-.PHONY: docker-build
-# Builds from the releases.hashicorp.com official binary
-docker-build:
-	docker build \
-		--tag $(IMAGE_TAG) \
-		--tag hashicorp/boundary:latest \
-		--target=official \
-		--build-arg VERSION=$(VERSION) \
-		.
-
-.PHONY: docker-multiarch-build
-# Builds multiarch from the releases.hashicorp.com official binary
-docker-multiarch-build:
-	docker buildx build \
-		--tag $(IMAGE_TAG) \
-		--tag hashicorp/boundary:latest \
-		--target=official \
-		--build-arg VERSION=$(VERSION) \
-		--platform linux/amd64,linux/arm64 \
-		.
+docker: docker-build-dev

 DEV_DOCKER_GOOS ?= linux
 DEV_DOCKER_GOARCH ?= amd64
@@ -406,7 +385,7 @@ docker-build-dev: build
 		--platform $(DEV_DOCKER_GOOS)/$(DEV_DOCKER_GOARCH) \
 		--tag $(IMAGE_TAG_DEV) \
 		--target=dev \
-		--build-arg=boundary \
+		--build-arg=threshold \
 		.
 	@echo "Successfully built $(IMAGE_TAG_DEV)"

@@ -416,8 +395,8 @@ docker-build-dev: build
 # This is used for release builds by .github/workflows/build.yml
 version:
 	@go run \
-		-ldflags "-X 'github.com/hashicorp/boundary/version.Version=$(shell cat version/VERSION)'" \
-		./cmd/boundary version \
+		-ldflags "-X 'repo.anhonesthost.net/CyberCoveLLC/threshold/version.Version=$(shell cat version/VERSION)'" \
+		./cmd/threshold version \
 		| awk '/Version Number:/ { print $$3 }'

 EDITION?=
@@ -425,7 +404,7 @@ EDITION?=
 # This is used for release builds by .github/workflows/build.yml
 edition:
 	@if [ -z "$(EDITION)" ]; then \
-		go run ./cmd/boundary version -format=json | jq -r '.version_metadata // "oss"'; \
+		go run ./cmd/threshold version -format=json | jq -r '.version_metadata // "oss"'; \
 	else \
 		echo $(EDITION); \
 	fi; \
@@ -0,0 +1,26 @@
+Threshold
+=========
+
+Threshold is a community fork of HashiCorp Boundary Community Edition (CE),
+originally developed by HashiCorp, Inc. (an IBM company):
+
+    https://github.com/hashicorp/boundary
+
+The upstream repository was archived on 2026-10-09. Threshold continues
+maintenance of that code base.
+
+Original work:
+    Copyright (c) HashiCorp, Inc.
+    Copyright IBM Corp. 2020, 2026
+    Licensed under the Business Source License 1.1 (see LICENSE).
+
+All existing copyright headers and the LICENSE file are preserved unchanged.
+Threshold is distributed under the same license terms as the upstream project.
+
+Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp,
+Inc. or IBM. "Boundary", "HashiCorp", "HCP Boundary" and related marks are
+the property of their respective owners and are referenced here solely to
+identify the origin of this software.
+
+Portions of this repository (for example the api and sdk modules) carry their
+own license files, which apply to those portions.
@@ -1,10 +1,83 @@
-<img alt="Boundary" src="boundary.png" alt="Image" width="500px"/>
+# Threshold

-Boundary Community Edition (CE) is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities.
+Threshold provides simple and secure access to hosts and services. It is a
+community-maintained fork of HashiCorp Boundary Community Edition (CE).

-This repository is now read-only and no longer accepts new issues, pull requests, or community contributions. Existing source code and previously released binaries remain available for reference and existing self-managed use.
+## About this fork

-No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned.
+Threshold is a community fork of [HashiCorp Boundary Community Edition](https://github.com/hashicorp/boundary).
+HashiCorp (an IBM company) archived the upstream Boundary CE repository on
+2026-10-09 and announced that no further CE releases, maintenance updates, bug
+fixes or security patches are planned. Threshold continues maintenance of the
+Community Edition code base so that existing self-managed deployments can keep
+receiving fixes.

