@rover-studio/answer-me 0.1.0-rc.1

package/distribution/npm/skills/answerme/scripts/create-answerme.ps1

@@ -0,0 +1,1892 @@
+[CmdletBinding()]
+param(
+    [string]$TemplateJson,
+    [string]$CompactQuestionnaireJson,
+    [string]$ApiBaseUrl,
+    [switch]$AllowInsecureLoopbackHttpForTest,
+    [string]$IdempotencyKey,
+    [string]$CreatorKeyEnvironmentVariable = 'ANSWERME_CREATOR_KEY',
+    [string]$CredentialPath = $env:ANSWERME_CREATOR_CREDENTIAL_PATH,
+    [string]$ResultTokenStoreRoot = $env:ANSWERME_RESULT_TOKEN_STORE_ROOT,
+    [switch]$AllowNonDefaultResultTokenStore,
+    [object]$WaitTimeoutSeconds = 300,
+    [object]$EnrollmentWaitTimeoutSeconds = 300,
+    [switch]$SkipPopup,
+    [switch]$ValidateOnly,
+    [switch]$ValidateCredentialOnly
+)
+
+$ErrorActionPreference = 'Stop'
+
+$processStartInfoSupport = Join-Path $PSScriptRoot 'windows-process-start-info.ps1'
+if (-not (Test-Path -LiteralPath $processStartInfoSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows process argument helper is missing.'
+}
+. $processStartInfoSupport
+
+$cryptoSupport = Join-Path $PSScriptRoot 'windows-crypto.ps1'
+if (-not (Test-Path -LiteralPath $cryptoSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows cryptography helper is missing.'
+}
+. $cryptoSupport
+
+$httpSupport = Join-Path $PSScriptRoot 'windows-http.ps1'
+if (-not (Test-Path -LiteralPath $httpSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows HTTP helper is missing.'
+}
+. $httpSupport
+
+$AnswerMeProtocolVersion = '1.1'
+$AnswerMeSkillVersion = '0.3.0'
+$AnswerMeOperationStopwatch = [Diagnostics.Stopwatch]::StartNew()
+$AnswerMeAutomaticEnrollmentAttempted = $false
+$AnswerMeOriginalRequestRetried = $false
+$AnswerMeTimings = [ordered]@{
+    inputValidationMilliseconds = 0L
+    configurationMilliseconds = 0L
+    capabilitiesMilliseconds = 0L
+    createRequestMilliseconds = 0L
+    responseValidationMilliseconds = 0L
+    tokenPersistenceMilliseconds = 0L
+    popupMilliseconds = 0L
+}
+
+function Get-AnswerMeTimings {
+    $snapshot = [ordered]@{}
+    foreach ($entry in $AnswerMeTimings.GetEnumerator()) {
+        $snapshot[$entry.Key] = [long]$entry.Value
+    }
+    $snapshot.totalMilliseconds = [long]$AnswerMeOperationStopwatch.ElapsedMilliseconds
+    return [PSCustomObject]$snapshot
+}
+
+function Write-AnswerMeFailure {
+    param(
+        [Parameter(Mandatory = $true)][string]$Code,
+        [Parameter(Mandatory = $true)][string]$Message,
+        [Parameter(Mandatory = $true)][int]$ExitCode,
+        [bool]$NetworkCalled = $false,
+        [AllowNull()][string]$Reason,
+        [int]$RetryAfterSeconds = 0,
+        [AllowNull()][object]$RecoveryAction,
+        [AllowNull()][object]$RecoveryReference,
+        [AllowNull()][string]$IdempotencyKey
+    )
+
+    $failure = [ordered]@{
+        ok = $false
+        status = 'failed'
+        stage = 'create'
+        code = $Code
+        message = $Message
+        reason = $Reason
+        retryAfterSeconds = $RetryAfterSeconds
+        recoveryAction = $RecoveryAction
+        recoveryReference = $RecoveryReference
+        timings = Get-AnswerMeTimings
+        networkCalled = $NetworkCalled
+        automaticEnrollmentAttempted = $AnswerMeAutomaticEnrollmentAttempted
+        originalRequestRetried = $AnswerMeOriginalRequestRetried
+    }
+    if (-not [string]::IsNullOrWhiteSpace($IdempotencyKey)) {
+        $failure.idempotencyKey = $IdempotencyKey
+    }
+    [PSCustomObject]$failure | ConvertTo-Json -Depth 4
+    exit $ExitCode
+}
+
+function Get-AnswerMeWaitDecision {
+    param([Parameter(Mandatory = $true)][object]$RequestedValue)
+
+    $text = [string]$RequestedValue
+    $integerValue = 0L
+    $numericValue = 0.0
+    if ([long]::TryParse(
+        $text,
+        [Globalization.NumberStyles]::Integer,
+        [Globalization.CultureInfo]::InvariantCulture,
+        [ref]$integerValue
+    )) {
+        $requested = $integerValue
+        $valid = $integerValue -eq 0 -or ($integerValue -ge 30 -and $integerValue -le 600)
+    }
+    elseif ([double]::TryParse(
+        $text,
+        [Globalization.NumberStyles]::Float,
+        [Globalization.CultureInfo]::InvariantCulture,
+        [ref]$numericValue
+    )) {
+        $requested = $numericValue
+        $valid = $false
+    }
+    else {
+        $requested = $text
+        $valid = $false
+    }
+
+    return [PSCustomObject]@{
+        requestedTimeoutSeconds = $requested
+        effectiveTimeoutSeconds = if ($valid) { [int]$integerValue } else { 0 }
+        reason = if ($valid) { $null } else { 'timeout_out_of_range' }
+    }
+}
+
+function ConvertTo-AnswerMeCanonicalJsonScalar {
+    param([AllowNull()][object]$Value)
+
+    return ConvertTo-Json -InputObject $Value -Compress -Depth 4
+}
+
+function Get-DefaultAnswerMeCredentialPath {
+    if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
+        return $null
+    }
+    $localAppData = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
+    if ([string]::IsNullOrWhiteSpace($localAppData)) {
+        return $null
+    }
+    return Join-Path $localAppData 'AnswerMe\creator-credential.clixml'
+}
+
+function Assert-AnswerMeAllowedProperties {
+    param(
+        [Parameter(Mandatory = $true)][object]$Value,
+        [Parameter(Mandatory = $true)][string[]]$Allowed,
+        [Parameter(Mandatory = $true)][string]$Context
+    )
+
+    $unsupported = @($Value.PSObject.Properties.Name | Where-Object { $Allowed -cnotcontains $_ })
+    if ($unsupported.Count -gt 0) {
+        throw "$Context contains unsupported field '$($unsupported[0])'."
+    }
+}
+
+function Assert-AnswerMeJsonObject {
+    param(
+        [AllowNull()][object]$Value,
+        [Parameter(Mandatory = $true)][string]$Context
+    )
+
+    if ($Value -isnot [PSCustomObject]) {
+        throw "$Context must be a JSON object."
+    }
+}
+
+function Assert-AnswerMeJsonUnicodeWellFormed {
+    param([Parameter(Mandatory = $true)][string]$Json)
+
+    $insideString = $false
+    for ($index = 0; $index -lt $Json.Length; $index += 1) {
+        $current = $Json[$index]
+        if ([char]::IsHighSurrogate($current)) {
+            if ($index + 1 -ge $Json.Length -or -not [char]::IsLowSurrogate($Json[$index + 1])) {
+                throw 'JSON contains an unpaired Unicode surrogate.'
+            }
+            $index += 1
+            continue
+        }
+        if ([char]::IsLowSurrogate($current)) {
+            throw 'JSON contains an unpaired Unicode surrogate.'
+        }
+        if (-not $insideString) {
+            if ($current -ceq [char]'"') { $insideString = $true }
+            continue
+        }
+        if ($current -ceq [char]'"') {
+            $insideString = $false
+            continue
+        }
+        if ($current -cne [char]'\') { continue }
+        if ($index + 1 -ge $Json.Length) { return }
+
+        $escape = $Json[$index + 1]
+        if ($escape -cne [char]'u') {
+            $index += 1
+            continue
+        }
+        if ($index + 5 -ge $Json.Length) { return }
+
+        $hex = $Json.Substring($index + 2, 4)
+        $codeUnit = 0
+        if (-not [int]::TryParse(
+            $hex,
+            [Globalization.NumberStyles]::AllowHexSpecifier,
+            [Globalization.CultureInfo]::InvariantCulture,
+            [ref]$codeUnit
+        )) { return }
+        if ($codeUnit -ge 0xD800 -and $codeUnit -le 0xDBFF) {
+            if ($index + 11 -ge $Json.Length -or
+                $Json[$index + 6] -cne [char]'\' -or
+                $Json[$index + 7] -cne [char]'u') {
+                throw 'JSON contains an unpaired Unicode surrogate escape.'
+            }
+            $lowHex = $Json.Substring($index + 8, 4)
+            $lowCodeUnit = 0
+            if (-not [int]::TryParse(
+                $lowHex,
+                [Globalization.NumberStyles]::AllowHexSpecifier,
+                [Globalization.CultureInfo]::InvariantCulture,
+                [ref]$lowCodeUnit
+            ) -or $lowCodeUnit -lt 0xDC00 -or $lowCodeUnit -gt 0xDFFF) {
+                throw 'JSON contains an unpaired Unicode surrogate escape.'
+            }
+            $index += 11
+            continue
+        }
+        if ($codeUnit -ge 0xDC00 -and $codeUnit -le 0xDFFF) {
+            throw 'JSON contains an unpaired Unicode surrogate escape.'
+        }
+        $index += 5
+    }
+}
+
+function Get-AnswerMeProperty {
+    param(
+        [Parameter(Mandatory = $true)][object]$Value,
+        [Parameter(Mandatory = $true)][string]$Name,
+        [Parameter(Mandatory = $true)][string]$Context,
+        [switch]$Required
+    )
+
+    $properties = @($Value.PSObject.Properties | Where-Object { $_.Name -ceq $Name })
+    if ($properties.Count -gt 1) {
+        throw "$Context contains duplicate field '$Name'."
+    }
+    if ($properties.Count -eq 0) {
+        if ($Required) {
+            throw "$Context is missing required field '$Name'."
+        }
+        return $null
+    }
+    return $properties[0]
+}
+
+function Get-AnswerMeJsonArray {
+    param(
+        [AllowNull()][object]$Value,
+        [Parameter(Mandatory = $true)][string]$Context
+    )
+
+    if ($null -eq $Value -or $Value -isnot [Array]) {
+        throw "$Context must be a JSON array."
+    }
+    return [object[]]$Value
+}
+
+function Get-AnswerMeInteger {
+    param(
+        [AllowNull()][object]$Value,
+        [Parameter(Mandatory = $true)][string]$Context
+    )
+
+    if ($Value -isnot [int] -and $Value -isnot [long]) {
+        throw "$Context must be an integer."
+    }
+    return [long]$Value
+}
+
+function Get-AnswerMeUnicodeCodePointCount {
+    param(
+        [Parameter(Mandatory = $true)][string]$Value,
+        [Parameter(Mandatory = $true)][string]$Context
+    )
+
+    $count = 0
+    for ($index = 0; $index -lt $Value.Length; $index += 1) {
+        $current = $Value[$index]
+        if ([char]::IsHighSurrogate($current)) {
+            if ($index + 1 -ge $Value.Length -or -not [char]::IsLowSurrogate($Value[$index + 1])) {
+                throw "$Context contains an unpaired Unicode surrogate."
