Experimental software. Omnipair V2 (Dusk) is unaudited, incomplete, and under active development. It is published for research, review, and testing only. Do not deploy it to mainnet, integrate it in production, or use it with real funds until the implementation, tests, audits, and launch process are complete.

Omnipair V2 (Dusk)

Dusk is the Omnipair V2 protocol architecture: an oracle-less lending protocol on Solana.

Dusk is the next generation of Omnipair: a standalone market program that brings swaps, lending, yield-bearing liquidity, leveraged LP vaults, and isolated spot-margin leverage into one capital-efficient protocol without relying on external price oracles.

Overview

Omnipair's GAMM (Generalized Automated Market Maker) combines an AMM with an integrated lending market. Dusk markets can use exact constant product or the optional oracle-less Dusk Concentrated AMM with amplified near-center depth and exact CPMM tails. Liquidity providers deposit both sides of a pair, traders swap against the unified reserves, and borrowers can use one side of the market as collateral to borrow the other.

Dusk keeps that core Omnipair GAMM idea and rebuilds it around a market-native account model:

• Oracle-less markets: pricing and risk use in-protocol reserve state, EMA books, and conservative settlement references instead of external oracle feeds.
• Optional autonomous concentration: the Dusk Concentrated AMM concentrates depth around an internal center and recenters only through its funded bounded controller during genuine user operations. Governance can switch the curve shape to or from exact CPMM.
• Path-aware bounded fees: an outward divergence surcharge targets trending inventory stress while a separate volatility surcharge prices repeated chop. Each component has an explicit gross-input budget, and aggregate fees can never exceed 50% of the trader's input.
• Unified liquidity and lending: LP inventory backs both swaps and borrow demand, letting capital serve multiple protocol flows.
• Standalone Dusk program: Dusk has its own program ID, IDL, account model, event surface, and SDK helpers.
• Yield-bearing LP shares: yLP represents a two-sided liquidity claim while reserve-side yield is checkpointed through base and quote growth indexes.
• Leveraged LP vaults: base and quote hLP mints are aggregate hedged LP vault shares that target one-sided market exposure while their yLP ownership and funding debt are reconstructed at the trader's quoted endpoint.
• Isolated leverage: traders can open market-local leverage positions that borrow one side, swap through the GAMM, hold the opposite side as collateral, delegate TP/SL close execution, and liquidate through the same reserve accounting.
• Permissioned referral revenue sharing: Futarchy-listed referrers can bind to new borrow or leverage debt and earn a configured share of the DAO's realized interest revenue without changing borrower debt or rates.
• Cached risk books: risk checks roll EMA values from cached observations so settlement does not depend on a same-instruction manipulated spot.
• Permissionless atomic liquidation: buyers receive collateral and owe a fixed net payment in the same transaction. Useful partial fills come first, with a 0.5–5% discount based only on current health, without a registration transaction. At critical EMA health, partial-first internal AMM recovery uses a caller reward capped at 1%, principal-only insurance and residual LP loss absorption; there is no mandatory auction wait.

How It Works

Each Dusk market is defined by a base mint, quote mint, and market parameters. The market records principal reserves, fee and interest liabilities, borrower debt, yield accounts, and aggregate hLP vault state.

Liquidity providers
  deposit base + quote
  receive yLP
  claim swap fees and borrow interest through yield indexes

Traders
  swap base <-> quote
  split LP-owned fees between governed reserve compounding and claimable yield
  trigger O(1) hLP vault checkpoints when needed

Borrowers
  deposit collateral
  borrow the opposite market asset
  receive a stored liquidation CF under V1-style dynamic underwriting

hLP users
  deposit one market asset
  receive aggregate leveraged LP vault shares
  close by burning hLP and settling the vault's funding debt

Leverage users
  deposit margin in one market asset
  borrow the same debt side internally
  swap borrowed notional into the opposite collateral asset
  repay, unwind, or get liquidated against market-local reserves

Referrers
  are listed by Futarchy as protocol-wide ReferralPartners with an interest share
  bind that partner when a borrower or leverage user opens new debt
  accrue a share of realized DAO interest revenue per market and mint
  claim accrued revenue to the partner's designated recipient

