# Pinned plugin ABI headers

No plugin binaries or SDK runtime library are bundled. Updates are explicit,
reviewed source changes; ordinary builds never fetch from the network.

| Headers | Upstream revision | License | Maintenance/build impact |
| --- | --- | --- | --- |
| `clap/include` | [free-audio/clap](https://github.com/free-audio/clap), `a47f6badb49d948fd009998f28309cdab78979c9` | MIT, `clap/LICENSE` | Active CLAP header specification, pinned snapshot; C99 compile-time dependency only |
| `vst3/vst3_c_api.h` | [steinbergmedia/vst3_c_api](https://github.com/steinbergmedia/vst3_c_api), `93a116f7c6c52a317ec3aaee9b13789068b5234e` | BSD-3-Clause, `vst3/LICENSE.txt` | Official generated C ABI; review compatibility when updating the SDK snapshot; no C++ runtime adapter |

Files are unmodified upstream snapshots. The VST3 header's opening comment refers
to its accompanying license; that upstream license is retained verbatim. Install
and binary packages include both notices under the xtc license directory. These
headers define interoperability ABIs, not a grant to redistribute user plugins.

`src/plugin/vst2_abi.h` is original minimal Linux compatibility declarations; no
Steinberg VST2 SDK, implementation or VST2-wrapping SDK is copied or distributed.
Legacy VST2 support does not grant SDK/trademark/plugin distribution rights. There
is no VST2 plugin-building target for third-party SDKs. The original test fixture
implements only the ABI subset needed to test this host.

Optional full-SDK examples in `examples/steinberg` compile from explicitly
supplied external VST3/ASIO SDK roots. Normal builds do not fetch or link them;
no external SDK source or ASIO runtime is included in source/binary packages.
See [SDK integration and licenses](../examples/steinberg/README.md).

The optional `examples/juce` integration uses an external JUCE source root, not
vendored headers. The inspected JUCE 9.0.4 revision is AGPLv3/commercial; a
commercial licence may be required. Original example source does not relicense
JUCE or its dependencies. JUCE-linked outputs stay outside normal install and
package targets. See [JUCE dependency/license details](../docs/JUCE.md).