+            }
+            $index += 1
+        }
+        elseif ([char]::IsLowSurrogate($current)) {
+            throw "$Context contains an unpaired Unicode surrogate."
+        }
+        $count += 1
+    }
+    return $count
+}
+
+function Get-AnswerMeNormalizedString {
+    param(
+        [AllowNull()][object]$Value,
+        [Parameter(Mandatory = $true)][string]$Context,
+        [int]$MinimumCodePoints = 0,
+        [int]$MaximumCodePoints = [int]::MaxValue
+    )
+
+    if ($Value -isnot [string]) {
+        throw "$Context must be a string."
+    }
+    $trimmed = $Value.Trim()
+    $codePointCount = Get-AnswerMeUnicodeCodePointCount -Value $trimmed -Context $Context
+    if ($codePointCount -lt $MinimumCodePoints -or $codePointCount -gt $MaximumCodePoints) {
+        throw "$Context must contain between $MinimumCodePoints and $MaximumCodePoints Unicode code points."
+    }
+    return $trimmed
+}
+
+function Get-AnswerMeSubstringByCodePoints {
+    param(
+        [Parameter(Mandatory = $true)][string]$Value,
+        [Parameter(Mandatory = $true)][ValidateRange(1, [int]::MaxValue)][int]$MaximumCodePoints
+    )
+
+    $endIndex = 0
+    $codePointCount = 0
+    while ($endIndex -lt $Value.Length -and $codePointCount -lt $MaximumCodePoints) {
+        $current = $Value[$endIndex]
+        if ([char]::IsHighSurrogate($current)) {
+            if ($endIndex + 1 -ge $Value.Length -or -not [char]::IsLowSurrogate($Value[$endIndex + 1])) {
+                throw 'String contains an unpaired Unicode surrogate.'
+            }
+            $endIndex += 2
+        }
+        elseif ([char]::IsLowSurrogate($current)) {
+            throw 'String contains an unpaired Unicode surrogate.'
+        }
+        else {
+            $endIndex += 1
+        }
+        $codePointCount += 1
+    }
+    return $Value.Substring(0, $endIndex)
+}
+
+function Get-AnswerMeCompactShortLabel {
+    param([Parameter(Mandatory = $true)][string]$Title)
+
+    return Get-AnswerMeSubstringByCodePoints -Value $Title -MaximumCodePoints 20
+}
+
+function ConvertFrom-AnswerMeCompactQuestionnaire {
+    param([Parameter(Mandatory = $true)][object]$Compact)
+
+    Assert-AnswerMeJsonObject -Value $Compact -Context 'Compact questionnaire'
+    Assert-AnswerMeAllowedProperties `
+        -Value $Compact `
+        -Allowed @('topic', 'intro', 'questions', 'allowAdditionalContext', 'expiresInSeconds') `
+        -Context 'Compact questionnaire'
+
+    $topicProperty = Get-AnswerMeProperty -Value $Compact -Name 'topic' -Context 'Compact questionnaire' -Required
+    $topic = Get-AnswerMeNormalizedString -Value $topicProperty.Value -Context 'Compact questionnaire topic' -MinimumCodePoints 1 -MaximumCodePoints 100
+    $questionsProperty = Get-AnswerMeProperty -Value $Compact -Name 'questions' -Context 'Compact questionnaire' -Required
+    $compactQuestions = @(Get-AnswerMeJsonArray -Value $questionsProperty.Value -Context 'Compact questionnaire questions')
+    if ($compactQuestions.Count -lt 1 -or $compactQuestions.Count -gt 20) {
+        throw 'Compact questionnaire must contain between 1 and 20 questions.'
+    }
+
+    $intro = $null
+    $introProperty = Get-AnswerMeProperty -Value $Compact -Name 'intro' -Context 'Compact questionnaire'
+    if ($null -ne $introProperty) {
+        $intro = Get-AnswerMeNormalizedString -Value $introProperty.Value -Context 'Compact questionnaire intro' -MaximumCodePoints 1000
+    }
+    $allowAdditionalContext = $false
+    $additionalContextProperty = Get-AnswerMeProperty -Value $Compact -Name 'allowAdditionalContext' -Context 'Compact questionnaire'
+    if ($null -ne $additionalContextProperty) {
+        if ($additionalContextProperty.Value -isnot [bool]) {
+            throw 'Compact questionnaire allowAdditionalContext must be a boolean.'
+        }
+        $allowAdditionalContext = [bool]$additionalContextProperty.Value
+    }
+    $expiresInSeconds = 3600
+    $expiresProperty = Get-AnswerMeProperty -Value $Compact -Name 'expiresInSeconds' -Context 'Compact questionnaire'
+    if ($null -ne $expiresProperty) {
+        $expiresInSeconds = Get-AnswerMeInteger -Value $expiresProperty.Value -Context 'Compact questionnaire expiresInSeconds'
+        if ($expiresInSeconds -lt 1 -or $expiresInSeconds -gt 604800) {
+            throw 'Compact questionnaire expiresInSeconds must be between 1 and 604800.'
+        }
+    }
+
+    $expandedQuestions = @()
+    $schemaVersion = 1
+    for ($questionIndex = 0; $questionIndex -lt $compactQuestions.Count; $questionIndex += 1) {
+        $question = $compactQuestions[$questionIndex]
+        $questionNumber = $questionIndex + 1
+        $context = "Compact question $questionNumber"
+        Assert-AnswerMeJsonObject -Value $question -Context $context
+        Assert-AnswerMeAllowedProperties `
+            -Value $question `
+            -Allowed @('title', 'type', 'body', 'maxLength', 'options', 'minSelections', 'maxSelections') `
+            -Context $context
+
+        $titleProperty = Get-AnswerMeProperty -Value $question -Name 'title' -Context $context -Required
+        $title = Get-AnswerMeNormalizedString -Value $titleProperty.Value -Context "$context title" -MinimumCodePoints 1 -MaximumCodePoints 1000
+        $typeProperty = Get-AnswerMeProperty -Value $question -Name 'type' -Context $context -Required
+        $questionType = Get-AnswerMeNormalizedString -Value $typeProperty.Value -Context "$context type" -MinimumCodePoints 1 -MaximumCodePoints 32
+        if ($questionType -cnotin @('single-choice', 'multiple-choice', 'text')) {
+            throw "$context must use type=single-choice, type=multiple-choice or type=text."
+        }
+        $bodyProperty = Get-AnswerMeProperty -Value $question -Name 'body' -Context $context
+        if ($null -ne $bodyProperty -or $questionType -ceq 'text') { $schemaVersion = 2 }
+        if ($questionType -ceq 'text') {
+            Assert-AnswerMeAllowedProperties -Value $question -Allowed @('title', 'type', 'body', 'maxLength') -Context $context
+            $expandedText = [ordered]@{
+                id = "q$questionNumber"
+                type = 'text'
+                title = $title
+                shortLabel = Get-AnswerMeCompactShortLabel -Title $title
+                required = $true
+            }
+            if ($null -ne $bodyProperty) { $expandedText.body = $bodyProperty.Value }
+            $lengthProperty = Get-AnswerMeProperty -Value $question -Name 'maxLength' -Context $context
+            if ($null -ne $lengthProperty) { $expandedText.maxLength = $lengthProperty.Value }
+            $expandedQuestions += [PSCustomObject]$expandedText
+            continue
+        }
+        if ($null -ne (Get-AnswerMeProperty -Value $question -Name 'maxLength' -Context $context)) {
+            throw "$context choice questions forbid maxLength."
+        }
+        $optionsProperty = Get-AnswerMeProperty -Value $question -Name 'options' -Context $context -Required
+        $compactOptions = @(Get-AnswerMeJsonArray -Value $optionsProperty.Value -Context "$context options")
+        if ($compactOptions.Count -lt 2 -or $compactOptions.Count -gt 20) {
+            throw "$context must contain between 2 and 20 option labels."
+        }
+
+        $questionId = "q$questionNumber"
+        $expandedOptions = @()
+        for ($optionIndex = 0; $optionIndex -lt $compactOptions.Count; $optionIndex += 1) {
+            $optionLabel = Get-AnswerMeNormalizedString `
+                -Value $compactOptions[$optionIndex] `
+                -Context "$context option $($optionIndex + 1)" `
+                -MinimumCodePoints 1 `
+                -MaximumCodePoints 100
+            $expandedOptions += [PSCustomObject][ordered]@{
+                id = "$questionId-o$($optionIndex + 1)"
+                label = $optionLabel
+            }
+        }
+
+        if ($questionType -ceq 'single-choice') {
+            if ($null -ne (Get-AnswerMeProperty -Value $question -Name 'minSelections' -Context $context) -or
+                $null -ne (Get-AnswerMeProperty -Value $question -Name 'maxSelections' -Context $context)) {
+                throw "$context single-choice selection range is fixed by the adapter."
+            }
+            $minSelections = 1
+            $maxSelections = 1
+        }
+        else {
+            $minSelections = 1
+            $maxSelections = $compactOptions.Count
+            $minimumProperty = Get-AnswerMeProperty -Value $question -Name 'minSelections' -Context $context
+            if ($null -ne $minimumProperty) {
+                $minSelections = Get-AnswerMeInteger -Value $minimumProperty.Value -Context "$context minSelections"
+            }
+            $maximumProperty = Get-AnswerMeProperty -Value $question -Name 'maxSelections' -Context $context
+            if ($null -ne $maximumProperty) {
+                $maxSelections = Get-AnswerMeInteger -Value $maximumProperty.Value -Context "$context maxSelections"
+            }
+        }
+
+        $expandedQuestions += [PSCustomObject][ordered]@{
+            id = $questionId
+            type = $questionType
+            title = $title
+            shortLabel = Get-AnswerMeCompactShortLabel -Title $title
+            required = $true
+            minSelections = $minSelections
+            maxSelections = $maxSelections
+            options = $expandedOptions
+            allowCustomAnswer = $false
+        }
+        if ($null -ne $bodyProperty) { $expandedQuestions[-1] | Add-Member -NotePropertyName body -NotePropertyValue $bodyProperty.Value }
+    }
+
+    $expanded = [ordered]@{
+        schemaVersion = $schemaVersion
+        type = 'questionnaire'
+        topic = $topic
+        questions = $expandedQuestions
+        allowAdditionalContext = $allowAdditionalContext
+        expiresInSeconds = $expiresInSeconds
+        visual = [PSCustomObject]@{ theme = 'auto' }
+    }
+    if ($null -ne $intro -and $intro.Length -gt 0) {
+        $expanded.intro = $intro
+    }
+    return [PSCustomObject]$expanded
+}
+
+function Assert-AnswerMeTemplate {
+    param([Parameter(Mandatory = $true)][object]$Template)
+
+    Assert-AnswerMeJsonObject -Value $Template -Context 'Template'
+    Assert-AnswerMeAllowedProperties `
+        -Value $Template `
+        -Allowed @('schemaVersion', 'type', 'topic', 'intro', 'questions', 'allowAdditionalContext', 'expiresInSeconds', 'visual') `
+        -Context 'Template'
+
+    $schemaVersionProperty = Get-AnswerMeProperty -Value $Template -Name 'schemaVersion' -Context 'Template' -Required
+    $schemaVersion = Get-AnswerMeInteger -Value $schemaVersionProperty.Value -Context 'Template schemaVersion'
+    if ($schemaVersion -notin @(1, 2)) {
+        throw 'Template must use schemaVersion=1 or schemaVersion=2.'
