@uapkg/cli 1.4.0 → 1.5.0

package/dist/types/uapkg-diagnostics-format/ink/components/specInkComponents.d.ts

@@ -0,0 +1,5 @@
+import { DiagnosticInkComponentMap } from "../contracts/InkTypes.js";
+//#region src/ink/components/specInkComponents.d.ts
+declare const specInkComponents: DiagnosticInkComponentMap;
+//#endregion
+export { specInkComponents };

package/dist/types/uapkg-diagnostics-format/ink/contracts/InkTypes.d.ts

@@ -0,0 +1,35 @@
+import { Diagnostic, DiagnosticCode } from "../../../uapkg-diagnostics/index.js";
+import { ComponentType } from "react";
+//#region src/ink/contracts/InkTypes.d.ts
+/**
+ * Props every family-body component receives. Each component renders only
+ * the **body** of a diagnostic — icon, code header, and hint are rendered
+ * by {@link DiagnosticView}. Bodies are pure (data-in → element-out) and
+ * must never touch config, fs, or stdout.
+ */
+interface DiagnosticBodyProps {
+  readonly diagnostic: Diagnostic;
+}
+/** A React/Ink component that renders a diagnostic body. */
+type DiagnosticBodyComponent = ComponentType<DiagnosticBodyProps> & {
+  /** The body renders the hint itself to control its position among resources. */
+  rendersHint?: boolean;
+};
+/**
+ * Map of diagnostic code → body component. Any code **not** present in the
+ * map falls back to {@link PlainTextBody}, which renders the same prose
+ * `formatPlainText` would emit — just wrapped in `<Text>`.
+ */
+type DiagnosticInkComponentMap = Partial<Record<DiagnosticCode, DiagnosticBodyComponent>>;
+/**
+ * Contract for a lookup service that maps diagnostic codes to Ink bodies.
+ *
+ * The registry is the Ink analog of `FormatterRegistry` — same spirit
+ * (code → renderer), different codomain (React element vs. string).
+ */
+interface IDiagnosticInkRegistry {
+  register(code: DiagnosticCode, component: DiagnosticBodyComponent): void;
+  resolve(code: DiagnosticCode): DiagnosticBodyComponent | undefined;
+}
+//#endregion
+export { DiagnosticBodyComponent, DiagnosticBodyProps, DiagnosticInkComponentMap, IDiagnosticInkRegistry };

package/dist/types/uapkg-diagnostics-format/ink/defaults/defaultInkComponents.d.ts

@@ -0,0 +1,15 @@
+import { DiagnosticInkComponentMap } from "../contracts/InkTypes.js";
+//#region src/ink/defaults/defaultInkComponents.d.ts
+/**
+ * Aggregated default Ink component map — one entry per well-known diagnostic
+ * code. Unknown codes fall back to {@link PlainTextBody} inside
+ * {@link DiagnosticView}, so the registry is always safe to call.
+ *
+ * Consumers that want custom behavior can either:
+ *
+ *   1. Pass a spread: `{ ...defaultInkComponents, MY_CODE: MyBody }`, or
+ *   2. Instantiate a {@link DiagnosticInkRegistry} and `.register()` after.
+ */
+declare const defaultInkComponents: DiagnosticInkComponentMap;
+//#endregion
+export { defaultInkComponents };