-Teams continuing to use Boundary CE should evaluate whether it meets their operational, security, and compliance requirements.
-For supported Boundary capabilities, including production-scale governance, compliance, session recording, enterprise support, and future Boundary development, please evaluate HCP Boundary or Boundary Enterprise.
+- Threshold is licensed under the [Business Source License 1.1](LICENSE), the
+  same license as the upstream code. The original license text and all
+  copyright headers are preserved. See [NOTICE](NOTICE) for attribution.
+- **Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or
+  IBM.** "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their
+  respective owners and are used here only to describe the origin of this
+  project.
+- Upstream project: <https://github.com/hashicorp/boundary>
+- This repository: <https://repo.anhonesthost.net/CyberCoveLLC/threshold>
+
+### Compatibility with Boundary CE
+
+This is the first phase of the rebrand and is designed to keep existing
+Boundary CE deployments working:
+
+- The command-line binary is now `threshold` (built from `cmd/threshold`).
+- The wire protocol, HTTP API paths (`/v1`), database schema, plugin protocol
+  and configuration file format are unchanged.
+- The Go module path is `repo.anhonesthost.net/CyberCoveLLC/threshold` (with `/api` and `/sdk`
+  submodules); protobuf code has been regenerated for it.
+- Release versions are still reported on the wire with the upstream
+  `Boundary v` prefix so mixed clusters keep working. `Threshold v` is also
+  accepted when parsing.
+
+### Environment variable and path fallbacks
+
+Threshold prefers `THRESHOLD_*` environment variables, and transparently falls
+back to the legacy `BOUNDARY_*` name when the `THRESHOLD_*` variable is not set.
+For example `THRESHOLD_ADDR`, `THRESHOLD_TOKEN`, `THRESHOLD_SCOPE_ID`,
+`THRESHOLD_KEYRING_TYPE`, `THRESHOLD_TOKEN_NAME`, `THRESHOLD_CONNECT_*`,
+`THRESHOLD_SKIP_CACHE_DAEMON` and the other CLI and server variables are read
+first, then `BOUNDARY_ADDR`, `BOUNDARY_TOKEN`, and so on. A `THRESHOLD_*` variable that is
+set to a non-empty value always wins. Existing scripts and deployments that
+only set `BOUNDARY_*` variables do not need to change.
+
+Notes:
+
+- `env://VAR` references inside configuration files and flags (for example
+  `url = "env://BOUNDARY_POSTGRES_URL"` or `url = "env://THRESHOLD_POSTGRES_URL"`
+  as used by the bundled container config) name an environment variable
+  literally and are not rewritten; keep using whichever variable name you export.
+- `threshold connect -exec` exports both `THRESHOLD_PROXIED_{PORT,IP,ADDR}` and
+  the legacy `BOUNDARY_PROXIED_{PORT,IP,ADDR}` variables to the child process.
+- The container image entrypoint mirrors any `BOUNDARY_*` variables to the
+  matching `THRESHOLD_*` variable when it is unset.
+
+Other fallbacks:
+
+| Item | New | Legacy fallback |
+|------|-----|-----------------|
+| Client cache directory | `~/.threshold` | `~/.boundary` is used if it exists and `~/.threshold` does not |
+| Keyring entry (macOS Keychain / Windows Credential Manager) | `Threshold Auth Token` | `HashiCorp Boundary Auth Token` is read if the new entry is not found, and removed on `threshold logout` |
+| Keyring prefix (`pass`, libsecret) | `Threshold` | `HashiCorp_Boundary` is read if the new entry is not found, and removed on `threshold logout` |
+
+Tokens are always written using the new names.
+
+## Building
+
+```
+make build        # builds bin/threshold (requires the embedded UI, see Makefile)
+make build-no-ui  # builds bin/threshold without the embedded admin UI
+```
+
+The embedded admin UI is built from the upstream `boundary-ui` project and is
+not part of this repository.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Account struct {
@@ -8,7 +8,7 @@ import (
 	"errors"
 	"fmt"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 func (c *Client) ChangePassword(ctx context.Context, accountId, currentPassword, newPassword string, version uint32, opt ...Option) (*AccountUpdateResult, error) {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -8,7 +8,7 @@ import (
 	"errors"
 	"fmt"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 func (c *Client) SetPassword(ctx context.Context, accountId, password string, version uint32, opt ...Option) (*AccountUpdateResult, error) {
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Alias struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -9,8 +9,8 @@ import (
 	"errors"
 	"fmt"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authtokens"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/authtokens"
 )