+    }
+    $typeProperty = Get-AnswerMeProperty -Value $Template -Name 'type' -Context 'Template' -Required
+    $templateType = Get-AnswerMeNormalizedString -Value $typeProperty.Value -Context 'Template type' -MinimumCodePoints 1 -MaximumCodePoints 32
+    if ($templateType -cne 'questionnaire') {
+        throw 'Template must use type=questionnaire.'
+    }
+    $typeProperty.Value = $templateType
+    $topicProperty = Get-AnswerMeProperty -Value $Template -Name 'topic' -Context 'Template' -Required
+    $topicProperty.Value = Get-AnswerMeNormalizedString -Value $topicProperty.Value -Context 'Template topic' -MinimumCodePoints 1 -MaximumCodePoints 100
+
+    $introProperty = Get-AnswerMeProperty -Value $Template -Name 'intro' -Context 'Template'
+    if ($null -ne $introProperty) {
+        $introProperty.Value = Get-AnswerMeNormalizedString -Value $introProperty.Value -Context 'Template intro' -MaximumCodePoints 1000
+    }
+    $additionalContextProperty = Get-AnswerMeProperty -Value $Template -Name 'allowAdditionalContext' -Context 'Template'
+    if ($null -ne $additionalContextProperty -and $additionalContextProperty.Value -isnot [bool]) {
+        throw 'Template allowAdditionalContext must be a boolean.'
+    }
+    $expiresProperty = Get-AnswerMeProperty -Value $Template -Name 'expiresInSeconds' -Context 'Template'
+    if ($null -ne $expiresProperty) {
+        $expiresInSeconds = Get-AnswerMeInteger -Value $expiresProperty.Value -Context 'Template expiresInSeconds'
+        if ($expiresInSeconds -lt 1 -or $expiresInSeconds -gt 604800) {
+            throw 'Template expiresInSeconds must be between 1 and 604800.'
+        }
+        $expiresProperty.Value = $expiresInSeconds
+    }
+    $visualProperty = Get-AnswerMeProperty -Value $Template -Name 'visual' -Context 'Template' -Required
+    $visual = $visualProperty.Value
+    Assert-AnswerMeJsonObject -Value $visual -Context 'Template visual'
+    Assert-AnswerMeAllowedProperties -Value $visual -Allowed @('theme') -Context 'Template visual'
+    $themeProperty = Get-AnswerMeProperty -Value $visual -Name 'theme' -Context 'Template visual' -Required
+    $theme = Get-AnswerMeNormalizedString -Value $themeProperty.Value -Context 'Template visual theme' -MinimumCodePoints 1 -MaximumCodePoints 16
+    if ($theme -cne 'auto') {
+        throw 'Template visual theme must be auto.'
+    }
+    $themeProperty.Value = $theme
+
+    $questionsProperty = Get-AnswerMeProperty -Value $Template -Name 'questions' -Context 'Template' -Required
+    $questions = @(Get-AnswerMeJsonArray -Value $questionsProperty.Value -Context 'Template questions')
+    if ($questions.Count -lt 1 -or $questions.Count -gt 20) {
+        throw 'Template must contain between 1 and 20 questions.'
+    }
+    $questionIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal)
+    for ($questionIndex = 0; $questionIndex -lt $questions.Count; $questionIndex += 1) {
+        $question = $questions[$questionIndex]
+        $questionContext = "Question $($questionIndex + 1)"
+        Assert-AnswerMeJsonObject -Value $question -Context $questionContext
+        Assert-AnswerMeAllowedProperties `
+            -Value $question `
+            -Allowed @('id', 'type', 'title', 'shortLabel', 'required', 'body', 'maxLength', 'minSelections', 'maxSelections', 'options', 'allowCustomAnswer', 'customAnswerMaxLength') `
+            -Context $questionContext
+
+        $questionIdProperty = Get-AnswerMeProperty -Value $question -Name 'id' -Context $questionContext -Required
+        $questionId = Get-AnswerMeNormalizedString -Value $questionIdProperty.Value -Context "$questionContext id" -MinimumCodePoints 1
+        $questionIdProperty.Value = $questionId
+        if (-not $questionIds.Add($questionId)) {
+            throw "Duplicate question id '$questionId'."
+        }
+        $questionTypeProperty = Get-AnswerMeProperty -Value $question -Name 'type' -Context $questionContext -Required
+        $questionType = Get-AnswerMeNormalizedString -Value $questionTypeProperty.Value -Context "$questionContext type" -MinimumCodePoints 1 -MaximumCodePoints 32
+        if ($questionType -cnotin @('single-choice', 'multiple-choice', 'text')) {
+            throw "$questionContext must use type=single-choice, type=multiple-choice or type=text."
+        }
+        $bodyProperty = Get-AnswerMeProperty -Value $question -Name 'body' -Context $questionContext
+        $lengthProperty = Get-AnswerMeProperty -Value $question -Name 'maxLength' -Context $questionContext
+        if ($schemaVersion -eq 1 -and ($null -ne $bodyProperty -or $null -ne $lengthProperty -or $questionType -ceq 'text')) {
+            throw "$questionContext body, maxLength and text require schemaVersion=2."
+        }
+        if ($null -ne $bodyProperty) {
+            if ($bodyProperty.Value -isnot [string]) { throw "$questionContext body must be a string." }
+            if ($bodyProperty.Value.Length -gt 0 -and (Get-AnswerMeUnicodeCodePointCount -Value $bodyProperty.Value -Context "$questionContext body") -gt 10000) {
+                throw "$questionContext body must contain at most 10000 Unicode code points."
+            }
+            if ([string]::IsNullOrWhiteSpace($bodyProperty.Value)) { $question.PSObject.Properties.Remove('body') }
+        }
+        $questionTypeProperty.Value = $questionType
+        $titleProperty = Get-AnswerMeProperty -Value $question -Name 'title' -Context $questionContext -Required
+        $titleProperty.Value = Get-AnswerMeNormalizedString -Value $titleProperty.Value -Context "$questionContext title" -MinimumCodePoints 1 -MaximumCodePoints 1000
+        $shortLabelProperty = Get-AnswerMeProperty -Value $question -Name 'shortLabel' -Context $questionContext -Required
+        $shortLabelProperty.Value = Get-AnswerMeNormalizedString -Value $shortLabelProperty.Value -Context "$questionContext shortLabel" -MinimumCodePoints 1 -MaximumCodePoints 20
+        $requiredProperty = Get-AnswerMeProperty -Value $question -Name 'required' -Context $questionContext -Required
+        if ($requiredProperty.Value -isnot [bool]) {
+            throw "$questionContext required must be a boolean."
+        }
+        if ($questionType -ceq 'text') {
+            Assert-AnswerMeAllowedProperties -Value $question -Allowed @('id', 'type', 'title', 'shortLabel', 'required', 'body', 'maxLength') -Context $questionContext
+            $maxLength = 2000
+            if ($null -ne $lengthProperty) {
+                $maxLength = Get-AnswerMeInteger -Value $lengthProperty.Value -Context "$questionContext maxLength"
+                if ($maxLength -lt 1 -or $maxLength -gt 2000) { throw "$questionContext maxLength must be between 1 and 2000." }
+                $lengthProperty.Value = $maxLength
+            }
+            else { $question | Add-Member -NotePropertyName maxLength -NotePropertyValue $maxLength }
+            continue
+        }
+        if ($null -ne $lengthProperty) { throw "$questionContext choice questions forbid maxLength." }
+        $minimumProperty = Get-AnswerMeProperty -Value $question -Name 'minSelections' -Context $questionContext -Required
+        $minSelections = Get-AnswerMeInteger -Value $minimumProperty.Value -Context "$questionContext minSelections"
+        $minimumProperty.Value = $minSelections
+        $maximumProperty = Get-AnswerMeProperty -Value $question -Name 'maxSelections' -Context $questionContext -Required
+        $maxSelections = Get-AnswerMeInteger -Value $maximumProperty.Value -Context "$questionContext maxSelections"
+        $maximumProperty.Value = $maxSelections
+        $allowCustomAnswerProperty = Get-AnswerMeProperty -Value $question -Name 'allowCustomAnswer' -Context $questionContext -Required
+        if ($allowCustomAnswerProperty.Value -isnot [bool]) {
+            throw "$questionContext allowCustomAnswer must be a boolean."
+        }
+        $allowCustomAnswer = [bool]$allowCustomAnswerProperty.Value
+        $optionsProperty = Get-AnswerMeProperty -Value $question -Name 'options' -Context $questionContext -Required
+        $options = @(Get-AnswerMeJsonArray -Value $optionsProperty.Value -Context "$questionContext options")
+        if ($options.Count -lt 2 -or $options.Count -gt 20) {
+            throw "Question '$questionId' must contain between 2 and 20 options."
+        }
+        if ($questionType -ceq 'single-choice') {
+            if ($minSelections -ne 1 -or $maxSelections -ne 1) {
+                throw "Question '$questionId' must use minSelections=1 and maxSelections=1 for single-choice."
+            }
+        }
+        else {
+            $availableSelections = $options.Count + $(if ($allowCustomAnswer) { 1 } else { 0 })
+            if ($minSelections -lt 1 -or
+                $maxSelections -lt 2 -or
+                $minSelections -gt $maxSelections -or
+                $maxSelections -gt 20 -or
+                $maxSelections -gt $availableSelections) {
+                throw "Question '$questionId' has an invalid multiple-choice selection range."
+            }
+        }
+        $customAnswerLengthProperty = Get-AnswerMeProperty -Value $question -Name 'customAnswerMaxLength' -Context $questionContext
+        if ($null -ne $customAnswerLengthProperty) {
+            $customAnswerMaxLength = Get-AnswerMeInteger -Value $customAnswerLengthProperty.Value -Context "$questionContext customAnswerMaxLength"
+            if (-not $allowCustomAnswer -or $customAnswerMaxLength -lt 1 -or $customAnswerMaxLength -gt 2000) {
+                throw "Question '$questionId' has an invalid customAnswerMaxLength."
+            }
+            $customAnswerLengthProperty.Value = $customAnswerMaxLength
+        }
+
+        $optionIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal)
+        for ($optionIndex = 0; $optionIndex -lt $options.Count; $optionIndex += 1) {
+            $option = $options[$optionIndex]
+            $optionContext = "Question '$questionId' option $($optionIndex + 1)"
+            Assert-AnswerMeJsonObject -Value $option -Context $optionContext
+            Assert-AnswerMeAllowedProperties -Value $option -Allowed @('id', 'label', 'description') -Context $optionContext
+            $optionIdProperty = Get-AnswerMeProperty -Value $option -Name 'id' -Context $optionContext -Required
+            $optionId = Get-AnswerMeNormalizedString -Value $optionIdProperty.Value -Context "$optionContext id" -MinimumCodePoints 1
+            $optionIdProperty.Value = $optionId
+            if (-not $optionIds.Add($optionId)) {
+                throw "Duplicate option id '$optionId' in question '$questionId'."