Direct yLP holders
  burn-lock at least 1% of eligible direct yLP to sponsor a typed parameter proposal
  add support until the proposal holds strictly more than 50% of eligible direct yLP
  wait through a seven-day timelock before permissionless execution
  withdraw any collecting support, fully or partially, before it queues
  release queued support after execution, expiry, or staleness
  optionally fund a reusable governance balance and appoint one delegate per market
  retain ownership and yield while a delegate creates or supports proposals

Token Model

Dusk markets use Token-2022 mints for protocol LP surfaces:

Token	Meaning
yLP	Floating two-sided LP share for normal liquidity providers
base hLP	Aggregate leveraged LP vault share targeting base exposure
quote hLP	Aggregate leveraged LP vault share targeting quote exposure

Normal LPs enter with add_liquidity, depositing both assets at the current market ratio:

asset_claim = user_ylp_shares * live_reserve / total_ylp_supply

A governed share of the LP-owned base fee and non-retained dynamic surcharge may compound into ordinary reserve principal. The remainder is claimable yield: swap-fee liabilities stay physically in the reserve vault as swap_fee_custody_balance, outside executable cash_reserve, while interest liabilities stay in the side-specific interest vault. Public-borrow interest uses the all-yLP growth lane, while hLP funding interest uses a separate non-hLP denominator and source-specific rounding carry. The LP owner, designated yield recipient, or separately designated harvest authority may trigger harvest; payment goes only to the recipient's canonical associated token account. Only the LP owner may change the recipient or set, rotate, and revoke the harvest authority. Dynamic surcharge retained while recenter protection is being funded enters a custody-backed, non-quoteable Base/Quote bucket; a later admitted recenter deploys that bucket, and ordinary yLP withdrawals cannot claim it.

Isolated Leverage

Dusk also includes isolated spot-margin leverage. A leverage position is a market-local account owned by the user:

user margin + isolated borrow
  -> internal GAMM swap
  -> collateral held in a leverage collateral vault
  -> debt tracked in isolated debt buckets

Users can increase or decrease exposure, add or remove margin, close the position, or be liquidated if symmetric-EMA equity falls below the position's stored maintenance requirement. Isolated debt contributes to utilization and interest accrual, but it is kept separate from normal borrower debt and hLP vault debt.

Leverage stores liquidity-scaled maintenance bands and an entry-equity obligation per position. Other traders and LP activity do not passively change those terms. New risk uses progressive size margins and aggregate same-side exposure across all owners; margin extraction retains the admission obligation. Partial closure releases it proportionally. The former fixed 2% unwind-impact admission guard is removed; executable and reference equity checks still apply. See the stored-margin contract.

Owners can also approve a leverage delegate program for a position. The delegate flow uses a before-hook approval and after-hook settlement approval, so keepers can execute bounded partial or full take-profit and stop-loss closes. Dusk pays a bounded protocol fee and executor incentive from the realized residual, then sends the remainder directly to a token account owned by the position owner. A delegate cannot redirect the owner's payout to its own custody.

Permissioned Referral Revenue Sharing

Futarchy may list any wallet or application as a referrer and configure its share of protocol interest revenue. A listed partner can be supplied when a borrow debt side is first opened or when a leverage position is opened. Dusk snapshots the capped share at that point. The partner and snapshotted share remain bound until the debt side is fully repaid or the leverage position closes; increasing existing debt cannot replace or reprice them. Deactivating a partner blocks new bindings only, so existing positions retain their agreed referral economics.

Referral never increases principal, debt, interest, LTV utilization, or liquidation risk. Borrowers receive and owe the same amounts as unreferred borrowers. When an interest payment credits the market interest vault, Dusk calculates:

protocol_interest_revenue = floor(actual_interest_vault_credit * protocol_interest_bps / 10_000)
bound_referral_share      = min(partner_share_bps, runtime_cap_bps) at initial binding
referral_accrual          = floor(protocol_interest_revenue * bound_referral_share / 10_000)

Later partner, cap, or active-status changes apply only to new bindings. The referral amount is carved only from the DAO's configured share of realized interest; LP allocations are unchanged. Using actual vault credit keeps Token-2022 transfer fees from creating an unbacked claim.

Each ReferralAccrual is scoped to one partner, market, and asset mint. Funds remain in the market interest vault while the account records the claimable liability. The partner authority may rotate its designated recipient, and claim_referral_interest pays that recipient using the asset mint's SPL Token or Token-2022 program.

hLP Vaults

Each market maintains two aggregate hLP vaults:

• hLP_base: users deposit base and the vault funds the quote leg.
• hLP_quote: users deposit quote and the vault funds the base leg.

