Preserve multi-source provider provenance

Cargo.toml

@@ -15,4 +15,4 @@ serde_json = "=1.0.151"
 sha2 = "=0.11.0"
 stack-compiler = { git = "https://github.com/stack-sh/compiler.git", rev = "4a18fac42afc2256a1bb3a6ff13d12d732a391e7" }
 stack-formatter = { path = "crates/stack-formatter" }
-stack-theme = { git = "https://github.com/stack-sh/theme.git", rev = "2347315e6e86ab9d2708e05fd3f9b5f3d87e1241" }
+stack-theme = { git = "https://github.com/stack-sh/theme.git", rev = "7e208d6a3c90d255799f390a4e8b86248c73caee" }

crates/stack-engine-wasm/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "stack-engine-wasm"
-version = "0.5.0"
+version = "0.6.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/stack-engine-wasm/src/lib.rs

@@ -70,6 +70,8 @@ pub struct ProviderNotice {
     pub archive_sha256: String,
     /// Provider terms URL.
     pub terms_url: String,
+    /// Every audited archive that contributed to this pack.
+    pub sources: Vec<ProviderNoticeSource>,
     /// User-visible attribution.
     pub attribution: String,
     /// User-visible terms summary.
@@ -88,6 +90,30 @@ pub struct ProviderNoticeIcon {
     pub id: String,
     /// Official provider product name.
     pub product_name: String,
+    /// Rights-owner source for this brand icon, when the archive is multi-brand.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub brand_source_url: Option<String>,
+    /// Rights-owner usage guidelines for this brand icon, when available.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub brand_guidelines_url: Option<String>,
+    /// Pack-local source ID, or `primary` for the primary source.
+    pub source_id: String,
+}
+
+/// JavaScript-facing audited provider source.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ProviderNoticeSource {
+    /// Pack-local source ID.
+    pub id: String,
+    /// Official source page.
+    pub page_url: String,
+    /// Audited upstream release identifier.
+    pub release: String,
+    /// Complete official source archive SHA-256.
+    pub archive_sha256: String,
+    /// Terms reviewed for this source.
+    pub terms_url: String,
 }
 
 #[derive(Deserialize)]
@@ -305,6 +331,11 @@ impl From<stack_engine::ProviderNotice> for ProviderNotice {
             source_release: notice.source_release,
             archive_sha256: notice.archive_sha256,
             terms_url: notice.terms_url,
+            sources: notice
+                .sources
+                .into_iter()
+                .map(ProviderNoticeSource::from)
+                .collect(),
             attribution: notice.attribution,
             terms_summary: notice.terms_summary,
             non_endorsement: notice.non_endorsement,
@@ -322,6 +353,21 @@ impl From<stack_engine::ProviderNoticeIcon> for ProviderNoticeIcon {
         Self {
             id: icon.id,
             product_name: icon.product_name,
+            brand_source_url: icon.brand_source_url,
+            brand_guidelines_url: icon.brand_guidelines_url,
+            source_id: icon.source_id,
+        }
+    }
+}
+
+impl From<stack_engine::ProviderNoticeSource> for ProviderNoticeSource {
+    fn from(source: stack_engine::ProviderNoticeSource) -> Self {
+        Self {
+            id: source.id,
+            page_url: source.page_url,
+            release: source.release,
+            archive_sha256: source.archive_sha256,
+            terms_url: source.terms_url,
         }
     }
 }
@@ -466,6 +512,17 @@ export interface RenderResult {
 export interface ProviderNoticeIcon {
   readonly id: string;
   readonly productName: string;
+  readonly brandSourceUrl?: string;
+  readonly brandGuidelinesUrl?: string;
+  readonly sourceId: string;
+}
+
+export interface ProviderNoticeSource {
+  readonly id: string;
+  readonly pageUrl: string;
+  readonly release: string;
+  readonly archiveSha256: string;
+  readonly termsUrl: string;
 }
 
