Écluse
Écluse
An open-source supply-chain policy proxy for package registries: the controlled passage every dependency clears before it reaches your build.
What brought you here?
Start with the path that matches what you need. Each one leads from the short answer to the relevant detail.
Decide if it fits
Start with the problem and the policy-proxy bet, then compare the alternatives honestly.
Deploy and operate
Configure Écluse, connect npm, and lock down the deployment around it.
Understand the design
Use the architecture map to follow one concern down to its rationale.
Contribute
Enter the pinned development environment and take a change through the test gates.
Assess security
Review the security contract, invariants, and generated threat model.
Verify the provenance
Pin a release by digest, then verify its provenance and SBOM attestations against the public Rekor log.