# Third-party notices

**Status: public-beta candidate draft.**

Sandy Base Studio is built with third-party software. Exact resolved versions
are recorded in `pnpm-lock.yaml` and `src-tauri/Cargo.lock`.

Direct development and runtime dependencies include:

| Component | Role | Upstream license identifier |
| --- | --- | --- |
| Tauri and `@tauri-apps/cli` | Desktop framework and packaging tools | Apache-2.0 OR MIT |
| `crc32fast` | CRC-32 implementation | MIT OR Apache-2.0 |
| `hex` | Hexadecimal encoding | MIT OR Apache-2.0 |
| `rfd` | Native file dialogs | MIT |
| `serde` and `serde_json` | Rust serialization and JSON | MIT OR Apache-2.0 |
| `sha2` | SHA-2 hashing | MIT OR Apache-2.0 |
| `walkdir` | Directory traversal | Unlicense OR MIT |

Those packages include transitive dependencies and may include platform WebView
or operating-system components governed by separate terms. Garry's Mod,
Steam, `gmad`, and `gmpublish` are user-installed Valve software; Sandy Base
Studio locates and invokes them but does not redistribute them.

This draft is **not yet an exhaustive binary-distribution notice bundle**. A
public binary release remains blocked until the exact locked dependency graph
for every platform has been inventoried, every required copyright notice and
license text has been included, and the resulting bundle has been reviewed
against the files actually shipped. Do not replace upstream notices with this
summary.

Sandy Base Studio's own terms are in [LICENSE](LICENSE). Intro projects and
imported assets remain governed by their creators' and source assets' terms.