package/dist/types/uapkg-diagnostics-format/ink/index.d.ts

@@ -0,0 +1,17 @@
+import { DiagnosticBodyComponent, DiagnosticBodyProps, DiagnosticInkComponentMap, IDiagnosticInkRegistry } from "./contracts/InkTypes.js";
+import { installerInkComponents } from "./components/installerInkComponents.js";
+import { manifestInkComponents } from "./components/manifestInkComponents.js";
+import { postinstallInkComponents } from "./components/postinstallInkComponents.js";
+import { publishingInkComponents } from "./components/publishingInkComponents.js";
+import { registryInkComponents } from "./components/registryInkComponents.js";
+import { resolverInkComponents } from "./components/resolverInkComponents.js";
+import { safetyInkComponents } from "./components/safetyInkComponents.js";
+import { specInkComponents } from "./components/specInkComponents.js";
+import { defaultInkComponents } from "./defaults/defaultInkComponents.js";
+import { HintLine } from "./primitives/HintLine.js";
+import { PlainTextBody } from "./primitives/PlainTextBody.js";
+import { SeverityBadge } from "./primitives/SeverityBadge.js";
+import { DiagnosticInkRegistry, createInkRegistry } from "./registry/DiagnosticInkRegistry.js";
+import { DiagnosticsListView, DiagnosticsListViewProps } from "./views/DiagnosticsListView.js";
+import { DiagnosticView, DiagnosticViewProps } from "./views/DiagnosticView.js";
+export { type DiagnosticBodyComponent, type DiagnosticBodyProps, type DiagnosticInkComponentMap, DiagnosticInkRegistry, DiagnosticView, type DiagnosticViewProps, DiagnosticsListView, type DiagnosticsListViewProps, HintLine, type IDiagnosticInkRegistry, PlainTextBody, SeverityBadge, createInkRegistry, defaultInkComponents, installerInkComponents, manifestInkComponents, postinstallInkComponents, publishingInkComponents, registryInkComponents, resolverInkComponents, safetyInkComponents, specInkComponents };

package/dist/types/uapkg-diagnostics-format/ink/primitives/HintLine.d.ts

@@ -0,0 +1,12 @@
+import { ReactElement } from "react";
+//#region src/ink/primitives/HintLine.d.ts
+interface HintLineProps {
+  readonly hint: string;
+}
+/**
+ * Bottom-of-diagnostic actionable hint. Always indented and tinted so it
+ * stands apart from the body. Renders nothing when the hint is empty.
+ */
+declare function HintLine({ hint }: HintLineProps): ReactElement | null;
+//#endregion
+export { HintLine, HintLineProps };

package/dist/types/uapkg-diagnostics-format/ink/primitives/PlainTextBody.d.ts

@@ -0,0 +1,11 @@
+import { DiagnosticBodyProps } from "../contracts/InkTypes.js";
+import { ReactElement } from "react";
+//#region src/ink/primitives/PlainTextBody.d.ts
+/**
+ * Fallback body used when no family-specific component is registered for a
+ * diagnostic code. Writes the diagnostic message verbatim so the Ink render
+ * stays in structural parity with the plain-text formatter.
+ */
+declare function PlainTextBody({ diagnostic }: DiagnosticBodyProps): ReactElement;
+//#endregion
+export { PlainTextBody };

package/dist/types/uapkg-diagnostics-format/ink/primitives/SeverityBadge.d.ts

@@ -0,0 +1,13 @@
+import { Diagnostic } from "../../../uapkg-diagnostics/index.js";
+import { ReactElement } from "react";
+//#region src/ink/primitives/SeverityBadge.d.ts
+interface SeverityBadgeProps {
+  readonly level: Diagnostic['level'];
+}
+/**
+ * A single colored severity icon. Pure presentation — no diagnostic-specific
+ * logic lives here. Used as a prefix by {@link DiagnosticView}.
+ */
+declare function SeverityBadge({ level }: SeverityBadgeProps): ReactElement;
+//#endregion
+export { SeverityBadge, SeverityBadgeProps };

package/dist/types/uapkg-diagnostics-format/ink/registry/DiagnosticInkRegistry.d.ts

