cmd/

Command acceptance exercises access-issuer against a real Kubernetes API server.

Command docsgen rewrites the generated regions of the documentation: the text between `<!-- generated: name -->` and `<!-- /generated -->`.

Command resource-proxy fronts a service that knows nothing about sluis with a sluis resource server's front door: it verifies the caller's token, serves the RFC 9728 metadata, writes an audit line per request, and proxies to the service -- and, optionally, gives the service an identity of its own for what it calls in turn.

Command sluis is the whole product in one binary, one image and one chart (docs/decisions/0032), and one process: `sluis serve` is the issuer, the hub, the console and, beside them, the controllers its document names.

Command sluis-lambda is sluis as ONE AWS Lambda function: one arm64 `bootstrap` binary in one zip, deployed as one function that serves API Gateway events and runs the controllers' passes.

Command sluisctl is what a person on a laptop runs.