 type AuthenticateResult struct {
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type AuthMethod struct {
@@ -8,7 +8,7 @@ import (
 	"errors"
 	"fmt"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 const (
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type AuthToken struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -7,7 +7,7 @@ package billing
 import (
 	"time"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type ActiveUsers struct {
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"net/url"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type MonthlyActiveUsersResult struct {
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -15,7 +15,6 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"os"
 	"path"
 	"strconv"
 	"strings"
@@ -23,7 +22,7 @@ import (
 	"time"
 	"unicode"

-	"github.com/hashicorp/boundary/api/recovery"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/recovery"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	retryablehttp "github.com/hashicorp/go-retryablehttp"
@@ -53,14 +52,14 @@ const (

 // Config is used to configure the creation of the client
 type Config struct {
-	// Addr is the address of the Boundary controller. This should be a
-	// complete URL such as "http://boundary.example.com". If you need a custom
+	// Addr is the address of the Threshold controller. This should be a
+	// complete URL such as "http://threshold.example.com". If you need a custom
 	// SSL cert or want to enable insecure mode, you need to specify a custom
 	// HttpClient.
 	Addr string

 	// Token is the client token that reuslts from authentication and can be
-	// used to make calls into Boundary
+	// used to make calls into Threshold
 	Token string

 	// RecoveryKmsWrapper is a wrapper used in the recovery KMS authentication
@@ -68,9 +67,9 @@ type Config struct {
 	// per-call, regardless of any value set in Token.
 	RecoveryKmsWrapper wrapping.Wrapper

-	// HttpClient is the HTTP client to use. Boundary sets sane defaults for the
+	// HttpClient is the HTTP client to use. Threshold sets sane defaults for the
 	// http.Client and its associated http.Transport created in DefaultConfig.
-	// If you must modify Boundary's defaults, it is suggested that you start
+	// If you must modify Threshold's defaults, it is suggested that you start
 	// with that client and modify as needed rather than start with an empty
 	// client (or http.DefaultClient). Currently if the client is cloned the
 	// same HttpClient is used.
@@ -114,20 +113,20 @@ type Config struct {
 }

 // TLSConfig contains the parameters needed to configure TLS on the HTTP client
-// used to communicate with Boundary.
+// used to communicate with Threshold.
 type TLSConfig struct {
 	// CACert is the path to a PEM-encoded CA cert file to use to verify the
-	// Boundary server SSL certificate.
+	// Threshold server SSL certificate.
 	CACert string

 	// CAPath is the path to a directory of PEM-encoded CA cert files to verify
-	// the Boundary server SSL certificate.
+	// the Threshold server SSL certificate.
 	CAPath string

-	// ClientCert is the path to the certificate for Boundary communication
+	// ClientCert is the path to the certificate for Threshold communication
 	ClientCert string

-	// ClientKey is the path to the private key for Boundary communication
+	// ClientKey is the path to the private key for Threshold communication
 	ClientKey string