@@ -0,0 +1,24 @@
+import { DiagnosticBodyComponent, DiagnosticInkComponentMap, IDiagnosticInkRegistry } from "../contracts/InkTypes.js";
+import { DiagnosticCode } from "../../../uapkg-diagnostics/index.js";
+//#region src/ink/registry/DiagnosticInkRegistry.d.ts
+/**
+ * Lookup service for Ink diagnostic-body components.
+ *
+ * - One-shot register: seed with a map at construction.
+ * - Extensible: callers can `register(code, component)` for bespoke overrides.
+ *
+ * The registry only *resolves* components — the composing {@link DiagnosticView}
+ * is responsible for fallback behavior when `resolve()` returns undefined.
+ */
+declare class DiagnosticInkRegistry implements IDiagnosticInkRegistry {
+  private readonly components;
+  constructor(seed?: DiagnosticInkComponentMap);
+  register(code: DiagnosticCode, component: DiagnosticBodyComponent): void;
+  resolve(code: DiagnosticCode): DiagnosticBodyComponent | undefined;
+}
+/**
+ * Factory helper so consumers don't have to `new` the class directly.
+ */
+declare function createInkRegistry(seed?: DiagnosticInkComponentMap): DiagnosticInkRegistry;
+//#endregion
+export { DiagnosticInkRegistry, createInkRegistry };

package/dist/types/uapkg-diagnostics-format/ink/views/DiagnosticView.d.ts

@@ -0,0 +1,21 @@
+import { IDiagnosticInkRegistry } from "../contracts/InkTypes.js";
+import { Diagnostic } from "../../../uapkg-diagnostics/index.js";
+import { ReactElement } from "react";
+//#region src/ink/views/DiagnosticView.d.ts
+interface DiagnosticViewProps {
+  readonly diagnostic: Diagnostic;
+  readonly registry: IDiagnosticInkRegistry;
+}
+/**
+ * Renders one diagnostic in three layers:
+ *
+ *   1. Header — severity badge + code + message.
+ *   2. Body   — family-specific component (resolved from {@link IDiagnosticInkRegistry})
+ *               or {@link PlainTextBody} as a safe fallback.
+ *   3. Hint   — the `hint` field when present.
+ *
+ * This component is pure — it neither reads config nor talks to I/O.
+ */
+declare function DiagnosticView({ diagnostic, registry }: DiagnosticViewProps): ReactElement;
+//#endregion
+export { DiagnosticView, DiagnosticViewProps };

package/dist/types/uapkg-diagnostics-format/ink/views/DiagnosticsListView.d.ts

@@ -0,0 +1,16 @@
+import { IDiagnosticInkRegistry } from "../contracts/InkTypes.js";
+import { Diagnostic } from "../../../uapkg-diagnostics/index.js";
+import { ReactElement } from "react";
+//#region src/ink/views/DiagnosticsListView.d.ts
+interface DiagnosticsListViewProps {
+  readonly diagnostics: readonly Diagnostic[];
+  readonly registry: IDiagnosticInkRegistry;
+}
+/**
+ * Renders a list of diagnostics (already pre-sorted by the caller — usually
+ * severity-descending). Produces nothing for an empty input so the host
+ * Ink tree stays quiet.
+ */
+declare function DiagnosticsListView({ diagnostics, registry }: DiagnosticsListViewProps): ReactElement | null;
+//#endregion
+export { DiagnosticsListView, DiagnosticsListViewProps };