 export interface ProviderNotice {
@@ -476,6 +533,7 @@ export interface ProviderNotice {
   readonly sourceRelease: string;
   readonly archiveSha256: string;
   readonly termsUrl: string;
+  readonly sources: readonly ProviderNoticeSource[];
   readonly attribution: string;
   readonly termsSummary: string;
   readonly nonEndorsement: string;
@@ -631,6 +689,17 @@ fn provider_notices_to_js(notices: Vec<ProviderNotice>) -> Result<JsValue, JsVal
         set(&item, "sourceRelease", notice.source_release.into())?;
         set(&item, "archiveSha256", notice.archive_sha256.into())?;
         set(&item, "termsUrl", notice.terms_url.into())?;
+        let sources = Array::new();
+        for source in notice.sources {
+            let source_item = Object::new();
+            set(&source_item, "id", source.id.into())?;
+            set(&source_item, "pageUrl", source.page_url.into())?;
+            set(&source_item, "release", source.release.into())?;
+            set(&source_item, "archiveSha256", source.archive_sha256.into())?;
+            set(&source_item, "termsUrl", source.terms_url.into())?;
+            sources.push(&source_item);
+        }
+        set(&item, "sources", sources.into())?;
         set(&item, "attribution", notice.attribution.into())?;
         set(&item, "termsSummary", notice.terms_summary.into())?;
         set(&item, "nonEndorsement", notice.non_endorsement.into())?;
@@ -639,6 +708,17 @@ fn provider_notices_to_js(notices: Vec<ProviderNotice>) -> Result<JsValue, JsVal
             let icon_item = Object::new();
             set(&icon_item, "id", icon.id.into())?;
             set(&icon_item, "productName", icon.product_name.into())?;
+            if let Some(brand_source_url) = icon.brand_source_url {
+                set(&icon_item, "brandSourceUrl", brand_source_url.into())?;
+            }
+            if let Some(brand_guidelines_url) = icon.brand_guidelines_url {
+                set(
+                    &icon_item,
+                    "brandGuidelinesUrl",
+                    brand_guidelines_url.into(),
+                )?;
+            }
+            set(&icon_item, "sourceId", icon.source_id.into())?;
             icons.push(&icon_item);
         }
         set(&item, "icons", icons.into())?;

crates/stack-engine/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "stack-engine"
-version = "0.5.0"
+version = "0.6.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true

crates/stack-engine/src/lib.rs

@@ -448,6 +448,8 @@ pub struct ProviderNotice {
     pub archive_sha256: String,
     /// Provider terms reviewed for this pack.
     pub terms_url: String,
+    /// Every audited archive that contributed an icon to this pack.
+    pub sources: Vec<ProviderNoticeSource>,
     /// User-visible attribution text.
     pub attribution: String,
     /// User-visible terms summary.
@@ -465,6 +467,27 @@ pub struct ProviderNoticeIcon {
     pub id: String,
     /// Official provider product name.
     pub product_name: String,
+    /// Rights-owner source for this brand icon, when the archive is multi-brand.
+    pub brand_source_url: Option<String>,
+    /// Rights-owner usage guidelines for this brand icon, when available.
+    pub brand_guidelines_url: Option<String>,
+    /// Pack-local source ID, or `primary` for the primary source.
+    pub source_id: String,
+}
+
+/// One audited archive listed in a rendered-artifact notice.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderNoticeSource {
+    /// Pack-local source ID. The primary source always uses `primary`.
+    pub id: String,
+    /// Official source page.
+    pub page_url: String,
+    /// Audited upstream release identifier.
+    pub release: String,
+    /// Complete official source archive SHA-256.
+    pub archive_sha256: String,
+    /// Terms reviewed for this source.
+    pub terms_url: String,
 }
 
 /// Engine-owned portable diagnostic shared by native and future WASM outputs.
@@ -614,7 +637,7 @@ mod tests {
                 output.metadata.language_version,
                 Some(LanguageVersion { major: 1, minor: 0 })
             );
-            assert_eq!(output.metadata.theme_catalog_version, "0.4.0");
+            assert_eq!(output.metadata.theme_catalog_version, "0.5.0");
             assert_eq!(
                 output.metadata.theme_catalog_revision,
                 stack_theme::CATALOG_REVISION
@@ -658,10 +681,10 @@ mod tests {
             ("ai", "Artificial intelligence system"),
         ];
         let catalog = stack_theme::catalog();
-        assert_eq!(catalog.catalog_version, "0.4.0");
+        assert_eq!(catalog.catalog_version, "0.5.0");
         assert_eq!(
             stack_theme::CATALOG_REVISION,
-            "sha256:9cb3de8b504acbf22c93cea5fbea66be50f38734dc1dee18b9cab7084082cc1f"
+            "sha256:3bfd66e1a96628b29b95b7273b54373bcce952f7285aefa506b4255a629eaf53"
         );
         for theme in &catalog.themes {
             for (identifier, subject) in expected_icons {
@@ -680,7 +703,7 @@ mod tests {
         let rendered = Engine::bundled().render(source)?;
         assert!(checked.diagnostics.is_empty());
         assert!(rendered.diagnostics.is_empty());
-        assert_eq!(rendered.metadata.theme_catalog_version, "0.4.0");
+        assert_eq!(rendered.metadata.theme_catalog_version, "0.5.0");
         assert_eq!(
             rendered.metadata.theme_catalog_revision,
             stack_theme::CATALOG_REVISION