Opening an hLP position mints vault shares against current aggregate vault NAV, including the hLP-owned yLP claim on accrued public interest. A cached settlement price or NAV does not set the deposit share price. The target-side deposit is reserve cash; the funded side is tracked as hLP funding debt and an explicit hLP live-reserve component:

user target asset
  -> hLP vault records opposite-side funding debt
  -> market credits balanced live reserves
  -> vault receives yLP
  -> user receives hLP_target

Closing burns hLP shares, removes the vault's proportional yLP liquidity, repays funding debt, realizes any interest from borrowed-side cash, and returns remaining target-side inventory to the user.

hLP funding debt bears the full indexed borrow rate without a self- or cross-hLP rebate. When that funding interest is paid, Dusk measures the net interest-vault token credit, applies the configured protocol split, and indexes the remaining LP amount only over non-hLP yLP supply frozen for the operation. Both hLP vaults are excluded. Permanently burned MIN_LIQUIDITY remains in the denominator; if no ordinary yLP holder exists, it is the complete backed sink, so a later deposit cannot capture previously paid interest. This is deliberate payment-time ownership: ordinary yLP present at the operation snapshot participates, while ordinary yLP that exits beforehand does not. Public-borrow interest and swap fees retain their ordinary all-yLP eligibility rules.

Active hLP uses the market's exact applied CPMM or concentrated curve. For an active-hLP swap or swap-like leverage operation, Dusk freezes the ordinary trader-facing reserves, quotes the trade and fees on that curve, then reconstructs both hLP vaults' yLP ownership and indexed funding debt algebraically at the accepted endpoint. A live-basis yLP burn also realizes the burned shares' accrued-but-unpaid interest entitlement inside that integrated endpoint calculation. The accepted path bounds each vault's deposited-asset principal plus frozen public-interest claim to the larger of one raw target atom and one part per million of its operation-start economic NAV. hLP funding interest is excluded because neither hLP is eligible for that source. A material unconverged or cap-bound worsening swap fails closed. Every positive funding transition also keeps aggregate indexed hLP debt within the borrowed asset's current cash. If passive funding growth exhausts the vault, close_insolvent_hlp retires its yLP, applies caller-bounded insurance and socialization, and pays a bounded caller bounty from recovered funding interest before crediting the remaining interest to ordinary yLP.

When one hLP vault has negative executable value, Dusk freezes that vault's automatic hedge, retaining its shares, funded reserve and indexed debt as an explicit claim. Spot swaps continue on the remaining executable curve and the other hLP vault keeps its hedge. A frozen vault cannot make an ordinary exit that would leave its deficit with the remaining holders. Its permissionless terminal close uses the existing insurance and principal writeoff waterfall, with eligibility determined by its current-slot linear symmetric-EMA value. Native terminal recovery values the target claim through the same symmetric-EMA, curve_depth_ema_nad, configured-concentration and full-fee reference curve as other internal emergency liquidations; it does not use the live reserve ratio to determine repayment or writeoff. The real inventory endpoint is still rebuilt after close, so the accepted post-settlement inventory/arbitrage risk remains. External flash terminal recovery instead uses the buyer's actual fixed payment and the borrowed-token yLP claim frozen at begin, so routing collateral through Dusk in the middle cannot move the session's recovery accounting. Once closed, holders can burn their hLP receipts for zero principal payout; the SDK can compose the close and burn in one transaction. A frozen vault whose value recovers can use funded flash rescue to restore its hedge and permit an ordinary holder exit, even if its debt gap is below the usual rescue threshold.

Direct Token-2022 burns bypass transfer hooks. Dusk lazily reconciles a partial hLP burn before the next hLP deposit or withdrawal: existing nested yield is checkpointed against the old supply, the smaller nonzero live supply becomes the pricing denominator, and the burned principal benefits remaining holders. Burning the entire live hLP supply is unrecoverable and leaves that hLP side fail-closed; there is intentionally no asynchronous recovery instruction or governance sweep. Clients should always exit through Dusk's withdrawal instruction.