package/dist/types/uapkg-diagnostics-format/registry/FormatterRegistry.d.ts

@@ -0,0 +1,26 @@
+import { DiagnosticFormatterFn, FormatterMap, IFormatterRegistry } from "../contracts/FormatterTypes.js";
+import { Diagnostic, DiagnosticCode } from "../../uapkg-diagnostics/index.js";
+//#region src/registry/FormatterRegistry.d.ts
+/**
+ * Registry that maps diagnostic codes to formatter functions.
+ * Falls back to a plain-text default when no specific formatter is registered.
+ */
+declare class FormatterRegistry implements IFormatterRegistry {
+  private readonly formatters;
+  private readonly fallback;
+  constructor(fallback?: DiagnosticFormatterFn);
+  /** Register a formatter for a single diagnostic code. */
+  register(code: DiagnosticCode, formatter: DiagnosticFormatterFn): void;
+  /** Bulk-register multiple formatters from a partial map. */
+  registerAll(map: FormatterMap): void;
+  /** Format a single diagnostic using the registered (or fallback) formatter. */
+  format(diagnostic: Diagnostic): string;
+  /** Format an array of diagnostics, joining with newlines. */
+  formatAll(diagnostics: readonly Diagnostic[]): string;
+}
+/**
+ * Create a new `FormatterRegistry` optionally pre-loaded with formatters.
+ */
+declare function createFormatterRegistry(initial?: FormatterMap, fallback?: DiagnosticFormatterFn): FormatterRegistry;
+//#endregion
+export { FormatterRegistry, createFormatterRegistry };

package/dist/types/uapkg-diagnostics-format/utils/indent.d.ts

@@ -0,0 +1,7 @@
+//#region src/utils/indent.d.ts
+/** Indent every line of `text` by `spaces` spaces. */
+declare function indent(text: string, spaces?: number): string;
+/** Format an array of items as a bulleted list. */
+declare function bulletList(items: readonly string[], bullet?: string): string;
+//#endregion
+export { bulletList, indent };

package/dist/types/uapkg-installer/contracts/InstallerTypes.d.ts

@@ -0,0 +1,91 @@
+import { RegistryVersion } from "../../uapkg-registry-schema/index.js";
+import { AssetHash, InstallPath, PackageName, PackageVersion, RegistryName } from "../../uapkg-common-schema/index.js";
+//#region src/contracts/InstallerTypes.d.ts
+/**
+ * The kind of change the installer will perform for a single package.
+ */
+type InstallActionType = 'add' | 'update' | 'remove' | 'unchanged';
+/**
+ * A single planned action — fully self-describing so the executor does not
+ * need to re-query the lockfile or registry at execution time.
+ */
+interface InstallAction {
+  readonly type: InstallActionType;
+  readonly packageName: PackageName;
+  readonly path: InstallPath;
+  /** Target version (for add / update / unchanged). */
+  readonly targetVersion?: PackageVersion;
+  /** Previously installed version (for update / remove). */
+  readonly currentVersion?: PackageVersion;
+  readonly registry?: RegistryName;
+  readonly integrity?: AssetHash;
+  /** Byte size of the .tgz asset, if known from the registry manifest. */
+  readonly sizeBytes?: number;
+  /** Asset download URL for add / update. */
+  readonly downloadUrl?: string;
+  /** Registry version record used for claims verification (add / update). */
+  readonly registryEntry?: RegistryVersion;
+  /** Immutable registry type from the projected registry metadata, when known. */
+  readonly registryType?: 'public' | 'private';
+}
+/**
+ * Summary counts for the whole plan.
+ */
+interface InstallSummary {
+  readonly added: number;
+  readonly updated: number;
+  readonly removed: number;
+  readonly unchanged: number;
+  readonly totalBytes: number;
+}
+/**
+ * The full plan returned by `InstallPlanner.plan()`. Safe to serialize
+ * (e.g. for `--dry-run --json`).
+ */
+interface InstallPlan {
+  readonly actions: readonly InstallAction[];
+  readonly summary: InstallSummary;
+}
+/** Terminal status of one package after a partial, verification-gated install. */
+type PackageInstallStatus = 'installed' | 'failed' | 'skipped_no_verified_parent' | 'removed' | 'unchanged';
+interface PackageInstallOutcome {
+  readonly packageName: PackageName;
+  readonly status: PackageInstallStatus;
+}
+/**
+ * Result of executing an install plan. Installation is partial by design:
+ * one failed branch never rolls back or blocks unrelated verified branches.
+ */
+interface InstallReport {
+  readonly plan: InstallPlan;
+  readonly outcomes: readonly PackageInstallOutcome[];
+  /** Packages newly installed (verified add/update actions). */
+  readonly installed: readonly PackageName[];
+  /** Packages whose download/verification/extraction failed. */
+  readonly failed: readonly PackageName[];
+  /** Packages left uninstalled because no verified parent required them. */
+  readonly skipped: readonly PackageName[];
+  /** Installed/retained packages whose dependency closure is incomplete. */
+  readonly incompleteClosure: readonly PackageName[];
+}
+/**
+ * Options accepted by {@link Installer}. Concurrency is NOT accepted here —
+ * the installer reads `network.maxConcurrentDownloads` from config.
+ */
+interface InstallerOptions {
+  /** Absolute path to the directory containing `uapkg.json`. */
+  readonly manifestRoot: string;
+  /** If true, safety policies emit `SAFETY_OVERRIDDEN_BY_FORCE` instead of failing. */
+  readonly force?: boolean;
+  /** If true, the plan is produced but no IO is performed. */
+  readonly dryRun?: boolean;
+  /**
+   * Direct dependency names declared by the trusted root manifest. These seed
+   * the verification-gated traversal: a package is eligible only when a root
+   * or an already verified parent requires it. When omitted, every lockfile
+   * entry is treated as a trusted root request.
+   */
+  readonly rootDependencies?: readonly string[];
+}
+//#endregion
+export { InstallAction, InstallActionType, InstallPlan, InstallReport, InstallSummary, InstallerOptions, PackageInstallOutcome, PackageInstallStatus };

