first commit

Install-Apps.ps1

@@ -0,0 +1,18 @@
+#Requires -Version 5.1
+[CmdletBinding(SupportsShouldProcess)]
+param([ValidateSet('Tor','Zen','Helium','Mullvad','VeraCrypt')][string[]]$App = @())
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$catalog = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'config/apps.json') -Raw | ConvertFrom-Json
+if ($App.Count -eq 0) { $catalog | Format-Table Name,Id,Role -Wrap; return }
+foreach ($name in @($App | Select-Object -Unique)) {
+    $package = $catalog | Where-Object Name -EQ $name
+    Write-Output "$($package.Name): $($package.Role)"
+    Write-Output "Official site: $($package.Website)"
+    if ($PSCmdlet.ShouldProcess($package.Id, 'Install from exact WinGet community-source package; retain installer prompts')) {
+        $winget = Get-Command winget.exe -ErrorAction Stop
+        # No bypassed hash checks, remote PowerShell execution, automatic source/license acceptance or forced restart.
+        & $winget.Source install --id $package.Id --exact --source winget --interactive
+        if ($LASTEXITCODE -ne 0) { throw "WinGet returned $LASTEXITCODE for $name. Installation was not confirmed; inspect its output." }
+    }
+}