Risk Model

Dusk is designed around market-local risk accounting:

• Lending is isolated by market.
• Individual health and liquidation use all collateral held by the position and its stored liquidation CF.
• Debt-capped global-health contributions improve new-borrow underwriting without locking collateral or changing existing terms.
• Pessimistic depth is the lower of observed curve depth and its EMA. Public borrowing uses only the full-range CPMM tail at the lower of symmetric and directional price EMAs. Borrowing and leverage liquidatability use linear symmetric-EMA value. Ordinary flash payment is fixed from that value and the bounded discount. Emergency AMM execution is separately gated at 70% of maintenance; its execution price does not make a reference-healthy position liquidatable.
• Isolated leverage has its own position state and debt buckets.
• Price and risk books use cached EMA state to reduce same-transaction spot manipulation.
• hLP entries price shares from current economic NAV. The hedge-state and funding checks still apply; accrued public interest is included in share value but excluded from executable AMM reserves.
• Swaps stay live when hLP leverage-up is cash-constrained; unexecuted rebalance is stored as residual_exposure.
• Each debt asset has one shared 24-hour leaky/token bucket for gross new principal issued through public lending borrow. Isolated leverage and direct or automatic hLP funding do not consume it because they do not lend cash out. For a fixed absolute limit, refill is independent of checkpoint frequency; repayments and exits do not refund flow capacity, and the bucket is not an exact trailing-window sum. Changes in conservative market depth may resize the bps-derived absolute limit.
• The borrow admission floor, shared borrow-flow limits, insurance, and LP socialization bound how losses move through the system.

Instruction Surface

Dusk exposes simple market actions:

initialize_market
initialize_yield_accounts
initialize_lp_transfer_hook
set_market_reduce_only
fortify_market
create_parameter_proposal
support_parameter_proposal
queue_parameter_proposal
execute_parameter_proposal
withdraw_parameter_support
manage_governance_balance
set_governance_delegate
create_governance_proposal
support_governance_proposal
withdraw_governance_support
add_liquidity
open_liquidity_gates
remove_liquidity
set_yield_recipient
set_harvest_authority
harvest
swap
close_insolvent_hlp
deposit_collateral
withdraw_collateral
borrow
repay
configure_referral_partner
initialize_referral_accrual
set_referral_recipient
claim_referral_interest
preview_liquidation_health
preview_flash_liquidation
begin_flash_liquidation
settle_flash_liquidation
preview_emergency_liquidation
emergency_liquidation
deposit_single_sided
withdraw_single_sided
open_leverage
close_leverage
delegated_close_leverage
increase_leverage
decrease_leverage
add_leverage_margin
repay_leverage
withdraw_repaid_leverage
create_leverage_delegation
update_leverage_delegation
close_leverage_delegation
preview_market
preview_hlp_order_trigger
preview_add_liquidity
preview_swap
preview_borrow_capacity
preview_borrow_position

Futarchy and protocol revenue administration:

init_futarchy_authority
update_futarchy_authority
update_protocol_revenue
update_revenue_recipients
update_protocol_auction_config
update_protocol_auction_recipients
update_protocol_auction_route
set_global_reduce_only
settle_protocol_auction

LP governance supports direct wallet locks and reusable owner balances. An owner may appoint one delegate per market to create and support proposals, combining authorized owners' contributions to meet sponsorship atomically. Each owner's allocation remains separate. Collecting support can be released partially or fully; queued support follows the existing lock rules. Revocation is immediate and does not unlock queued support. Only the owner can withdraw idle shares or claim yield, and the same shares cannot support multiple proposals. SDK builders and examples are in the governance guide.

Market parameters are deliberately split into seven typed proposal families: fees, concentration shape, IRM, EMA half-lives, the daily borrow limit, the center controller, and insurance draw caps. A proposal snapshots that family's revision, so execution becomes stale if another proposal changes the same family first. Execution is blocked at 80% utilization, while repayments, liquidations, collateral additions, and cash-available LP exits remain live. Fee parameters are bounded to a combined 5,000 bps gross-input budget; IRM defaults are 70% target utilization, 4x curve steepness, and adjustment speed 20/year.

Protocol-auction settlement always specifies both lane (fee or buyback) and source (swap or interest). The source is never inferred: swap revenue is sold from reserve-vault custody and debits the matching swap-fee liability; interest revenue is sold from the side-specific interest vault and debits the matching interest-fee liability.