 	// ServerName, if set, is used to set the SNI host when connecting via
@@ -162,7 +161,7 @@ func RateLimitLinearJitterBackoff(min, max time.Duration, attemptNum int, resp *
 // safe to modify the return value of this function.
 //
 // The default Addr is http://127.0.0.1:9200, but this can be overridden by
-// setting the `BOUNDARY_ADDR` environment variable.
+// setting the `THRESHOLD_ADDR` environment variable.
 //
 // If an error is encountered, this will return nil.
 func DefaultConfig() (*Config, error) {
@@ -270,7 +269,7 @@ func (c *Config) setAddr(addr string) error {
 	// Remove trailing or leading slashes
 	path := strings.Trim(u.Path, "/")
 	// Remove v1 in front or back (e.g. they could have
-	// https://boundary.example.com/myinstall/v1 which would put it at the
+	// https://threshold.example.com/myinstall/v1 which would put it at the
 	// back)
 	path = strings.TrimPrefix(path, "v1")
 	path = strings.TrimSuffix(path, "v1")
@@ -296,15 +295,15 @@ func (c *Config) ReadEnvironment() error {
 	var envServerName string

 	// Parse the environment variables
-	if v := os.Getenv(EnvBoundaryAddr); v != "" {
+	if v := Getenv(EnvBoundaryAddr); v != "" {
 		c.Addr = v
 	}

-	if v := os.Getenv(EnvBoundaryToken); v != "" {
+	if v := Getenv(EnvBoundaryToken); v != "" {
 		c.Token = v
 	}

-	if v := os.Getenv(EnvBoundaryMaxRetries); v != "" {
+	if v := Getenv(EnvBoundaryMaxRetries); v != "" {
 		maxRetries, err := strconv.ParseUint(v, 10, 32)
 		if err != nil {
 			return err
@@ -318,7 +317,7 @@ func (c *Config) ReadEnvironment() error {
 		c.MaxRetries = int(maxRetries)
 	}

-	if v := os.Getenv(EnvBoundarySRVLookup); v != "" {
+	if v := Getenv(EnvBoundarySRVLookup); v != "" {
 		var err error
 		lookup, err := strconv.ParseBool(v)
 		if err != nil {
@@ -327,7 +326,7 @@ func (c *Config) ReadEnvironment() error {
 		c.SRVLookup = lookup
 	}

-	if t := os.Getenv(EnvBoundaryClientTimeout); t != "" {
+	if t := Getenv(EnvBoundaryClientTimeout); t != "" {
 		clientTimeout, err := parseutil.ParseDurationSecond(t)
 		if err != nil {
 			return fmt.Errorf("could not parse %q", EnvBoundaryClientTimeout)
@@ -335,7 +334,7 @@ func (c *Config) ReadEnvironment() error {
 		c.Timeout = clientTimeout
 	}

-	if v := os.Getenv(EnvBoundaryRateLimit); v != "" {
+	if v := Getenv(EnvBoundaryRateLimit); v != "" {
 		rateLimit, burstLimit, err := parseRateLimit(v)
 		if err != nil {
 			return err
@@ -346,31 +345,31 @@ func (c *Config) ReadEnvironment() error {
 	// TLS Config
 	{
 		var foundTLSConfig bool
-		if v := os.Getenv(EnvBoundaryCACert); v != "" {
+		if v := Getenv(EnvBoundaryCACert); v != "" {
 			foundTLSConfig = true
 			envCACert = v
 		}
-		if v := os.Getenv(EnvBoundaryCAPath); v != "" {
+		if v := Getenv(EnvBoundaryCAPath); v != "" {
 			foundTLSConfig = true
 			envCAPath = v
 		}
-		if v := os.Getenv(EnvBoundaryClientCert); v != "" {
+		if v := Getenv(EnvBoundaryClientCert); v != "" {
 			foundTLSConfig = true
 			envClientCert = v
 		}
-		if v := os.Getenv(EnvBoundaryClientKey); v != "" {
+		if v := Getenv(EnvBoundaryClientKey); v != "" {
 			foundTLSConfig = true
 			envClientKey = v
 		}
-		if v := os.Getenv(EnvBoundaryTLSInsecure); v != "" {
+		if v := Getenv(EnvBoundaryTLSInsecure); v != "" {
 			foundTLSConfig = true
 			var err error
 			envInsecure, err = strconv.ParseBool(v)
 			if err != nil {
-				return fmt.Errorf("could not parse BOUNDARY_TLS_INSECURE")
+				return fmt.Errorf("could not parse THRESHOLD_TLS_INSECURE")
 			}
 		}
-		if v := os.Getenv(EnvBoundaryTLSServerName); v != "" {
+		if v := Getenv(EnvBoundaryTLSServerName); v != "" {
 			foundTLSConfig = true
 			envServerName = v
 		}
@@ -405,7 +404,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	return rate, burst, err
 }