package/dist/types/uapkg-installer/contracts/SafetyPolicyTypes.d.ts

@@ -0,0 +1,43 @@
+import { InstallAction } from "./InstallerTypes.js";
+import { Diagnostic } from "../../uapkg-diagnostics/index.js";
+//#region src/contracts/SafetyPolicyTypes.d.ts
+/**
+ * Stable identifier for a built-in safety policy.
+ *
+ * This is NOT a closed enum — consumers MAY register their own policies via
+ * {@link SafetyPolicyRegistry.register}. Built-in identifiers are reserved.
+ */
+type BuiltInSafetyPolicyId = 'no-marker' | 'plugin-manifest-path';
+/**
+ * Outcome of evaluating a single safety policy against one action.
+ */
+type SafetyEvaluation = {
+  readonly kind: 'allow';
+} | {
+  readonly kind: 'block';
+  readonly diagnostics: readonly Diagnostic[];
+} | {
+  readonly kind: 'warn';
+  readonly diagnostics: readonly Diagnostic[];
+};
+/**
+ * Context passed to every policy on each evaluation. Policies do not share
+ * state and must not mutate the context.
+ */
+interface SafetyContext {
+  readonly manifestRoot: string;
+  readonly action: InstallAction;
+  readonly force: boolean;
+}
+/**
+ * Contract every safety policy implements.
+ *
+ * A policy is a stateless, injectable function-object with an identifier so
+ * failures can be cited in diagnostics and `--force` messages.
+ */
+interface SafetyPolicy {
+  readonly id: string;
+  evaluate(context: SafetyContext): Promise<SafetyEvaluation>;
+}
+//#endregion
+export { BuiltInSafetyPolicyId, SafetyContext, SafetyEvaluation, SafetyPolicy };

