# Pinned plugin ABI headers

No plugin binaries or SDK runtime library are bundled. Updates are explicit,
reviewed source changes; ordinary builds never fetch from the network.

| Headers | Upstream revision | License | Maintenance/build impact |
| --- | --- | --- | --- |
| `clap/include` | [free-audio/clap](https://github.com/free-audio/clap), `a47f6badb49d948fd009998f28309cdab78979c9` | MIT, `clap/LICENSE` | Active CLAP header specification, pinned snapshot; C99 compile-time dependency only |
| `vst3/vst3_c_api.h` | [steinbergmedia/vst3_c_api](https://github.com/steinbergmedia/vst3_c_api), `93a116f7c6c52a317ec3aaee9b13789068b5234e` | BSD-3-Clause, `vst3/LICENSE.txt` | Official generated C ABI; review compatibility when updating the SDK snapshot; no C++ runtime adapter |

Files are unmodified upstream snapshots. The VST3 header's opening comment refers
to its accompanying license; that upstream license is retained verbatim. Install
and binary packages include both notices under the xtc license directory. These
headers define interoperability ABIs, not a grant to redistribute user plugins.

`src/plugin/vst2_abi.h` is original minimal Linux compatibility declarations; no
Steinberg VST2 SDK, implementation or VST2-wrapping SDK is copied or distributed.
Legacy VST2 support does not grant SDK/trademark/plugin distribution rights. There
is no VST2 plugin-building target for third-party SDKs. The original test fixture
implements only the ABI subset needed to test this host.

Optional full-SDK examples in `examples/steinberg` compile from explicitly
supplied external VST3/ASIO SDK roots. Normal builds do not fetch or link them;
no external SDK source or ASIO runtime is included in source/binary packages.
See [SDK integration and licenses](../examples/steinberg/README.md).

The optional `examples/juce` integration uses an external JUCE source root, not
vendored headers. The inspected JUCE 9.0.4 revision is AGPLv3/commercial; a
commercial licence may be required. Original example source does not relicense
JUCE or its dependencies. JUCE-linked outputs stay outside normal install and
package targets. See [JUCE dependency/license details](../docs/JUCE.md).

## CMake integration

The root CMake target `xtc-core` uses the pinned CLAP/VST3 directories as private
system include paths. No download step or SDK runtime is required. Configure
optional full SDK builds explicitly:

```sh
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
  -DXTC_BUILD_STEINBERG=ON -DXTC_VST3_SDK_ROOT=/path/to/vst3sdk \
  -DXTC_BUILD_JUCE=ON -DXTC_JUCE_ROOT=/path/to/JUCE
cmake --build build --parallel 3
ctest --test-dir build --output-on-failure -R 'steinberg|juce'
```

Leave both options off for normal builds. ASIO's native Windows diagnostic
retains its separate CMake configuration described in the Steinberg examples;
the Linux core is not a Windows/ASIO backend. See [BUILD.md](../docs/BUILD.md)
for target options and [RELEASING.md](../docs/RELEASING.md) for staging. The
owned install inventory retains the CLAP and VST3 C-header license notices;
JUCE/official SDK plugin binaries are excluded from normal install/package targets.