+            }
+            $labelProperty = Get-AnswerMeProperty -Value $option -Name 'label' -Context $optionContext -Required
+            $labelProperty.Value = Get-AnswerMeNormalizedString -Value $labelProperty.Value -Context "$optionContext label" -MinimumCodePoints 1 -MaximumCodePoints 100
+            $descriptionProperty = Get-AnswerMeProperty -Value $option -Name 'description' -Context $optionContext
+            if ($null -ne $descriptionProperty) {
+                $descriptionProperty.Value = Get-AnswerMeNormalizedString -Value $descriptionProperty.Value -Context "$optionContext description" -MaximumCodePoints 500
+            }
+        }
+    }
+}
+
+function Get-AnswerMeIdempotencyKey {
+    param(
+        [AllowNull()][string]$Value,
+        [switch]$Generate
+    )
+
+    if (-not $Generate) {
+        if ($Value -cnotmatch '^[0-9a-f]{32}$') {
+            throw 'IdempotencyKey must be exactly 32 lowercase hexadecimal characters.'
+        }
+        return $Value
+    }
+
+    $randomBytes = New-AnswerMeCryptographicRandomBytes -Length 16
+    try {
+        return ConvertTo-AnswerMeLowerHex -Bytes $randomBytes
+    }
+    finally {
+        Clear-AnswerMeSensitiveByteArray -Bytes $randomBytes
+    }
+}
+
+function Get-AnswerMeRetryAfterSeconds {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    $rawValue = [string]$Response.Headers['Retry-After']
+    $parsedValue = 0
+    if ([int]::TryParse($rawValue, [ref]$parsedValue) -and $parsedValue -ge 0) {
+        return $parsedValue
+    }
+    return 0
+}
+
+function Test-AnswerMeWriterAdmissionResponse {
+    param(
+        [Parameter(Mandatory = $true)][object]$Response,
+        [AllowNull()][object]$Body
+    )
+
+    return (Test-AnswerMeCreateErrorResponse -StatusCode ([int]$Response.StatusCode) -Body $Body) -and
+        $Body.code -ceq 'service_unavailable' -and
+        $Body.reason -cin @('writer_admission_full', 'writer_admission_timeout')
+}
+
+function ConvertFrom-AnswerMeResponseBody {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    if ([string]::IsNullOrWhiteSpace([string]$Response.Content)) {
+        return $null
+    }
+    try {
+        if ((Get-Command ConvertFrom-Json).Parameters.ContainsKey('DateKind')) {
+            return $Response.Content | ConvertFrom-Json -DateKind String
+        }
+        return $Response.Content | ConvertFrom-Json
+    }
+    catch {
+        return $null
+    }
+}
+
+function Test-AnswerMeNoStoreResponse {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    return ([string]$Response.Headers['Cache-Control']).Trim() -ceq 'no-store'
+}
+
+function Test-AnswerMeResponseFields {
+    param(
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string[]]$ExpectedFields
+    )
+
+    if ($null -eq $Body) { return $false }
+    $actual = @($Body.PSObject.Properties.Name | Sort-Object)
+    $expected = @($ExpectedFields | Sort-Object)
+    return $actual.Count -eq $expected.Count -and
+        -not (Compare-Object -ReferenceObject $expected -DifferenceObject $actual -CaseSensitive)
+}
+
+function Test-AnswerMeCreateErrorResponse {
+    param(
+        [Parameter(Mandatory = $true)][int]$StatusCode,
+        [AllowNull()][object]$Body
+    )
+
+    if ($Body -isnot [PSCustomObject]) { return $false }
+    $allowedFields = @('code', 'requestId', 'path', 'reason')
+    $actualFields = @($Body.PSObject.Properties.Name)
+    if ($actualFields.Count -lt 2 -or
+        @($actualFields | Where-Object { $allowedFields -cnotcontains $_ }).Count -gt 0 -or
+        @($actualFields | Where-Object { $_ -ceq 'code' }).Count -ne 1 -or
+        @($actualFields | Where-Object { $_ -ceq 'requestId' }).Count -ne 1 -or
+        $Body.code -isnot [string] -or
+        $Body.requestId -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.requestId)) {
+        return $false
+    }
+    if ($null -ne $Body.PSObject.Properties['path'] -and
+        ($Body.path -isnot [string] -or [string]$Body.path -cne '/api/v1/interactions')) {
+        return $false
+    }
+    if ($null -ne $Body.PSObject.Properties['reason'] -and $Body.reason -isnot [string]) {
+        return $false
+    }
+
+    $reason = if ($null -ne $Body.PSObject.Properties['reason']) { [string]$Body.reason } else { $null }
+    switch ($StatusCode) {
+        400 { return $Body.code -ceq 'invalid_request' -and $null -eq $reason }
+        401 {
+            return $Body.code -ceq 'invalid_creator_credential' -and
+                $reason -cin @('invalid', 'idle_expired', 'max_lifetime_expired', 'abuse_revoked')
+        }
+        404 { return $Body.code -ceq 'interaction_not_found' -and $null -eq $reason }
+        405 { return $Body.code -ceq 'invalid_request' -and $null -eq $reason }
+        409 { return $Body.code -ceq 'idempotency_conflict' -and $null -eq $reason }
+        413 { return $Body.code -ceq 'invalid_request' -and $null -eq $reason }
+        422 { return $Body.code -ceq 'definition_invalid' -and $null -eq $reason }
+        429 {
+            return $Body.code -ceq 'rate_limited' -and
+                ($null -eq $reason -or $reason -cin @('creator_rolling_create_limit', 'temporary_credential_daily_limit'))
+        }
+        503 {
+            return $Body.code -cin @('service_unavailable', 'creation_unavailable') -and
+                ($null -eq $reason -or $reason -cin @('writer_admission_full', 'writer_admission_timeout'))
+        }
+        default { return $false }
+    }
+}
+
+function Test-AnswerMeCreateResponse {
+    param(
+        [Parameter(Mandatory = $true)][object]$Response,
+        [AllowNull()][object]$Body
+    )
+
+    if (-not (Test-AnswerMeNoStoreResponse -Response $Response) -or $Body -isnot [PSCustomObject]) {
+        return $false
+    }
+    $requiredFields = @('interactionId', 'answerUrl', 'resultToken', 'status', 'expiresAt', 'requestId')
+    $allowedFields = @($requiredFields + @('idempotentReplay', 'waitDecision'))
+    $actualFields = @($Body.PSObject.Properties.Name)
+    if (@($actualFields | Where-Object { $allowedFields -cnotcontains $_ }).Count -gt 0) { return $false }
+    foreach ($requiredField in $requiredFields) {
+        if (@($actualFields | Where-Object { $_ -ceq $requiredField }).Count -ne 1) { return $false }
+    }
+    foreach ($textField in @('interactionId', 'answerUrl', 'resultToken', 'status', 'expiresAt', 'requestId')) {
+        if ($Body.$textField -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$Body.$textField)) {
+            return $false
+        }
+    }
+    if ([string]$Body.status -cne 'pending') { return $false }
+    if ($null -ne $Body.PSObject.Properties['idempotentReplay'] -and
+        ($Body.idempotentReplay -isnot [bool] -or $Body.idempotentReplay -ne $true)) {
+        return $false
+    }
+
+    $expiresAt = [string]$Body.expiresAt
+    $parsedExpiresAt = [DateTimeOffset]::MinValue
+    if ($expiresAt -cnotmatch '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$' -or
+        -not [DateTimeOffset]::TryParse(
+            $expiresAt,
+            [Globalization.CultureInfo]::InvariantCulture,
+            [Globalization.DateTimeStyles]::RoundtripKind,
+            [ref]$parsedExpiresAt
+        )) {
+        return $false
+    }
+
+    $answerUri = $null
+    if (-not [Uri]::TryCreate([string]$Body.answerUrl, [UriKind]::Absolute, [ref]$answerUri) -or
+        -not [string]::IsNullOrEmpty($answerUri.UserInfo)) {
+        return $false
+    }
+    if ($answerUri.Scheme -ceq 'https') { return $true }
+    if (-not $AllowInsecureLoopbackHttpForTest -or $answerUri.Scheme -cne 'http') { return $false }
+    return $answerUri.DnsSafeHost -cin @('127.0.0.1', 'localhost', '::1')
+}
+
+function Test-AnswerMeCapabilitiesResponse {
+    param([AllowNull()][object]$Body, [int]$SchemaVersion = 1)
+
+    if ($Body -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $Body `
+            -ExpectedFields @('protocolVersion', 'schemaVersions', 'clientProtocol', 'capabilities', 'requestId'))) {
+        return $false
+    }
+    if ($Body.protocolVersion -isnot [string] -or
+        [string]$Body.protocolVersion -cne $AnswerMeProtocolVersion -or
+        $Body.requestId -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.requestId) -or
+        $Body.schemaVersions -isnot [Array] -or
+        @($Body.schemaVersions).Count -ne $SchemaVersion -or
+        @($Body.schemaVersions | Where-Object { ($_ -isnot [int] -and $_ -isnot [long]) -or $_ -notin @(1, 2) }).Count -gt 0 -or
+        $Body.schemaVersions -notcontains 1 -or
+        ($SchemaVersion -eq 2 -and $Body.schemaVersions -notcontains 2)) {
+        return $false
+    }
+
+    $clientProtocol = $Body.clientProtocol
+    if ($clientProtocol -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $clientProtocol `
+            -ExpectedFields @('supportedVersions', 'recommendedVersion', 'minimumCompatibleSkillVersion')) -or
+        $clientProtocol.recommendedVersion -isnot [string] -or
+        [string]$clientProtocol.recommendedVersion -cne $AnswerMeProtocolVersion -or
+        $clientProtocol.minimumCompatibleSkillVersion -isnot [string] -or
+        [string]$clientProtocol.minimumCompatibleSkillVersion -cne '0.1.0' -or
+        $clientProtocol.supportedVersions -isnot [Array]) {
+        return $false
+    }
+    $supportedVersions = @($clientProtocol.supportedVersions)
+    if ($supportedVersions.Count -ne 2 -or
+        $supportedVersions[0] -isnot [string] -or
+        $supportedVersions[1] -isnot [string] -or
+        $supportedVersions -cnotcontains '1.0' -or
+        $supportedVersions -cnotcontains $AnswerMeProtocolVersion) {
+        return $false
+    }
+
+    $capabilities = $Body.capabilities
+    if ($capabilities -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $capabilities `
+            -ExpectedFields @('createInteraction', 'resultQuery', 'resultWait')) -or
+        $capabilities.createInteraction -isnot [bool] -or
+        $capabilities.createInteraction -ne $true -or
+        $capabilities.resultQuery -isnot [bool]) {
+        return $false
+    }
+    $resultWait = $capabilities.resultWait
+    return $resultWait -is [PSCustomObject] -and
+        (Test-AnswerMeResponseFields `
+            -Body $resultWait `
+            -ExpectedFields @('enabled', 'defaultWaitSeconds', 'maxWaitSeconds')) -and
+        $resultWait.enabled -is [bool] -and
+        ($resultWait.defaultWaitSeconds -is [int] -or $resultWait.defaultWaitSeconds -is [long]) -and
+        [long]$resultWait.defaultWaitSeconds -eq 55 -and
+        ($resultWait.maxWaitSeconds -is [int] -or $resultWait.maxWaitSeconds -is [long]) -and
+        [long]$resultWait.maxWaitSeconds -eq 600
+}
+
+function Test-AnswerMeIncompatibleCapabilitiesResponse {
+    param([AllowNull()][object]$Body)
+
+    if ($Body -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $Body `
+            -ExpectedFields @('protocolVersion', 'schemaVersions', 'clientProtocol', 'capabilities', 'requestId')) -or
+        $Body.protocolVersion -isnot [string] -or
+        [string]$Body.protocolVersion -cne $AnswerMeProtocolVersion -or
+        $Body.requestId -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.requestId) -or
+        $Body.schemaVersions -isnot [Array] -or
+        @($Body.schemaVersions).Count -ne 1 -or
+        ($Body.schemaVersions[0] -isnot [int] -and $Body.schemaVersions[0] -isnot [long]) -or
+        [long]$Body.schemaVersions[0] -ne 1) {
+        return $false
+    }
+    $clientProtocol = $Body.clientProtocol
+    if ($clientProtocol -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $clientProtocol `
+            -ExpectedFields @('supportedVersions', 'recommendedVersion', 'minimumCompatibleSkillVersion')) -or