-// Client is the client to the Boundary API. Create a client with NewClient.
+// Client is the client to the Threshold API. Create a client with NewClient.
 type Client struct {
 	modifyLock sync.RWMutex
 	config     *Config
@@ -413,10 +412,10 @@ type Client struct {

 // NewClient returns a new client for the given configuration.
 //
-// If the configuration is nil, Boundary will use configuration from
+// If the configuration is nil, Threshold will use configuration from
 // DefaultConfig(), which is the recommended starting configuration.
 //
-// If the environment variable `BOUNDARY_TOKEN` is present, the token will be
+// If the environment variable `THRESHOLD_TOKEN` is present, the token will be
 // automatically added to the client. Otherwise, you must manually call
 // `SetToken()`.
 func NewClient(c *Config) (*Client, error) {
@@ -465,9 +464,9 @@ func (c *Client) Addr() string {
 	return c.config.Addr
 }

-// Sets the address of Boundary in the client. The format of address should
+// Sets the address of Threshold in the client. The format of address should
 // be "<Scheme>://<Host>:<Port>". Setting this on a client will override the
-// value of the BOUNDARY_ADDR environment variable.
+// value of the THRESHOLD_ADDR environment variable.
 func (c *Client) SetAddr(addr string) error {
 	c.modifyLock.Lock()
 	defer c.modifyLock.Unlock()
@@ -624,7 +623,7 @@ func copyHeaders(in http.Header) http.Header {
 	return ret
 }

-// NewRequest creates a new raw request object to query the Boundary controller
+// NewRequest creates a new raw request object to query the Threshold controller
 // configured for this client. This is an advanced method and generally
 // doesn't need to be called externally.
 func (c *Client) NewRequest(ctx context.Context, method, requestPath string, body any, opt ...Option) (*retryablehttp.Request, error) {
@@ -762,7 +761,7 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 		return !unicode.IsPrint(c)
 	})
 	if idx != -1 {
-		return nil, fmt.Errorf("configured Boundary token contains non-printable characters and cannot be used")
+		return nil, fmt.Errorf("configured Threshold token contains non-printable characters and cannot be used")
 	}