Auction configuration is intentionally retroactive for unsettled inventory: the local lane/source epoch keeps its original start slot, but settlement uses the current accepted mint, price parameters, reference-age limit, and recipients. An accepted-mint change may pause a market until governance updates its route; no historical config version is stored per inventory epoch.

Integrator Notes

Dusk is a standalone program and should be integrated through its own IDL, program ID, and market account model:

• Use the Dusk IDL and market PDAs for markets.
• Do not sort Dusk market mints client-side. The creator's base_mint and quote_mint order defines the market and its price direction.
• Treat yLP and hLP mints as distinct Token-2022 token concepts. yLP is the two-sided normal LP token; hLP tokens are aggregate leveraged LP vault shares.
• Use the referral builders for referred debt actions so the partner and accrual PDAs are included atomically.
• Use the parameter-proposal builders so sponsorship/support burns, virtual-yield checkpoints, proposal/support PDAs, and terminal remints remain atomic.
• Consume Dusk events from the standalone IDL, including market, liquidity, swap, debt, liquidation, yield, hLP, leverage, leverage-delegation, and referral events.

Core Invariants

Dusk keeps a live reserve coordinate for each side of the market:

R_live[i] = R_cash[i] + D_cash_backed[i] + R_hLP_live[i]

where i is base or quote. Without hLP live depth this collapses to the V1 GAMM reserve invariant:

R_live[i] = R_cash[i] + D_cash_backed[i]

That gives Dusk the same normal lending behavior as V1: cash-backed borrow decreases cash and increases debt by the same amount, so borrowing does not move the GAMM price.

borrow a:
  R_cash[i]        -= a
  D_cash_backed[i] += a
  R_live[i]         unchanged

hLP adds a named synthetic live-reserve coordinate, not an unnamed exception. hLP funding debt is part of total utilization and accrues interest, but it is not same-side cash-backed reserve debt:

D_total[i] = D_cash_backed[i] + D_hLP_funding[i]

Only D_cash_backed expands R_live through normal cash-backed interest accrual. hLP funding interest is carried as a full hLP debt/NAV cost and is paid only to non-hLP yLP after the configured protocol split. Automatic deleverage carves the payment from the paying hLP's borrowed-asset yLP burn leg rather than applying an additional shared-live debit. If that leg is short, the exact applied curve converts only the required part of the payer's target leg into the borrowed asset.

When both assets carry the same proportional unpaid-interest load, hLP rebalancing moves both executable reserve sides proportionally:

dR_hLP_live[base]  / R_live[base]
= dR_hLP_live[quote] / R_live[quote]

P = R_live[quote] / R_live[base]
P' = P

That special case preserves spot, but not depth: finite swap quotes can change when hLP live depth changes. A live-basis yLP burn also realizes the burned shares' unpaid-interest entitlement. If that entitlement is asymmetric across the assets, executable reserves move non-proportionally and the quote starts from the resulting price, exactly as for ordinary yLP redemption. Swap-triggered hLP updates are therefore quote-aware and O(1), and never iterate over user positions.

Other invariants:

• yLP supply is backed by reserve-side principal accounting.
• No operation mints yLP without corresponding reserve value.
• yLP principal reserves exclude reserve-custodied swap-fee liabilities and interest-vault balances.
• Physical reserve custody is at least cash_reserve + swap_fee_custody_balance + base_hlp_backing_inventory + quote_hlp_backing_inventory. Protocol transitions conserve the accounted amount exactly; unsolicited donations remain non-executable. Interest liabilities are separately backed by the interest vault.
• Synthetic hLP live reserve is not directly withdrawable cash; swaps, withdrawals, debt repayment, and interest realization are still constrained by cash reserves.
• Every hLP funding increase must keep aggregate indexed funding debt within current borrowed-asset cash. Terminal exhausted-vault recovery is separate and permissionless through close_insolvent_hlp, with caller-supplied insurance and socialized-loss bounds.
• Dusk does not enforce R_hLP_live[i] <= D_hLP_funding[i] per asset; hLP live depth is a balanced GAMM coordinate, not a standalone per-asset liability.
• hLP debt shares stay matched to aggregate hLP vault funding debt.
• hLP operations never use yLP-denominated debt.
• Isolated leverage debt contributes to utilization without contaminating normal borrower health checks.
• Referral binding never changes principal, debt, interest, health, or liquidation terms; referral claims are bounded liabilities carved from realized protocol interest revenue.
• Referral claims can only debit the matching ReferralAccrual from its market interest vault and pay a token account owned by the partner's current designated recipient.
• Leverage collateral vault balances are matched by open leverage position collateral accounting.
• Delegated close requires both a close approval payload and a settlement approval payload from the approved delegate program.