package/dist/types/uapkg-installer/contracts/StatusStreamTypes.d.ts

@@ -0,0 +1,42 @@
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/contracts/StatusStreamTypes.d.ts
+/**
+ * Lifecycle state of a single installer work-slot.
+ *
+ * One status row per slot; slot ids are stable across frames so Ink can
+ * render a fixed-height region without re-flowing.
+ */
+type SlotState = 'idle' | 'downloading' | 'verifying' | 'extracting' | 'removing' | 'done' | 'failed';
+/**
+ * Per-slot status snapshot.
+ */
+interface SlotSnapshot {
+  readonly slotId: number;
+  readonly state: SlotState;
+  readonly packageName?: PackageName;
+  readonly version?: PackageVersion;
+  readonly bytesDone: number;
+  readonly bytesTotal?: number;
+  readonly attempt: number;
+}
+/**
+ * Aggregate totals across all actions in the plan.
+ */
+interface InstallTotals {
+  readonly added: number;
+  readonly updated: number;
+  readonly removed: number;
+  readonly unchanged: number;
+  readonly bytesDone: number;
+  readonly bytesTotal: number;
+}
+/**
+ * Immutable snapshot yielded by `Installer.getStatusStream()`. The CLI view
+ * re-renders whenever a new snapshot arrives.
+ */
+interface DownloadStatusSnapshot {
+  readonly slots: readonly SlotSnapshot[];
+  readonly totals: InstallTotals;
+}
+//#endregion
+export { DownloadStatusSnapshot, InstallTotals, SlotSnapshot, SlotState };

package/dist/types/uapkg-installer/core/ClaimsVerifier.d.ts

@@ -0,0 +1,22 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { RegistryVersion } from "../../uapkg-registry-schema/index.js";
+import { PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/core/ClaimsVerifier.d.ts
+interface ClaimsVerificationInput {
+  readonly packageName: PackageName;
+  readonly version: PackageVersion;
+  readonly archivePath: string;
+  readonly registryEntry: RegistryVersion;
+  readonly registryType?: 'public' | 'private';
+}
+/**
+ * Install-time packaged-manifest verification: the registry record's claims
+ * must agree with the packaged `uapkg.json` over the mandatory core plus the
+ * shared understood keys, and a `public` registry rejects `private: true`.
+ * Byte size and SHA-256 are verified separately before this step.
+ */
+declare class ClaimsVerifier {
+  verify(input: ClaimsVerificationInput): Promise<Result<void>>;
+}
+//#endregion
+export { ClaimsVerificationInput, ClaimsVerifier };

package/dist/types/uapkg-installer/core/DiskStateInspector.d.ts

@@ -0,0 +1,29 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { Lockfile } from "../../uapkg-package-manifest-schema/index.js";
+import { InstallPath, PackageName, PackageVersion } from "../../uapkg-common-schema/index.js";
+//#region src/core/DiskStateInspector.d.ts
+/**
+ * What we found at a given install path on disk.
+ */
+interface DiskStateEntry {
+  readonly path: InstallPath;
+  readonly exists: boolean;
+  readonly hasManifest: boolean;
+  readonly installedName?: PackageName;
+  readonly installedVersion?: PackageVersion;
+}
+/**
+ * Determines the current on-disk state of every package referenced in a
+ * lockfile. Scoped to lockfile entries only — files outside the lockfile's
+ * install paths are never touched or enumerated.
+ *
+ * This is the entry point that makes the installer non-destructive: we only
+ * know about paths we already own.
+ */
+declare class DiskStateInspector {
+  inspect(manifestRoot: string, lockfile: Lockfile): Promise<Result<Map<PackageName, DiskStateEntry>>>;
+  private resolveRelPath;
+  private inspectOne;
+}
+//#endregion
+export { DiskStateEntry, DiskStateInspector };