 	if outputCurlString {
@@ -848,9 +847,9 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 					"but the client is configured to use TLS. Please either enable TLS\n"+
 					"on the server or run the client with -address set to an address\n"+
 					"that uses the http protocol:\n\n"+
-					"    boundary <command> -address http://<address>\n\n"+
-					"You can also set the BOUNDARY_ADDR environment variable:\n\n\n"+
-					"    BOUNDARY_ADDR=http://<address> boundary <command>\n\n"+
+					"    threshold <command> -address http://<address>\n\n"+
+					"You can also set the THRESHOLD_ADDR environment variable:\n\n\n"+
+					"    THRESHOLD_ADDR=http://<address> threshold <command>\n\n"+
 					"where <address> is replaced by the actual address to the controller.",
 				err)
 		}
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type CredentialLibrary struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Credential struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type CredentialStore struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -0,0 +1,56 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package api
+
+import (
+	"os"
+	"strings"
+)
+
+const (
+	// legacyEnvPrefix is the environment variable prefix used by upstream
+	// HashiCorp Boundary. It is still honored as a fallback.
+	legacyEnvPrefix = "BOUNDARY_"
+	// envPrefix is the preferred environment variable prefix for Threshold.
+	envPrefix = "THRESHOLD_"
+)
+
+// PreferredEnvName returns the Threshold (THRESHOLD_*) form of an environment
+// variable name. Names that do not use the legacy BOUNDARY_ prefix are
+// returned unchanged.
+func PreferredEnvName(name string) string {
+	if strings.HasPrefix(name, legacyEnvPrefix) {
+		return envPrefix + strings.TrimPrefix(name, legacyEnvPrefix)
+	}
+	return name
+}
+
+// LegacyEnvName returns the legacy (BOUNDARY_*) form of an environment
+// variable name. Names that do not use the THRESHOLD_ prefix are returned
+// unchanged.
+func LegacyEnvName(name string) string {
+	if strings.HasPrefix(name, envPrefix) {
+		return legacyEnvPrefix + strings.TrimPrefix(name, envPrefix)
+	}
+	return name
+}
+
+// LookupEnv looks up an environment variable, preferring the THRESHOLD_*
+// name and falling back to the legacy BOUNDARY_* name. The name may be given
+// with either prefix; names with neither prefix are looked up as-is.
+func LookupEnv(name string) (string, bool) {
+	if v, ok := os.LookupEnv(PreferredEnvName(LegacyEnvName(name))); ok {
+		return v, true
+	}
+	return os.LookupEnv(LegacyEnvName(name))
+}
+
+// Getenv is like os.Getenv but follows the LookupEnv precedence. A set but
+// empty THRESHOLD_* variable falls through to the legacy BOUNDARY_* variable.
+func Getenv(name string) string {
+	if v := os.Getenv(PreferredEnvName(LegacyEnvName(name))); v != "" {
+		return v
+	}
+	return os.Getenv(LegacyEnvName(name))
+}
@@ -0,0 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package api
+
+import "testing"
+
+func TestEnvFallback(t *testing.T) {
+	t.Setenv("THRESHOLD_ZZ_TEST", "")
+	t.Setenv("BOUNDARY_ZZ_TEST", "old")
+	if got := Getenv("BOUNDARY_ZZ_TEST"); got != "old" {
+		t.Fatalf("want old, got %q", got)
+	}
+	t.Setenv("THRESHOLD_ZZ_TEST", "new")
+	if got := Getenv("BOUNDARY_ZZ_TEST"); got != "new" {
+		t.Fatalf("want new, got %q", got)
+	}
+	if got, ok := LookupEnv("THRESHOLD_ZZ_TEST"); !ok || got != "new" {
+		t.Fatalf("want new, got %q %v", got, ok)
+	}
+	if PreferredEnvName("BOUNDARY_ADDR") != "THRESHOLD_ADDR" || LegacyEnvName("THRESHOLD_ADDR") != "BOUNDARY_ADDR" {
+		t.Fatal("name mapping")
+	}
+}
@@ -1,11 +1,10 @@
-module github.com/hashicorp/boundary/api
+module repo.anhonesthost.net/CyberCoveLLC/threshold/api

 go 1.26.9

 require (
 	github.com/coder/websocket v1.8.14
 	github.com/google/go-cmp v0.7.0
-	github.com/hashicorp/boundary/sdk v0.0.56
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-kms-wrapping/v2 v2.0.20
 	github.com/hashicorp/go-retryablehttp v0.7.8
@@ -22,6 +21,7 @@ require (
 	golang.org/x/time v0.14.0
 	google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e
 	google.golang.org/protobuf v1.36.12
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
@@ -38,8 +38,10 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	golang.org/x/crypto v0.56.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace repo.anhonesthost.net/CyberCoveLLC/threshold/sdk => ../sdk
@@ -23,8 +23,6 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary/sdk v0.0.56 h1:A/Wdd1A4qENjdnkvWQ20Igahs/3BSdbTPPL+A09BGMc=
-github.com/hashicorp/boundary/sdk v0.0.56/go.mod h1:cnudX5/Su+aPPcsK5vrQ6Y2t0OsERgT5oweQ7x0wNTs=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -124,14 +122,14 @@ go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 h1:lrupDmKL3p5kEX1M92oan027eCKcouzjuPbH6YBK+Rs=
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Group struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,9 +14,9 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/plugins"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/plugins"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type HostCatalog struct {
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,9 +14,9 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/plugins"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/plugins"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Host struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,9 +14,9 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/plugins"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/plugins"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type HostSet struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type ManagedGroup struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -5,7 +5,6 @@ package api

