# Third-party and build-tool notices

This inventory is generated from `Package.swift`, `tools/package_dmg.sh`, and
`tools/air_toolchain.lock.json`. It separates Vela's restrictive source
licence from dependencies. No third-party code is relicensed by Vela.

| Component | Version / identity | Source | Class | Licence | Distribution and notice status |
| --- | --- | --- | --- | --- | --- |
| Apple system frameworks (SwiftUI, AVFoundation, Foundation, JavaScriptCore, MusicKit, Metal, VideoToolbox, Speech) | SDK selected by the build host | Apple SDK | Runtime framework, not copied into Vela.app | Apple SDK Agreement | Vela links platform frameworks supplied by Apple; no framework binary is redistributed in the Vela bundle. |
| AIR language bundle | 0.50.0; commit `3b16e1a20c00c6db0ed54711f52c8db483962400`; SHA-256 `b87212dcdc93020f5575d3b8f9e5915e2325bd6b96366c1c65b86de198dc7110` | Locked external toolchain | Build-only | Separately governed; not relicensed here | AIR is author-attributed in `AIR_NOTICE.md`; its compiler/source is not bundled in Vela.app or the DMG. |
| WABT | 1.0.39; npm integrity `sha512-ba+dRL/75VQQY7RkU/CgriGbkoWAfS8TDyUlJfJhJ8KhtXgMl5dhNvoPNUcQ9IWRhW8u41glMSuZeTvsYq2rRg==`; tree SHA-256 `5b3a39f668cca28a82ec68a3d41b5859a7872ee5a2b917f1a20cbacf062dd9e6` | `WebAssembly/wabt` npm package | Build-only | Apache-2.0 | Not copied into the application or DMG; used only to verify/build AIR artifacts. |
| dmgbuild | 1.6.7 | `dmgbuild/dmgbuild` Python package | Build-only | MIT | Not copied into the application or DMG; used only to create Finder layout. |

The official Vela binary contains Vela-owned AIR policy artifacts, not the AIR
compiler or WABT. Their hashes and package checks are retained in the release
provenance. A release gate rejects an unknown bundled binary or a dependency
missing from the SBOM.