package/dist/types/uapkg-installer/core/InstallPlanner.d.ts

@@ -0,0 +1,35 @@
+import { InstallPlan } from "../contracts/InstallerTypes.js";
+import { DiskStateEntry } from "./DiskStateInspector.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { Lockfile } from "../../uapkg-package-manifest-schema/index.js";
+import { RegistryCore } from "../../uapkg-registry-core/index.js";
+import { PackageName } from "../../uapkg-common-schema/index.js";
+//#region src/core/InstallPlanner.d.ts
+/**
+ * Diffs (previousLockfile, currentLockfile, diskState) → InstallPlan.
+ *
+ * Rules:
+ *  - Package in current lockfile, not on disk        → `add`
+ *  - Package in current lockfile, on disk, same ver  → `unchanged`
+ *  - Package in current lockfile, on disk, different → `update`
+ *  - Package in previous lockfile only                → `remove`
+ *
+ * Fetches asset URLs + integrity + size + the registry version record (for
+ * install-time claims verification) from `RegistryCore` for add/update
+ * actions. Pure with respect to disk (planner only reads registry metadata).
+ */
+declare class InstallPlanner {
+  private readonly registryCore;
+  constructor(registryCore: RegistryCore);
+  plan(currentLockfile: Lockfile, previousLockfile: Lockfile | null, diskState: ReadonlyMap<PackageName, DiskStateEntry>): Promise<Result<InstallPlan>>;
+  private summarize;
+  private fetchAssetMeta;
+  /**
+   * Read the immutable registry type from the projected registry metadata.
+   * Missing, invalid, or unsupported metadata fails closed because package
+   * validation cannot safely choose public or private policy without it.
+   */
+  private readRegistryType;
+}
+//#endregion
+export { InstallPlanner };

package/dist/types/uapkg-installer/core/Installer.d.ts

@@ -0,0 +1,61 @@
+import { InstallReport, InstallerOptions } from "../contracts/InstallerTypes.js";
+import { DownloadStatusSnapshot } from "../contracts/StatusStreamTypes.js";
+import { SafetyPolicyRegistry } from "../safety/SafetyPolicyRegistry.js";
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { Lockfile } from "../../uapkg-package-manifest-schema/index.js";
+import { RegistryCore } from "../../uapkg-registry-core/index.js";
+import { ConfigInstance } from "../../uapkg-config/index.js";
+//#region src/core/Installer.d.ts
+interface InstallerConstructorOptions {
+  readonly registryCore: RegistryCore;
+  readonly config: InstanceType<typeof ConfigInstance>;
+}
+/**
+ * Physical installation orchestrator. Owns the collaborators but is not a
+ * god-class — each step delegates to a single-responsibility module.
+ *
+ * Public surface:
+ *   - execute(lockfile, previous?) → Result<InstallReport>
+ *   - getStatusStream() → AsyncIterable<DownloadStatusSnapshot>
+ *
+ * Installation is verification-gated and partial: a package activates only
+ * after exact byte-size, SHA-256, and packaged-manifest claims verification,
+ * its outgoing dependency edges are trusted only after it verifies, and a
+ * failed branch is reported without blocking unrelated verified branches.
+ *
+ * Concurrency is read from `network.maxConcurrentDownloads` in config;
+ * retries/timeout from `network.retries` / `network.timeout`.
+ *
+ * Emits no console output. Progress flows through the status stream.
+ */
+declare class Installer {
+  private readonly deps;
+  private readonly inspector;
+  private readonly planner;
+  private readonly downloader;
+  private readonly verifier;
+  private readonly claimsVerifier;
+  private readonly extractor;
+  private readonly remover;
+  private readonly safety;
+  private slots;
+  private stream;
+  constructor(deps: InstallerConstructorOptions);
+  /** Expose the registry so consumers can register additional policies. */
+  get safetyRegistry(): SafetyPolicyRegistry;
+  getStatusStream(): AsyncIterable<DownloadStatusSnapshot>;
+  execute(lockfile: Lockfile, previousLockfile: Lockfile | null, options: InstallerOptions): Promise<Result<InstallReport>>;
+  private isEligible;
+  private emptyReport;
+  private buildReport;
+  private skippedDiagnostic;
+  private executeRemove;
+  private executeDownloadAction;
+  private unexpectedFailure;
+  private readMaxConcurrent;
+  private createExecutionRuntime;
+  private readNumber;
+  private safeUnlink;
+}
+//#endregion
+export { Installer, InstallerConstructorOptions };