 import (
 	"fmt"
-	"os"
 	"strings"

 	retryablehttp "github.com/hashicorp/go-retryablehttp"
@@ -60,15 +59,15 @@ func (d *OutputStringError) parseRequest() {
 	for k, v := range d.Request.Header {
 		for _, h := range v {
 			if strings.ToLower(k) == "authorization" {
-				tokenName := os.Getenv("BOUNDARY_TOKEN_NAME")
-				keyringType := os.Getenv("BOUNDARY_KEYRING_TYPE")
+				tokenName := Getenv("THRESHOLD_TOKEN_NAME")
+				keyringType := Getenv("THRESHOLD_KEYRING_TYPE")
 				switch {
 				case tokenName == "none" || keyringType == "none":
 					h = `Bearer <token>`
 				case tokenName == "" && keyringType == "":
-					h = `Bearer $(boundary config get-token)`
+					h = `Bearer $(threshold config get-token)`
 				default:
-					h = fmt.Sprintf("Bearer $(boundary config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
+					h = fmt.Sprintf("Bearer $(threshold config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
 				}
 			}
 			d.parsedCurlString = fmt.Sprintf("%s -H \"%s: %s\"", d.parsedCurlString, k, h)
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Policy struct {
@@ -6,7 +6,7 @@ package proxy
 import (
 	"errors"

-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 	"github.com/mitchellh/mapstructure"
 )

@@ -6,7 +6,7 @@ package proxy
 import (
 	"testing"

-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -9,8 +9,8 @@ import (
 	"net/netip"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 )

 // getOpts iterates the inbound Options and returns a struct and any errors
@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -15,9 +15,9 @@ import (
 	"sync/atomic"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/sessions"
-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/sessions"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-secure-stdlib/base62"
 	"github.com/hashicorp/go-secure-stdlib/temperror"
@@ -15,8 +15,8 @@ import (
 	"testing"
 	"time"

-	"github.com/hashicorp/boundary/api/scopes"
-	"github.com/hashicorp/boundary/api/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/targets"
 	"github.com/mitchellh/copystructure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -14,9 +14,9 @@ import (
 	"sync"

 	"github.com/coder/websocket"
-	"github.com/hashicorp/boundary/api/consts"
-	pb "github.com/hashicorp/boundary/sdk/pbs/proxy"
-	"github.com/hashicorp/boundary/sdk/wspb"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/consts"
+	pb "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/proxy"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/wspb"
 )

 func (p *ClientProxy) getWsConn(ctx context.Context) (*websocket.Conn, error) {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Role struct {
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"net/url"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type KeyListResult struct {
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,7 +14,7 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type Scope struct {
@@ -7,7 +7,7 @@ package sessionrecordings
 import (
 	"time"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type ChannelRecording struct {
@@ -7,7 +7,7 @@ package sessionrecordings
 import (
 	"time"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type ConnectionRecording struct {
@@ -14,7 +14,7 @@ import (
 	"slices"
 	"strconv"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Download makes a Boundary request to download the requested session recording
@@ -7,8 +7,8 @@ package sessionrecordings
 import (
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Export struct {
@@ -5,7 +5,7 @@
 package sessionrecordings

 import (
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type HostCatalog struct {
@@ -7,7 +7,7 @@ package sessionrecordings
 import (
 	"strconv"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type SessionRecording struct {
@@ -5,7 +5,7 @@
 package sessionrecordings

 import (
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Target struct {
@@ -5,7 +5,7 @@
 package sessionrecordings

 import (
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type User struct {
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"net/url"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 func (c *Client) Cancel(ctx context.Context, sessionId string, version uint32, opt ...Option) (*SessionUpdateResult, error) {
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Session struct {
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,9 +14,9 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/plugins"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/plugins"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type StorageBucket struct {
@@ -10,9 +10,9 @@ import (
 	"fmt"
 	"net/url"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
-	targetspb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/targets"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
+	targetspb "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/targets"
 	"github.com/mr-tron/base58"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -7,7 +7,7 @@ package targets
 import (
 	"time"