+        $clientProtocol.recommendedVersion -isnot [string] -or
+        [string]$clientProtocol.recommendedVersion -cne $AnswerMeProtocolVersion -or
+        $clientProtocol.minimumCompatibleSkillVersion -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$clientProtocol.minimumCompatibleSkillVersion) -or
+        $clientProtocol.supportedVersions -isnot [Array]) {
+        return $false
+    }
+    $supportedVersions = @($clientProtocol.supportedVersions)
+    if ($supportedVersions.Count -lt 1 -or
+        @($supportedVersions | Where-Object { $_ -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$_) }).Count -gt 0 -or
+        $supportedVersions -ccontains $AnswerMeProtocolVersion) {
+        return $false
+    }
+    $capabilities = $Body.capabilities
+    if ($capabilities -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $capabilities `
+            -ExpectedFields @('createInteraction', 'resultQuery', 'resultWait')) -or
+        $capabilities.createInteraction -isnot [bool] -or
+        $capabilities.resultQuery -isnot [bool]) {
+        return $false
+    }
+    $resultWait = $capabilities.resultWait
+    return $resultWait -is [PSCustomObject] -and
+        (Test-AnswerMeResponseFields `
+            -Body $resultWait `
+            -ExpectedFields @('enabled', 'defaultWaitSeconds', 'maxWaitSeconds')) -and
+        $resultWait.enabled -is [bool] -and
+        ($resultWait.defaultWaitSeconds -is [int] -or $resultWait.defaultWaitSeconds -is [long]) -and
+        [long]$resultWait.defaultWaitSeconds -eq 55 -and
+        ($resultWait.maxWaitSeconds -is [int] -or $resultWait.maxWaitSeconds -is [long]) -and
+        [long]$resultWait.maxWaitSeconds -eq 600
+}
+
+function Test-AnswerMeProtocolUnsupportedErrorResponse {
+    param([AllowNull()][object]$Body)
+
+    if ($Body -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeResponseFields `
+            -Body $Body `
+            -ExpectedFields @(
+                'code',
+                'requestId',
+                'reason',
+                'receivedProtocolVersion',
+                'supportedProtocolVersions',
+                'minimumCompatibleSkillVersion'
+            )) -or
+        $Body.code -isnot [string] -or
+        [string]$Body.code -cne 'client_protocol_unsupported' -or
+        $Body.reason -isnot [string] -or
+        [string]$Body.reason -cne 'answerme_client_protocol_version_is_not_supported' -or
+        $Body.requestId -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.requestId) -or
+        $Body.receivedProtocolVersion -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.receivedProtocolVersion) -or
+        $Body.minimumCompatibleSkillVersion -isnot [string] -or
+        [string]::IsNullOrWhiteSpace([string]$Body.minimumCompatibleSkillVersion) -or
+        $Body.supportedProtocolVersions -isnot [Array]) {
+        return $false
+    }
+    $supportedVersions = @($Body.supportedProtocolVersions)
+    return $supportedVersions.Count -gt 0 -and
+        @($supportedVersions | Where-Object { $_ -isnot [string] -or [string]::IsNullOrWhiteSpace([string]$_) }).Count -eq 0
+}
+
+function Test-AnswerMeEnrollmentProgressEvent {
+    param(
+        [Parameter(Mandatory = $true)][string]$Line,
+        [Parameter(Mandatory = $true)][Uri]$ResolvedApiBaseUrl
+    )
+
+    try {
+        $eventBody = $Line | ConvertFrom-Json
+    }
+    catch {
+        return $false
+    }
+    if (-not (Test-AnswerMeResponseFields `
+        -Body $eventBody `
+        -ExpectedFields @('event', 'stage', 'verificationUrl')) -or
+        $eventBody.event -isnot [string] -or
+        [string]$eventBody.event -cne 'answerme.creator-enrollment.verification-url' -or
+        $eventBody.stage -isnot [string] -or
+        [string]$eventBody.stage -cne 'verification-handoff' -or
+        $eventBody.verificationUrl -isnot [string]) {
+        return $false
+    }
+
+    $eventUri = $null
+    return [Uri]::TryCreate([string]$eventBody.verificationUrl, [UriKind]::Absolute, [ref]$eventUri) -and
+        $eventUri.Scheme.Equals($ResolvedApiBaseUrl.Scheme, [StringComparison]::OrdinalIgnoreCase) -and
+        $eventUri.DnsSafeHost.Equals($ResolvedApiBaseUrl.DnsSafeHost, [StringComparison]::OrdinalIgnoreCase) -and
+        $eventUri.Port -eq $ResolvedApiBaseUrl.Port -and
+        [string]::IsNullOrEmpty($eventUri.UserInfo) -and
+        [string]::IsNullOrEmpty($eventUri.Fragment)
+}
+
+function Invoke-AnswerMeEnrollmentChildProcess {
+    param(
+        [Parameter(Mandatory = $true)][string]$PowerShellPath,
+        [Parameter(Mandatory = $true)][string[]]$Arguments,
+        [Parameter(Mandatory = $true)][Uri]$ResolvedApiBaseUrl
+    )
+
+    $startInfo = [Diagnostics.ProcessStartInfo]::new()
+    $startInfo.FileName = $PowerShellPath
+    $startInfo.UseShellExecute = $false
+    $startInfo.CreateNoWindow = $true
+    $startInfo.RedirectStandardOutput = $true
+    $startInfo.RedirectStandardError = $true
+    $startInfo.RedirectStandardInput = $true
+    $acknowledgementToken = [Guid]::NewGuid().ToString('N')
+    Set-AnswerMeProcessEnvironmentVariable `
+        -StartInfo $startInfo `
+        -Name 'ANSWERME_INTERNAL_VERIFICATION_EVENT_ACK' `
+        -Value $acknowledgementToken
+    Set-AnswerMeProcessArguments -StartInfo $startInfo -Arguments $Arguments
+
+    $process = [Diagnostics.Process]::new()
+    $process.StartInfo = $startInfo
+    try {
+        if (-not $process.Start()) { throw 'Enrollment client process could not be started.' }
+        $stdoutTask = $process.StandardOutput.ReadToEndAsync()
+        $invalidStderr = $false
+        $progressEventCount = 0
+        while ($null -ne ($line = $process.StandardError.ReadLine())) {
+            if (Test-AnswerMeEnrollmentProgressEvent -Line $line -ResolvedApiBaseUrl $ResolvedApiBaseUrl) {
+                $progressEventCount += 1
+                [Console]::Error.WriteLine($line)
+                [Console]::Error.Flush()
+                $selfTestAcknowledgementToken = [Environment]::GetEnvironmentVariable(
+                    'ANSWERME_INTERNAL_SELFTEST_CREATE_EVENT_ACK',
+                    'Process'
+                )
+                if (-not [string]::IsNullOrWhiteSpace($selfTestAcknowledgementToken)) {
+                    $selfTestAcknowledgement = [Console]::In.ReadLine()
+                    if ($selfTestAcknowledgement -cne $selfTestAcknowledgementToken) {
+                        $invalidStderr = $true
+                        $process.StandardInput.WriteLine('invalid-event')
+                        $process.StandardInput.Flush()
+                        continue
+                    }
+                }
+                $process.StandardInput.WriteLine($acknowledgementToken)
+                $process.StandardInput.Flush()
+            }
+            else {
+                $invalidStderr = $true
+                $process.StandardInput.WriteLine('invalid-event')
+                $process.StandardInput.Flush()
+            }
+        }
+        $process.WaitForExit()
+        return [PSCustomObject]@{
+            stdout = $stdoutTask.GetAwaiter().GetResult()
+            exitCode = $process.ExitCode
+            invalidStderr = $invalidStderr
+            progressEventCount = $progressEventCount
+        }
+    }
+    finally {
+        $process.Dispose()
+    }
+}
+
+function Test-AnswerMeRecoverableCredentialReason {
+    param([AllowNull()][string]$Reason)
+
+    return $Reason -cin @('invalid', 'idle_expired', 'max_lifetime_expired', 'abuse_revoked')
+}
+
+function Invoke-AnswerMeAutomaticEnrollment {
+    param(
+        [Parameter(Mandatory = $true)][Uri]$ResolvedApiBaseUrl,
+        [Parameter(Mandatory = $true)][string]$ResolvedCredentialPath
+    )
+
+    if ($AnswerMeAutomaticEnrollmentAttempted) {
+        Write-AnswerMeFailure `
+            -Code 'automatic-enrollment-exhausted' `
+            -Message 'This operation has already attempted its one automatic Creator enrollment.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    $script:AnswerMeAutomaticEnrollmentAttempted = $true
+
+    $enrollmentScript = Join-Path $PSScriptRoot 'enroll-answerme-creator.ps1'
+    if (-not (Test-Path -LiteralPath $enrollmentScript -PathType Leaf)) {
+        Write-AnswerMeFailure `
+            -Code 'enrollment-client-missing' `
+            -Message 'The AnswerMe Creator enrollment client is required for automatic recovery.' `
+            -ExitCode 3
+    }
+
+    $arguments = @(
+        '-NoLogo',
+        '-NoProfile',
+        '-File', $enrollmentScript,
+        '-ApiBaseUrl', $ResolvedApiBaseUrl.AbsoluteUri.TrimEnd('/'),
+        '-CredentialPath', $ResolvedCredentialPath,
+        '-WaitTimeoutSeconds', [string]$localEnrollmentWaitDecision.effectiveTimeoutSeconds
+    )
+    if ($AllowInsecureLoopbackHttpForTest) { $arguments += '-AllowInsecureLoopbackHttpForTest' }
+    if ($SkipPopup) { $arguments += '-SkipPopup' }
+
+    $pwshPath = (Get-Process -Id $PID).Path
+    try {
+        $childResult = Invoke-AnswerMeEnrollmentChildProcess `
+            -PowerShellPath $pwshPath `
+            -Arguments $arguments `
+            -ResolvedApiBaseUrl $ResolvedApiBaseUrl
+    }
+    catch {
+        Write-AnswerMeFailure `
+            -Code 'automatic-enrollment-process-failed' `
+            -Message 'The automatic Creator enrollment process could not be executed.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    if ($childResult.invalidStderr -or $childResult.progressEventCount -gt 1) {
+        Write-AnswerMeFailure `
+            -Code 'automatic-enrollment-event-invalid' `
+            -Message 'Automatic Creator enrollment emitted an invalid progress event.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    $enrollmentExitCode = [int]$childResult.exitCode
+    $enrollmentText = ([string]$childResult.stdout).Trim()
+    $enrollment = $null
+    if (-not [string]::IsNullOrWhiteSpace($enrollmentText)) {
+        try {
+            $enrollment = $enrollmentText | ConvertFrom-Json
+        }
+        catch {
+            $enrollment = $null
+        }
+    }
+    if ($enrollmentExitCode -ne 0 -or $null -eq $enrollment -or $enrollment.ok -ne $true) {
+        Write-AnswerMeFailure `
+            -Code $(if ($null -ne $enrollment -and $enrollment.code) { [string]$enrollment.code } else { 'automatic-enrollment-failed' }) `
+            -Message 'Automatic Creator enrollment did not configure a protected credential.' `
+            -ExitCode $(if ($enrollmentExitCode -gt 0) { [int]$enrollmentExitCode } else { 4 }) `
+            -NetworkCalled $(if ($null -ne $enrollment) { $enrollment.networkCalled -eq $true } else { $true }) `
+            -Reason $(if ($null -ne $enrollment) { [string]$enrollment.reason } else { $null }) `
+            -RetryAfterSeconds $(if ($null -ne $enrollment) { [int]$enrollment.retryAfterSeconds } else { 0 })
+    }
+    $foregroundVerified = $null -ne $enrollment.verificationDelivery -and
+        $enrollment.verificationDelivery.foregroundVerified -eq $true
+    $expectedEventCount = if ($foregroundVerified) { 0 } else { 1 }
+    if ($childResult.progressEventCount -ne $expectedEventCount) {
+        Write-AnswerMeFailure `
+            -Code 'automatic-enrollment-event-missing' `
+            -Message 'Automatic Creator enrollment did not deliver its required verification URL event.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+
+    try {
+        $recoveredCredential = Import-Clixml -LiteralPath $ResolvedCredentialPath
+        if ($recoveredCredential -isnot [PSCredential]) {
+            throw 'Protected Creator credential did not contain a PSCredential.'
