Update the provider pack theme contract

Cargo.toml

@@ -13,4 +13,4 @@ serde = { version = "=1.0.229", features = ["derive"] }
 serde_json = "=1.0.151"
 stack-compiler = { git = "https://github.com/stack-sh/compiler.git", rev = "3d2379483da1edaeb24a26d43743587a4f5bd645" }
 stack-formatter = { path = "crates/stack-formatter" }
-stack-theme = { git = "https://github.com/stack-sh/theme.git", rev = "d25b883884420adcc124e4c9c786ad92925eae60" }
+stack-theme = { git = "https://github.com/stack-sh/theme.git", rev = "5dbe41326370260cfc6b72d4aab4470318d66dab" }

crates/stack-engine/src/lib.rs

@@ -521,7 +521,7 @@ mod tests {
                 output.metadata.language_version,
                 Some(LanguageVersion { major: 1, minor: 0 })
             );
-            assert_eq!(output.metadata.theme_catalog_version, "0.2.0");
+            assert_eq!(output.metadata.theme_catalog_version, "0.3.0");
             assert_eq!(
                 output.metadata.theme_catalog_revision,
                 stack_theme::CATALOG_REVISION
@@ -547,10 +547,10 @@ mod tests {
             ("observability", "Observability system"),
         ];
         let catalog = stack_theme::catalog();
-        assert_eq!(catalog.catalog_version, "0.2.0");
+        assert_eq!(catalog.catalog_version, "0.3.0");
         assert_eq!(
             stack_theme::CATALOG_REVISION,
-            "sha256:d3a8a5a9d2100e496af3fd7adf389788f4a77508bf749a108183a2abf8f681e1"
+            "sha256:e4eaad0813fcfef4a203e861909ff38833270646f9097155974c7c92108c5b1e"
         );
         for theme in &catalog.themes {
             for (identifier, subject) in expected_icons {
@@ -569,7 +569,7 @@ mod tests {
         let rendered = Engine::bundled().render(source)?;
         assert!(checked.diagnostics.is_empty());
         assert!(rendered.diagnostics.is_empty());
-        assert_eq!(rendered.metadata.theme_catalog_version, "0.2.0");
+        assert_eq!(rendered.metadata.theme_catalog_version, "0.3.0");
         assert_eq!(
             rendered.metadata.theme_catalog_revision,
             stack_theme::CATALOG_REVISION

crates/stack-engine/tests/render_snapshots.rs

@@ -53,7 +53,7 @@ fn explicit_core_icon_matches_standalone_svg_snapshot() -> Result<(), Box<dyn Er
     let source = include_bytes!("fixtures/explicit-core-icon.stack");
     let output = Engine::bundled().render(source)?;
     assert!(output.diagnostics.is_empty());
-    assert_eq!(output.metadata.theme_catalog_version, "0.2.0");
+    assert_eq!(output.metadata.theme_catalog_version, "0.3.0");
     assert_eq!(
         output.metadata.theme_catalog_revision,
         stack_theme::CATALOG_REVISION

docs/dependency-audit.md

@@ -8,7 +8,7 @@ Audit date: 2026-09-04
 
 - `stack-compiler` at `3d2379483da1edaeb24a26d43743587a4f5bd645` for byte decoding, parsing, validation, normalized IR, source maps, and compiler diagnostics;
 - the workspace-local `stack-formatter` for canonical source output;
-- `stack-theme` at `d25b883884420adcc124e4c9c786ad92925eae60` for the `0.2.0` embedded core catalog, 12 provider-neutral explicit icons, SVG bytes, deterministic font metrics, catalog version, and catalog revision.
+- `stack-theme` at `5dbe41326370260cfc6b72d4aab4470318d66dab` for the `0.3.0` embedded core catalog, 12 provider-neutral explicit icons, the local-only provider-pack contract, SVG bytes, deterministic font metrics, catalog version, and catalog revision. Vendor asset bytes are not included.
 
 `stack-engine-wasm` adds `serde` for its serializable native parity model and, only on `wasm32`, version-matched `wasm-bindgen` and `js-sys` for the JavaScript ABI, typed-array input, and plain object construction. It does not use `web-sys` or a WASI target.
 

packages/engine/THIRD_PARTY_LICENSES.md

@@ -5,7 +5,7 @@
 | Component | Version / revision | Selected license | Source |
 | --- | --- | --- | --- |
 | `stack-compiler` | `3d2379483da1edaeb24a26d43743587a4f5bd645` | Apache-2.0 | <https://github.com/stack-sh/compiler> |
-| `stack-theme` | `d25b883884420adcc124e4c9c786ad92925eae60` | Apache-2.0 | <https://github.com/stack-sh/theme> |
+| `stack-theme` | `5dbe41326370260cfc6b72d4aab4470318d66dab` | Apache-2.0 | <https://github.com/stack-sh/theme> |
 | `serde` / `serde_core` | `1.0.229` | Apache-2.0 | <https://github.com/serde-rs/serde> |
 | `serde_json` | `1.0.151` | Apache-2.0 | <https://github.com/serde-rs/json> |
 | `itoa` | `1.0.18` | Apache-2.0 | <https://github.com/dtolnay/itoa> |

scripts/validate-svg.py

@@ -88,10 +88,10 @@ def main() -> None:
         "association",
     }
     assert values(explicit_icon, "data-icon-id") == {"api"}
-    assert explicit_icon.attrib.get("data-theme-version") == "0.2.0"
+    assert explicit_icon.attrib.get("data-theme-version") == "0.3.0"
     assert (
         explicit_icon.attrib.get("data-theme-revision")
-        == "sha256:d3a8a5a9d2100e496af3fd7adf389788f4a77508bf749a108183a2abf8f681e1"
+        == "sha256:e4eaad0813fcfef4a203e861909ff38833270646f9097155974c7c92108c5b1e"
     )
 
 

tests/wasm.test.mjs

@@ -95,10 +95,10 @@ test("browser rendering resolves the bundled explicit core icon", () => {
   assert.deepEqual(explicitIcon.check.diagnostics, []);
   assert.deepEqual(explicitIcon.render.diagnostics, []);
   assert.equal(explicitIcon.render.metadata.engineVersion, "0.3.0");
-  assert.equal(explicitIcon.render.metadata.themeCatalogVersion, "0.2.0");
+  assert.equal(explicitIcon.render.metadata.themeCatalogVersion, "0.3.0");
   assert.equal(
     explicitIcon.render.metadata.themeCatalogRevision,
-    "sha256:d3a8a5a9d2100e496af3fd7adf389788f4a77508bf749a108183a2abf8f681e1",
+    "sha256:e4eaad0813fcfef4a203e861909ff38833270646f9097155974c7c92108c5b1e",
   );
   assert.match(explicitIcon.render.svg, /data-icon-id="api"/);
   assert.doesNotMatch(explicitIcon.render.svg, /data-icon-id="kind-external"/);