Changed Invariants From GAMM V1

The core GAMM reserve/lending relationship is preserved, while the swap invariant is now configurable:

• The market is still priced from in-protocol reserves, not external oracles.
• One-times peak_amplification with zero widths is exact V1-style CPMM; larger values add concentrated depth while preserving a nonzero full-range CPMM tail.
• core_half_width sets the full-depth region around the sticky center and fade_width sets the half-depth shoulder before the tail. The tail/concentrated allocation is derived from these widths and peak_amplification; fee, EMA, and recenter controls remain separate.
• Swaps and leverage use the live applied curve. Public borrowing uses a full-range-tail CPMM shadow; lending liquidatability is linear at the symmetric price EMA. Ordinary flash settlement binds a discounted EMA payment; emergency settlement uses the live concentrated curve within explicit health and partial/full-close permissions. See the liquidation contract.
• Normal borrow and repay paths still preserve R_live = R_cash + D_cash_backed.
• Cash constraints still matter: virtual depth can quote, but only cash can leave vaults or settle realized liabilities.
• LP minting and burning still use the V1-style proportional reserve math with permanently locked minimum liquidity.
• The governed compounded share of LP-owned base and distributed dynamic fees enters ordinary principal. The remaining claimable swap fees stay reserve-custodied outside executable cash, while borrow interest stays in the interest vault.
• Dynamic surcharge may be retained for protected recentering, compounded under the fee profile, or distributed as claimable yield; those buckets are accounted separately.

Dusk extends the invariant set where hLP needs curve-aware one-sided hedging:

• V1 had no hLP component, so R_hLP_live = 0.
• Dusk allows only hLP transitions to mutate R_hLP_live.
• hLP leverage-up/deleverage uses the same live-basis share accounting as yLP redemption. It changes only depth when unpaid-interest loads are proportional, and otherwise also reprices the executable curve before the authoritative quote.
• hLP funding debt affects utilization and funding cost, aggregate cash admission constrains new funding, and close_insolvent_hlp handles a terminal exhausted-vault waterfall without allowing loss to reach original principal.
• Cash-constrained hLP leverage-up does not block swaps; unexecuted rebalance is carried as residual_exposure.

Program ID

Status	Program ID
Dusk source / devnet	JA8Zxxm4t4zopBL8e3dQQXWfQ3a5pBUPY9Sp9RnybV2X
Leverage delegate source / devnet	AXNfmZt5e1UM4daeTzW3H7zNo4boobBcnFm8RzJYxvAv
Devnet faucet	EMmV9HKeQndxFd4duqp65rUSjikVWCPakBH1UjJJ32dz

Verification

Core Omnipair V2 (Dusk) verification gates:

node scripts/prepare_build.js
anchor build -p dusk
anchor build -p leverage_delegate
cargo fmt -p dusk -- --check
cargo check -p dusk --lib
cargo test -p dusk --lib -- --nocapture
cargo test -p leverage_delegate
npm run check-idl-current --prefix packages/dusk-sdk
npm run build --prefix packages/dusk-sdk
yarn test-litesvm

Run the dusk-sdk build whenever public IDL, account, event, seed, or instruction shapes change. check-idl-current must pass after anchor build -p dusk so committed client files match the generated build artifacts.

On a clean checkout, run node scripts/prepare_build.js before any Anchor command. Anchor 0.31.1's configuration discovery otherwise creates new program keys and rewrites the declared IDs when target/deploy is absent. The yarn build:litesvm and yarn v2:build-*-devnet commands include this preparation. yarn check:build-identity exercises Anchor in a disposable fresh workspace and verifies that the source declarations and devnet configuration stay unchanged. No local RPC or validator is required.

Security And Status

Dusk is the standalone market program for Omnipair V2.

Before Dusk is treated as production-ready, it should complete final security review, release artifact verification, and owner signoff for app, SDK, indexing, analytics, aggregators, and deployment.