+        }
+        $recoveredBaseUrl = Resolve-AnswerMeApiBaseUrl `
+            -ApiBaseUrl $recoveredCredential.UserName `
+            -AllowInsecureLoopbackHttpForTest:$AllowInsecureLoopbackHttpForTest
+        if ($recoveredBaseUrl.AbsoluteUri.TrimEnd('/') -cne $ResolvedApiBaseUrl.AbsoluteUri.TrimEnd('/')) {
+            throw 'Protected Creator credential does not match the requested API origin.'
+        }
+        $recoveredKey = $recoveredCredential.GetNetworkCredential().Password
+        if ([string]::IsNullOrWhiteSpace($recoveredKey)) {
+            throw 'Protected Creator credential did not contain a Creator Key.'
+        }
+        return [PSCustomObject]@{
+            creatorKey = $recoveredKey
+            credentialSource = 'encrypted-file-recovered'
+        }
+    }
+    catch {
+        Write-AnswerMeFailure `
+            -Code 'credential-recovery-readback-failed' `
+            -Message 'The enrolled Creator credential could not be read back from protected storage.' `
+            -ExitCode 5 `
+            -NetworkCalled $true
+    }
+    finally {
+        $recoveredCredential = $null
+        $recoveredKey = $null
+    }
+}
+
+function Get-AnswerMeCredentialVerification {
+    param(
+        [Parameter(Mandatory = $true)][Uri]$ResolvedApiBaseUrl,
+        [Parameter(Mandatory = $true)][string]$CreatorKey
+    )
+
+    $verificationUri = ([Uri]::new($ResolvedApiBaseUrl, '/api/v1/creator-credentials/verify')).AbsoluteUri
+    $verificationHeaders = @{
+        Accept = 'application/json'
+        Authorization = "Bearer $CreatorKey"
+        'X-AnswerMe-Protocol-Version' = $AnswerMeProtocolVersion
+        'X-AnswerMe-Skill-Version' = $AnswerMeSkillVersion
+    }
+    try {
+        $verificationResponse = Invoke-AnswerMeWebRequest `
+            -Uri $verificationUri `
+            -Method Get `
+            -Headers $verificationHeaders `
+            -TimeoutSec 15
+    }
+    catch {
+        Write-AnswerMeFailure `
+            -Code 'credential-verification-unavailable' `
+            -Message 'The Creator credential could not be verified safely.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    $verificationBody = ConvertFrom-AnswerMeResponseBody -Response $verificationResponse
+    if ([int]$verificationResponse.StatusCode -ne 200) {
+        if ([int]$verificationResponse.StatusCode -eq 503 -and
+            (Test-AnswerMeNoStoreResponse -Response $verificationResponse) -and
+            (Test-AnswerMeResponseFields -Body $verificationBody -ExpectedFields @('code', 'requestId')) -and
+            $verificationBody.code -is [string] -and
+            [string]$verificationBody.code -ceq 'service_unavailable' -and
+            $verificationBody.requestId -is [string] -and
+            -not [string]::IsNullOrWhiteSpace([string]$verificationBody.requestId)) {
+            Write-AnswerMeFailure `
+                -Code 'service_unavailable' `
+                -Message 'The Creator credential verification service is unavailable.' `
+                -ExitCode 4 `
+                -NetworkCalled $true
+        }
+        Write-AnswerMeFailure `
+            -Code 'credential-verification-response-invalid' `
+            -Message 'The Creator credential verification service returned an invalid failure response.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    if (-not (Test-AnswerMeNoStoreResponse -Response $verificationResponse) -or $null -eq $verificationBody) {
+        Write-AnswerMeFailure `
+            -Code 'credential-verification-response-invalid' `
+            -Message 'Creator credential verification omitted its no-store contract or response body.' `
+            -ExitCode 4 `
+            -NetworkCalled $true
+    }
+    if ($verificationBody.valid -is [bool] -and
+        $verificationBody.valid -eq $true -and
+        (Test-AnswerMeResponseFields -Body $verificationBody -ExpectedFields @('valid', 'creatorId', 'reason', 'requestId')) -and
+        $verificationBody.creatorId -is [string] -and
+        $verificationBody.reason -is [string] -and
+        $verificationBody.requestId -is [string] -and
+        $verificationBody.reason -ceq 'active' -and
+        -not [string]::IsNullOrWhiteSpace($verificationBody.creatorId) -and
+        -not [string]::IsNullOrWhiteSpace($verificationBody.requestId)) {
+        return [PSCustomObject]@{ valid = $true; reason = 'active' }
+    }
+    if ($verificationBody.valid -is [bool] -and
+        $verificationBody.valid -eq $false -and
+        (Test-AnswerMeResponseFields -Body $verificationBody -ExpectedFields @('valid', 'reason', 'requestId')) -and
+        $verificationBody.reason -is [string] -and
+        $verificationBody.requestId -is [string] -and
+        (Test-AnswerMeRecoverableCredentialReason -Reason $verificationBody.reason) -and
+        -not [string]::IsNullOrWhiteSpace($verificationBody.requestId)) {
+        return [PSCustomObject]@{ valid = $false; reason = $verificationBody.reason }
+    }
+    Write-AnswerMeFailure `
+        -Code 'credential-verification-response-invalid' `
+        -Message 'Creator credential verification returned an unknown state.' `
+        -ExitCode 4 `
+        -NetworkCalled $true
+}
+
+$apiBaseUrlPolicyPath = Join-Path $PSScriptRoot 'answerme-api-base-url.ps1'
+if (-not (Test-Path -LiteralPath $apiBaseUrlPolicyPath -PathType Leaf)) {
+    Write-AnswerMeFailure -Code 'api-base-url-policy-missing' -Message 'The AnswerMe API base URL policy is required.' -ExitCode 3
+}
+try {
+    . $apiBaseUrlPolicyPath
+}
+catch {
+    Write-AnswerMeFailure -Code 'api-base-url-policy-unavailable' -Message 'The AnswerMe API base URL policy could not be loaded.' -ExitCode 3
+}
+
+$inputStopwatch = [Diagnostics.Stopwatch]::StartNew()
+try {
+    $hasTemplateJson = -not [string]::IsNullOrWhiteSpace($TemplateJson)
+    $hasCompactJson = -not [string]::IsNullOrWhiteSpace($CompactQuestionnaireJson)
+    if ($hasTemplateJson -eq $hasCompactJson) {
+        throw 'Specify exactly one of TemplateJson or CompactQuestionnaireJson.'
+    }
+    if ($hasCompactJson) {
+        Assert-AnswerMeJsonUnicodeWellFormed -Json $CompactQuestionnaireJson
+        $compactQuestionnaire = $CompactQuestionnaireJson | ConvertFrom-Json
+        $template = ConvertFrom-AnswerMeCompactQuestionnaire -Compact $compactQuestionnaire
+        $inputMode = 'compact-questionnaire-json-argument'
+    }
+    else {
+        Assert-AnswerMeJsonUnicodeWellFormed -Json $TemplateJson
+        $template = $TemplateJson | ConvertFrom-Json
+        $inputMode = 'json-argument'
+    }
+    Assert-AnswerMeTemplate -Template $template
+    $localWaitDecision = Get-AnswerMeWaitDecision -RequestedValue $WaitTimeoutSeconds
+    $localEnrollmentWaitDecision = Get-AnswerMeWaitDecision -RequestedValue $EnrollmentWaitTimeoutSeconds
+    $template | Add-Member -NotePropertyName 'waitPreference' -NotePropertyValue ([PSCustomObject]@{
+        timeoutSeconds = $localWaitDecision.requestedTimeoutSeconds
+    }) -Force
+    $requestJson = $template | ConvertTo-Json -Depth 32 -Compress
+}
+catch {
+    $AnswerMeTimings.inputValidationMilliseconds = [long]$inputStopwatch.ElapsedMilliseconds
+    Write-AnswerMeFailure `
+        -Code 'invalid-template' `
+        -Message $_.Exception.Message `
+        -ExitCode 2 `
+        -RecoveryAction 'correct-input-and-retry-once'
+}
+
+if ($localEnrollmentWaitDecision.effectiveTimeoutSeconds -lt 30) {
+    $AnswerMeTimings.inputValidationMilliseconds = [long]$inputStopwatch.ElapsedMilliseconds
+    Write-AnswerMeFailure `
+        -Code 'enrollment-wait-timeout-invalid' `
+        -Message 'EnrollmentWaitTimeoutSeconds must be an integer from 30 through 600.' `
+        -ExitCode 2
+}
+
+$validatedApiBaseUrl = $null
+if (-not [string]::IsNullOrWhiteSpace($ApiBaseUrl)) {
+    try {
+        $validatedApiBaseUrl = Resolve-AnswerMeApiBaseUrl `
+            -ApiBaseUrl $ApiBaseUrl `
+            -AllowInsecureLoopbackHttpForTest:$AllowInsecureLoopbackHttpForTest
+    }
+    catch {
+        $AnswerMeTimings.inputValidationMilliseconds = [long]$inputStopwatch.ElapsedMilliseconds
+        Write-AnswerMeFailure -Code 'api-base-url-invalid' -Message $_.Exception.Message -ExitCode 2
+    }
+}
+$resolvedIdempotencyKey = $null
+if ($PSBoundParameters.ContainsKey('IdempotencyKey')) {
+    try {
+        $resolvedIdempotencyKey = Get-AnswerMeIdempotencyKey -Value $IdempotencyKey
+    }
+    catch {
+        $AnswerMeTimings.inputValidationMilliseconds = [long]$inputStopwatch.ElapsedMilliseconds
+        Write-AnswerMeFailure -Code 'idempotency-key-invalid' -Message $_.Exception.Message -ExitCode 2
+    }
+}
+$AnswerMeTimings.inputValidationMilliseconds = [long]$inputStopwatch.ElapsedMilliseconds
+
+if ($ValidateOnly) {
+    [PSCustomObject]@{
+        ok = $true
+        status = 'validated'
+        inputMode = $inputMode
+        questionCount = @($template.questions).Count
+        waitDecision = $localWaitDecision
+        enrollmentWaitDecision = $localEnrollmentWaitDecision
+        protocolVersion = $AnswerMeProtocolVersion
+        skillVersion = $AnswerMeSkillVersion
+        timings = Get-AnswerMeTimings
+        networkCalled = $false
+        automaticEnrollmentAttempted = $false
+        originalRequestRetried = $false
+    } | ConvertTo-Json -Depth 6
+    exit 0
+}
+
+$configurationStopwatch = [Diagnostics.Stopwatch]::StartNew()
+$creatorKey = [Environment]::GetEnvironmentVariable($CreatorKeyEnvironmentVariable, 'Process')
+$credentialSource = 'environment'
+if ([string]::IsNullOrWhiteSpace($creatorKey)) {
+    $credentialSource = 'missing'
+}
+if ([string]::IsNullOrWhiteSpace($creatorKey) -or [string]::IsNullOrWhiteSpace($ApiBaseUrl)) {
+    if ([string]::IsNullOrWhiteSpace($CredentialPath)) {
+        $CredentialPath = Get-DefaultAnswerMeCredentialPath
+    }
+    if (-not [string]::IsNullOrWhiteSpace($CredentialPath) -and (Test-Path -LiteralPath $CredentialPath -PathType Leaf)) {
+        try {
+            $encryptedCredential = Import-Clixml -LiteralPath $CredentialPath
+            if ($encryptedCredential -isnot [PSCredential]) {
+                throw 'Encrypted credential file does not contain a PSCredential.'