package/dist/types/uapkg-installer/core/IntegrityVerifier.d.ts

@@ -0,0 +1,16 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { AssetHash } from "../../uapkg-common-schema/index.js";
+//#region src/core/IntegrityVerifier.d.ts
+/**
+ * Verifies a downloaded file matches the expected `AssetHash`.
+ *
+ * The hash format is `"<algorithm>:<hex>"` (e.g. `"sha256:abc123…"`), matching
+ * what the registry stores in `RegistryAsset.integrity.hash`.
+ */
+declare class IntegrityVerifier {
+  verify(packageName: string, filePath: string, expected: AssetHash): Promise<Result<void>>;
+  private parseHash;
+  private hashFile;
+}
+//#endregion
+export { IntegrityVerifier };

package/dist/types/uapkg-installer/core/PackageDownloader.d.ts

@@ -0,0 +1,40 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+//#region src/core/PackageDownloader.d.ts
+/**
+ * Progress callback fired on every received chunk.
+ */
+type DownloadProgress = (bytesDone: number, bytesTotal: number | undefined, attempt: number) => void;
+interface DownloadOptions {
+  readonly retries: number;
+  readonly timeoutMs: number;
+}
+interface DownloadResult {
+  readonly tempPath: string;
+  readonly bytesTotal?: number;
+  /** Exact number of bytes written to the temp file. */
+  readonly bytesDownloaded: number;
+}
+/**
+ * Streams a .tgz from an HTTP(S) URL to a temp file with retry/timeout support.
+ *
+ * Retry behavior: any failed attempt is retried up to `retries` times, matching
+ * the installer's established network retry contract.
+ *
+ * Does not throw — all errors converted to typed diagnostics.
+ */
+declare class PackageDownloader {
+  download(packageName: string, url: string, options: DownloadOptions, onProgress?: DownloadProgress): Promise<Result<DownloadResult>>;
+  private attempt;
+  private fetchFollowingRedirects;
+  private parseInitialUrl;
+  private assertAllowedUrl;
+  private headersFor;
+  private isLegacyGitHubAssetApiUrl;
+  private cancelResponseBody;
+  private errorMessage;
+  private diagnosticUrl;
+  private makeTempPath;
+  private safeUnlink;
+}
+//#endregion
+export { DownloadOptions, DownloadProgress, DownloadResult, PackageDownloader };

package/dist/types/uapkg-installer/core/PackageExtractor.d.ts

@@ -0,0 +1,20 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { InstallPath } from "../../uapkg-common-schema/index.js";
+//#region src/core/PackageExtractor.d.ts
+/**
+ * Extracts a downloaded .tgz into its target install path atomically.
+ *
+ * Strategy:
+ *  1. Extract to a sibling temp directory.
+ *  2. Remove the existing target (if any — safety policies already gated).
+ *  3. Atomic `rename` tempDir → targetDir.
+ *
+ * The archive is expected to use the `<name>-<version>/` top-level directory
+ * that `@uapkg/pack` emits; we strip one path component during extraction.
+ */
+declare class PackageExtractor {
+  extract(packageName: string, tgzPath: string, manifestRoot: string, installPath: InstallPath): Promise<Result<void>>;
+  private cleanup;
+}
+//#endregion
+export { PackageExtractor };

package/dist/types/uapkg-installer/core/PackageRemover.d.ts

@@ -0,0 +1,14 @@
+import { Result } from "../../uapkg-diagnostics/index.js";
+import { InstallPath } from "../../uapkg-common-schema/index.js";
+//#region src/core/PackageRemover.d.ts
+/**
+ * Removes a package directory from disk.
+ *
+ * Scope is always `<manifestRoot>/<installPath>`; we never touch anything
+ * outside this tree. Safe against partially-extracted state.
+ */
+declare class PackageRemover {
+  remove(packageName: string, manifestRoot: string, installPath: InstallPath): Promise<Result<void>>;
+}
+//#endregion
+export { PackageRemover };