-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type SessionAuthorization struct {
@@ -7,7 +7,7 @@ package targets
 import (
 	"time"

-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type SessionAuthorizationData struct {
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Target struct {
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"net/url"

-	"github.com/hashicorp/boundary/api/aliases"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/aliases"
 )

 // ListResolvableAliases builds and sends a request to the API for listing
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type User struct {
@@ -5,7 +5,7 @@
 package workers

 import (
-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 type CertificateAuthority struct {
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/hashicorp/boundary/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
 )

 // Option is a func that sets optional attributes for a call. This does not need
@@ -11,8 +11,8 @@ import (
 	"net/url"
 	"time"

-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 )

 type Worker struct {
@@ -1,10 +0,0 @@
-// Copyright IBM Corp. 2020, 2026
-// SPDX-License-Identifier: BUSL-1.1
-
-package main
-
-import (
-	// Enable tcp target support.
-	_ "github.com/hashicorp/boundary/internal/daemon/controller/handlers/targets/tcp"
-	_ "github.com/hashicorp/boundary/internal/target/tcp"
-)
Author	SHA1	Message	Date
shadowdaoandClaude Sonnet 5.5	a5ba9460e5	Merge rebrand/phase-b: rename Go module path to repo.anhonesthost.net/CyberCoveLLC/threshold ci / check (push) Failing after 19m6s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:34:24 -07:00
shadowdaoandClaude Sonnet 5.5	962d708fdd	Rename Go module paths to repo.anhonesthost.net/CyberCoveLLC/threshold Rename root, api and sdk module paths (imports, go.mod, go_package, ldflags, build scripts, buf configs) and regenerate protobuf/gateway code with the project's pinned toolchain. Wire identifiers unchanged. api gets a local replace for sdk; root/api/sdk require v0.1.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:33:41 -07:00
shadowdaoandClaude Sonnet 5.5	443e483a16	Merge rebrand/phase-a: Threshold CLI/binary, packaging, docs, legacy fallbacks ci / check (push) Failing after 12m27s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:23:51 -07:00
shadowdaoandClaude Sonnet 5.5	613415624e	Merge security/go-1.26.9: Go 1.26.9, x/net, AWS SDK bumps, Gitea CI Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:23:50 -07:00
shadowdaoandClaude Sonnet 5.5	b30dead452	Bump golang.org/x/net to v0.60.0 (GO-2026-6603/6610/6611/6612/6617) and gofmt Go fuzz test / Fuzz grants.Parse (push) Successful in 4m29s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:21:04 -07:00
shadowdaoandClaude Sonnet 5.5	ab4ed3c9e5	Rebrand user-visible CLI text; add legacy fallbacks for keyring, cache dir and version prefix Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:20:06 -07:00
shadowdaoandClaude Sonnet 5.5	4cb3bda43a	Add fork notice, NOTICE file, README/CONTRIBUTING rewrite; drop HashiCorp logo assets Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 09:53:17 -07:00
shadowdaoandClaude Sonnet 5.5	5f5d35b9ff	Rename binary to threshold and update build/release packaging Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 09:53:13 -07:00
shadowdaoandClaude Sonnet 5.5	306960d24b	Add THRESHOLD_* env var support with BOUNDARY_* fallback Introduce api.Getenv/api.LookupEnv which prefer THRESHOLD_X and fall back to legacy BOUNDARY_X; use them for user-facing env var reads. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 09:45:44 -07:00