+            }
+            if ([string]::IsNullOrWhiteSpace($ApiBaseUrl)) {
+                $ApiBaseUrl = $encryptedCredential.UserName
+            }
+            if ([string]::IsNullOrWhiteSpace($creatorKey)) {
+                $creatorKey = $encryptedCredential.GetNetworkCredential().Password
+                $credentialSource = 'encrypted-file'
+            }
+            $encryptedCredential = $null
+        }
+        catch {
+            Write-AnswerMeFailure -Code 'credential-file-invalid' -Message 'The encrypted Creator credential cannot be read by this Windows account.' -ExitCode 3
+        }
+    }
+}
+if ([string]::IsNullOrWhiteSpace($CredentialPath)) {
+    $CredentialPath = Get-DefaultAnswerMeCredentialPath
+}
+
+if ([string]::IsNullOrWhiteSpace($ApiBaseUrl)) {
+    Write-AnswerMeFailure -Code 'api-base-url-missing' -Message 'A trusted AnswerMe API base URL is required.' -ExitCode 2
+}
+$parsedBaseUrl = $validatedApiBaseUrl
+try {
+    $parsedBaseUrl = Resolve-AnswerMeApiBaseUrl `
+        -ApiBaseUrl $ApiBaseUrl `
+        -AllowInsecureLoopbackHttpForTest:$AllowInsecureLoopbackHttpForTest
+}
+catch {
+    Write-AnswerMeFailure -Code 'api-base-url-invalid' -Message $_.Exception.Message -ExitCode 2
+}
+
+if ($ValidateCredentialOnly) {
+    if ([string]::IsNullOrWhiteSpace($creatorKey)) {
+        Write-AnswerMeFailure -Code 'creator-key-missing' -Message 'A Creator Key is missing from the configured protected credential.' -ExitCode 3
+    }
+    $AnswerMeTimings.configurationMilliseconds = [long]$configurationStopwatch.ElapsedMilliseconds
+    [PSCustomObject]@{
+        ok = $true
+        status = 'credential-validated'
+        apiBaseUrl = $parsedBaseUrl.AbsoluteUri.TrimEnd('/')
+        credentialSource = $credentialSource
+        timings = Get-AnswerMeTimings
+        networkCalled = $false
+        automaticEnrollmentAttempted = $false
+        originalRequestRetried = $false
+    } | ConvertTo-Json -Depth 6
+    $creatorKey = $null
+    exit 0
+}
+
+$resultTokenStoreAdapter = Join-Path $PSScriptRoot 'result-token-store.windows.ps1'
+if (-not (Test-Path -LiteralPath $resultTokenStoreAdapter -PathType Leaf)) {
+    Write-AnswerMeFailure -Code 'result-token-store-adapter-missing' -Message 'A protected Result Token Store adapter is required.' -ExitCode 3
+}
+try {
+    . $resultTokenStoreAdapter
+    $resultTokenStore = Assert-AnswerMeResultTokenStore `
+        -StoreRoot $ResultTokenStoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultResultTokenStore
+}
+catch {
+    Write-AnswerMeFailure -Code 'result-token-store-unavailable' -Message $_.Exception.Message -ExitCode 3
+}
+$AnswerMeTimings.configurationMilliseconds = [long]$configurationStopwatch.ElapsedMilliseconds
+
+$capabilitiesUri = ([Uri]::new($parsedBaseUrl, '/api/v1/capabilities')).AbsoluteUri
+if ($template.schemaVersion -eq 2) { $capabilitiesUri += '?schemaVersion=2' }
+$capabilitiesHeaders = @{
+    Accept = 'application/json'
+    'X-AnswerMe-Protocol-Version' = $AnswerMeProtocolVersion
+    'X-AnswerMe-Skill-Version' = $AnswerMeSkillVersion
+}
+$capabilitiesStopwatch = [Diagnostics.Stopwatch]::StartNew()
+try {
+    $capabilitiesResponse = Invoke-AnswerMeWebRequest -Uri $capabilitiesUri -Method Get -Headers $capabilitiesHeaders -TimeoutSec 15
+}
+catch {
+    $AnswerMeTimings.capabilitiesMilliseconds = [long]$capabilitiesStopwatch.ElapsedMilliseconds
+    Write-AnswerMeFailure -Code 'capabilities-unavailable' -Message $_.Exception.Message -ExitCode 4 -NetworkCalled $true
+}
+$AnswerMeTimings.capabilitiesMilliseconds = [long]$capabilitiesStopwatch.ElapsedMilliseconds
+$capabilitiesBody = $null
+try {
+    if (-not [string]::IsNullOrWhiteSpace([string]$capabilitiesResponse.Content)) {
+        $capabilitiesBody = $capabilitiesResponse.Content | ConvertFrom-Json
+    }
+}
+catch {
+    $capabilitiesBody = $null
+}
+if ([int]$capabilitiesResponse.StatusCode -eq 409 -and
+    (Test-AnswerMeProtocolUnsupportedErrorResponse -Body $capabilitiesBody)) {
+    [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        stage = 'create'
+        code = 'client_protocol_unsupported'
+        message = 'The installed AnswerMe client protocol is not supported by the service.'
+        httpStatus = 409
+        reason = [string]$capabilitiesBody.reason
+        receivedProtocolVersion = [string]$capabilitiesBody.receivedProtocolVersion
+        supportedProtocolVersions = @($capabilitiesBody.supportedProtocolVersions)
+        minimumCompatibleSkillVersion = [string]$capabilitiesBody.minimumCompatibleSkillVersion
+        recoveryReference = 'references/errors.md'
+        networkCalled = $true
+        automaticEnrollmentAttempted = $AnswerMeAutomaticEnrollmentAttempted
+        originalRequestRetried = $AnswerMeOriginalRequestRetried
+    } | ConvertTo-Json -Depth 8
+    exit 6
+}
+$supportedProtocolVersions = @($capabilitiesBody.clientProtocol.supportedVersions)
+if ([int]$capabilitiesResponse.StatusCode -eq 200 -and
+    (Test-AnswerMeIncompatibleCapabilitiesResponse -Body $capabilitiesBody)) {
+    [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        stage = 'create'
+        code = 'client_protocol_unsupported'
+        message = 'The installed AnswerMe client protocol is not supported by the service.'
