Deployment
macOS, web, mobile.
SLUICE runs on the operator's own machine. There is nothing to deploy to a server: you build the console for the platform you work on. Store builds are optional.
01macOS (recommended for operators)
On macOS the Helius key is kept in the login Keychain, which works with the ad-hoc signature the project ships with; no signing team is needed for it. The app is sandboxed with com.apple.security.network.client in both macos/Runner/*.entitlements files, so it can reach your RPC endpoint. Pick your own team under Runner → Signing & Capabilities in Xcode (the project ships with none). Then:
flutter build macos --release --dart-define=SLUICE_OPERATOR_PASSCODE=choose-your-ownThe app is in build/macos/Build/Products/Release/. To give it to other people, sign and notarise it with your Apple Developer account. The macOS build was not run for these docs.
02Web
flutter build web --release --dart-define=SLUICE_OPERATOR_PASSCODE=choose-your-ownThe result is in build/web/; upload its contents to any static host. This build was run for these docs with Flutter 3.41.4 and finished without errors. --wasm does not build in 1.0.0.
Anyone who opens it meets the passcode screen first; with the passcode, each visitor gets their own console in their own browser, and your projects, rounds and balance samples stay on the device that created them. In a browser the endpoints and the Helius key are kept for the session only, never in browser storage. Host it for yourself or your team. To show holders how a round was computed, publish its Audit bundle · JSON export.
Content-Security-Policy
web/index.html carries a Content-Security-Policy without 'unsafe-inline' or 'unsafe-eval'. 'wasm-unsafe-eval' and https://www.gstatic.com are the Flutter engine (CanvasKit); the two sha256- style hashes are style attributes the engine sets; connect-src https: wss: lets the console reach whichever RPC provider you use. The boot screen is in web/boot.css and web/boot.js. If you add an inline <script> or <style> to index.html, the browser refuses it: put it in a file instead.
The public demo build
tool/build_web_demo.sh builds the demo: demo mode (SLUICE_DEMO=true: a DEMO strip, one sample round computed by the product, at the current slot or time-weighted over 30 days of sample balances, no RPC endpoint, read-only operator settings) and the published passcode sluice-demo. It first runs test/demo/demo_dry_run_test.dart in demo mode, and refuses to finish without demo mode, the gate and the CSP. tool/verify_demo_absent.sh checks that a normal release build contains none of the sample data.
03Android and iOS
Both targets build; the console is designed for wide screens and has a compact layout for phones.
flutter build appbundle --release --dart-define=SLUICE_OPERATOR_PASSCODE=choose-your-own # Android: build/app/outputs/bundle/release/app-release.aab
flutter build ipa --release --dart-define=SLUICE_OPERATOR_PASSCODE=choose-your-own # iOS: build/ios/ipa/Android release builds are signed with the debug key until you add your own (android/app/build.gradle.kts; see the Flutter guide). For iOS pick your Team in Xcode (the project ships with an empty DEVELOPMENT_TEAM). Without SLUICE_OPERATOR_PASSCODE the app has no console. These builds were not run for these docs (unverified on this machine).
04Version numbers
pubspec.yaml has version: 1.0.0+1. The console shows SluiceVersion.number from lib/app/sluice_version.dart; change both together.