+        httpStatus = 200
+        reason = 'answerme_client_protocol_version_is_not_supported'
+        receivedProtocolVersion = $AnswerMeProtocolVersion
+        supportedProtocolVersions = $supportedProtocolVersions
+        minimumCompatibleSkillVersion = [string]$capabilitiesBody.clientProtocol.minimumCompatibleSkillVersion
+        recoveryReference = 'references/errors.md'
+        networkCalled = $true
+        automaticEnrollmentAttempted = $AnswerMeAutomaticEnrollmentAttempted
+        originalRequestRetried = $AnswerMeOriginalRequestRetried
+    } | ConvertTo-Json -Depth 8
+    exit 6
+}
+if ($template.schemaVersion -eq 2 -and
+    ([int]$capabilitiesResponse.StatusCode -eq 400 -or
+     ([int]$capabilitiesResponse.StatusCode -eq 200 -and
+      @($capabilitiesBody.schemaVersions | Where-Object { ($_ -is [int] -or $_ -is [long]) -and $_ -eq 2 }).Count -eq 0))) {
+    Write-AnswerMeFailure -Code 'unsupported-schema' -Message 'The service did not declare support for schemaVersion=2; creation was not attempted.' -ExitCode 6 -NetworkCalled $true
+}
+if ([int]$capabilitiesResponse.StatusCode -ne 200 -or
+    -not (Test-AnswerMeCapabilitiesResponse -Body $capabilitiesBody -SchemaVersion $template.schemaVersion)) {
+    Write-AnswerMeFailure -Code 'capabilities-invalid' -Message 'AnswerMe creation capabilities could not be verified.' -ExitCode 4 -NetworkCalled $true
+}
+
+if ([string]::IsNullOrWhiteSpace($creatorKey)) {
+    if ([string]::IsNullOrWhiteSpace($CredentialPath)) {
+        Write-AnswerMeFailure `
+            -Code 'credential-path-unavailable' `
+            -Message 'A protected Creator credential target is required for automatic enrollment.' `
+            -ExitCode 3 `
+            -NetworkCalled $true
+    }
+    $recovered = Invoke-AnswerMeAutomaticEnrollment `
+        -ResolvedApiBaseUrl $parsedBaseUrl `
+        -ResolvedCredentialPath $CredentialPath
+    $creatorKey = [string]$recovered.creatorKey
+    $credentialSource = [string]$recovered.credentialSource
+    $recovered = $null
+}
+elseif ($credentialSource -ceq 'encrypted-file') {
+    $credentialVerification = Get-AnswerMeCredentialVerification `
+        -ResolvedApiBaseUrl $parsedBaseUrl `
+        -CreatorKey $creatorKey
+    if ($credentialVerification.valid -ne $true) {
+        $recovered = Invoke-AnswerMeAutomaticEnrollment `
+            -ResolvedApiBaseUrl $parsedBaseUrl `
+            -ResolvedCredentialPath $CredentialPath
+        $creatorKey = [string]$recovered.creatorKey
+        $credentialSource = [string]$recovered.credentialSource
+        $recovered = $null
+    }
+}
+
+$resolvedIdempotencyKey = if ($null -ne $resolvedIdempotencyKey) {
+    $resolvedIdempotencyKey
+}
+else {
+    Get-AnswerMeIdempotencyKey -Generate
+}
+$uri = ([Uri]::new($parsedBaseUrl, '/api/v1/interactions')).AbsoluteUri
+
+try {
+    $createRequestStopwatch = [Diagnostics.Stopwatch]::StartNew()
+    try {
+        $headers = @{
+            Authorization = "Bearer $creatorKey"
+            'Idempotency-Key' = $resolvedIdempotencyKey
+            'X-AnswerMe-Protocol-Version' = $AnswerMeProtocolVersion
+            'X-AnswerMe-Skill-Version' = $AnswerMeSkillVersion
+        }
+        $requestBytes = [Text.Encoding]::UTF8.GetBytes($requestJson)
+        $response = Invoke-AnswerMeWebRequest -Uri $uri -Method Post -Headers $headers -ContentType 'application/json; charset=utf-8' -Body $requestBytes
+        $errorBody = $null
+        if ([int]$response.StatusCode -ne 201) {
+            $errorBody = ConvertFrom-AnswerMeResponseBody -Response $response
+        }
+        if (Test-AnswerMeWriterAdmissionResponse -Response $response -Body $errorBody) {
+            $retryAfter = Get-AnswerMeRetryAfterSeconds -Response $response
+            if ($retryAfter -gt 0) {
+                Start-Sleep -Seconds $retryAfter
+            }
+            $script:AnswerMeOriginalRequestRetried = $true
+            $response = Invoke-AnswerMeWebRequest -Uri $uri -Method Post -Headers $headers -ContentType 'application/json; charset=utf-8' -Body $requestBytes
+            $errorBody = $null
+            if ([int]$response.StatusCode -ne 201) {
+                $errorBody = ConvertFrom-AnswerMeResponseBody -Response $response
+            }
+        }
+        if ([int]$response.StatusCode -eq 401 -and
+            (Test-AnswerMeCreateErrorResponse -StatusCode 401 -Body $errorBody) -and
+            [string]$errorBody.code -ceq 'invalid_creator_credential' -and
+            (Test-AnswerMeRecoverableCredentialReason -Reason ([string]$errorBody.reason)) -and
+            -not $AnswerMeAutomaticEnrollmentAttempted -and
+            -not $AnswerMeOriginalRequestRetried) {
+            $recovered = Invoke-AnswerMeAutomaticEnrollment `
+                -ResolvedApiBaseUrl $parsedBaseUrl `
+                -ResolvedCredentialPath $CredentialPath
+            $creatorKey = [string]$recovered.creatorKey
+            $credentialSource = [string]$recovered.credentialSource
+            $recovered = $null
+            $script:AnswerMeOriginalRequestRetried = $true
+            $headers.Authorization = "Bearer $creatorKey"
+            $response = Invoke-AnswerMeWebRequest `
+                -Uri $uri `
+                -Method Post `
+                -Headers $headers `
+                -ContentType 'application/json; charset=utf-8' `
+                -Body $requestBytes
+            $errorBody = $null
+            if ([int]$response.StatusCode -ne 201) {
+                $errorBody = ConvertFrom-AnswerMeResponseBody -Response $response
+            }
+        }
+    }
+    finally {
+        $AnswerMeTimings.createRequestMilliseconds = [long]$createRequestStopwatch.ElapsedMilliseconds
+    }
+
+    $responseValidationStopwatch = [Diagnostics.Stopwatch]::StartNew()
+    if ([int]$response.StatusCode -ne 201) {
+        if ([int]$response.StatusCode -eq 409 -and
+            (Test-AnswerMeProtocolUnsupportedErrorResponse -Body $errorBody)) {
+            [PSCustomObject]@{
+                ok = $false
+                status = 'failed'
+                stage = 'create'
+                code = 'client_protocol_unsupported'
+                message = 'The installed AnswerMe client protocol is not supported by the service.'
+                httpStatus = 409
+                reason = [string]$errorBody.reason
+                receivedProtocolVersion = [string]$errorBody.receivedProtocolVersion
+                supportedProtocolVersions = @($errorBody.supportedProtocolVersions)
+                minimumCompatibleSkillVersion = [string]$errorBody.minimumCompatibleSkillVersion
+                recoveryReference = 'references/errors.md'
+                idempotencyKey = $resolvedIdempotencyKey
+                networkCalled = $true
+                automaticEnrollmentAttempted = $AnswerMeAutomaticEnrollmentAttempted
+                originalRequestRetried = $AnswerMeOriginalRequestRetried
+            } | ConvertTo-Json -Depth 8
+            exit 6
+        }
+        if ([int]$response.StatusCode -eq 429 -and
+            (Test-AnswerMeCreateErrorResponse -StatusCode 429 -Body $errorBody) -and
+            $errorBody.reason -ceq 'creator_rolling_create_limit') {
+            $retryAfter = Get-AnswerMeRetryAfterSeconds -Response $response
+            Write-AnswerMeFailure `
+                -Code 'rate_limited' `
+                -Message 'Create rate limit reached; combine related questions and retry later.' `
+                -ExitCode 4 `
+                -NetworkCalled $true `
+                -Reason 'creator_rolling_create_limit' `
+                -RetryAfterSeconds $retryAfter `
+                -IdempotencyKey $resolvedIdempotencyKey
+        }
+        if (Test-AnswerMeWriterAdmissionResponse -Response $response -Body $errorBody) {
+            $retryAfter = Get-AnswerMeRetryAfterSeconds -Response $response
+            Write-AnswerMeFailure `
+                -Code 'writer-admission-unavailable' `
+                -Message 'AnswerMe writer admission did not accept this creation request.' `
+                -ExitCode 4 `
+                -NetworkCalled $true `
+                -Reason ([string]$errorBody.reason) `
+                -RetryAfterSeconds $retryAfter `
+                -RecoveryAction 'retry-create-with-same-idempotency-key' `
+                -RecoveryReference 'references/errors.md' `
+                -IdempotencyKey $resolvedIdempotencyKey
+        }
+        $trustedErrorBody = Test-AnswerMeCreateErrorResponse `
+            -StatusCode ([int]$response.StatusCode) `
+            -Body $errorBody
+        Write-AnswerMeFailure `
+            -Code $(if ($trustedErrorBody) { [string]$errorBody.code } else { 'create-http-status' }) `
+            -Message "AnswerMe create returned HTTP $($response.StatusCode)." `
+            -ExitCode 4 `
+            -NetworkCalled $true `
+            -Reason $(if ($trustedErrorBody -and $null -ne $errorBody.PSObject.Properties['reason']) { [string]$errorBody.reason } else { $null }) `
+            -RetryAfterSeconds (Get-AnswerMeRetryAfterSeconds -Response $response) `
+            -IdempotencyKey $resolvedIdempotencyKey
+    }
+    $body = ConvertFrom-AnswerMeResponseBody -Response $response
+    if (-not (Test-AnswerMeCreateResponse -Response $response -Body $body)) {
+        Write-AnswerMeFailure `
+            -Code 'create-response-invalid' `
+            -Message 'Create response did not match the required no-store handoff contract.' `
+            -ExitCode 4 `
+            -NetworkCalled $true `
+            -IdempotencyKey $resolvedIdempotencyKey
+    }
+    $waitDecisionMatches = $null -eq $body.PSObject.Properties['waitDecision']
+    if ($null -ne $body.waitDecision) {
+        $actualWaitDecisionFields = @($body.waitDecision.PSObject.Properties.Name | Sort-Object)
+        $expectedWaitDecisionFields = @('effectiveTimeoutSeconds', 'requestedTimeoutSeconds')
+        if ($null -ne $localWaitDecision.reason) {
+            $expectedWaitDecisionFields += 'reason'
+        }
+        $expectedWaitDecisionFields = @($expectedWaitDecisionFields | Sort-Object)
+        $shapeMatches = $actualWaitDecisionFields.Count -eq $expectedWaitDecisionFields.Count -and
+            -not (Compare-Object -ReferenceObject $expectedWaitDecisionFields -DifferenceObject $actualWaitDecisionFields)
+        $requestedMatches = $null -ne $body.waitDecision.PSObject.Properties['requestedTimeoutSeconds'] -and
+            (ConvertTo-AnswerMeCanonicalJsonScalar $body.waitDecision.requestedTimeoutSeconds) -ceq
+            (ConvertTo-AnswerMeCanonicalJsonScalar $localWaitDecision.requestedTimeoutSeconds)
+        $effectiveMatches = $null -ne $body.waitDecision.PSObject.Properties['effectiveTimeoutSeconds'] -and
+            (ConvertTo-AnswerMeCanonicalJsonScalar $body.waitDecision.effectiveTimeoutSeconds) -ceq
+            (ConvertTo-AnswerMeCanonicalJsonScalar $localWaitDecision.effectiveTimeoutSeconds)
+        $reasonMatches = if ($null -eq $localWaitDecision.reason) {
+            $null -eq $body.waitDecision.PSObject.Properties['reason']
+        }
+        else {
+            $null -ne $body.waitDecision.PSObject.Properties['reason'] -and
+                (ConvertTo-AnswerMeCanonicalJsonScalar $body.waitDecision.reason) -ceq
+                (ConvertTo-AnswerMeCanonicalJsonScalar $localWaitDecision.reason)
+        }
+        $waitDecisionMatches = $shapeMatches -and $requestedMatches -and $effectiveMatches -and $reasonMatches
+    }
+    if (-not $waitDecisionMatches) {
+        Write-AnswerMeFailure `
+            -Code 'create-wait-decision-invalid' `
+            -Message 'Create response omitted or changed the requested wait decision.' `
+            -ExitCode 4 `
+            -NetworkCalled $true `
+            -IdempotencyKey $resolvedIdempotencyKey
+    }
+    $AnswerMeTimings.responseValidationMilliseconds = [long]$responseValidationStopwatch.ElapsedMilliseconds
+
+    $tokenPersistenceStopwatch = [Diagnostics.Stopwatch]::StartNew()
+    try {
+        $resultToken = [string]$body.resultToken
+        $persistedToken = Save-AnswerMeResultToken `
+            -InteractionId ([string]$body.interactionId) `
+            -ResultToken $resultToken `
+            -StoreRoot $ResultTokenStoreRoot `
+            -AllowNonDefaultStoreRoot:$AllowNonDefaultResultTokenStore
+        if (-not $persistedToken.persisted) {
+            throw 'Result Token Store did not confirm persistence.'
+        }
+    }
+    catch {
+        Write-AnswerMeFailure `
+            -Code 'result-token-persistence-failed' `
+            -Message 'The Result Token could not be verified in protected storage.' `
+            -ExitCode 5 `
+            -NetworkCalled $true `
+            -IdempotencyKey $resolvedIdempotencyKey
+    }
+    finally {
+        $resultToken = $null
+        $body.resultToken = $null
+    }
+    $AnswerMeTimings.tokenPersistenceMilliseconds = [long]$tokenPersistenceStopwatch.ElapsedMilliseconds
+
+    $popupStopwatch = [Diagnostics.Stopwatch]::StartNew()
+    $delivery = [PSCustomObject]@{
+        ok = $false
+        status = 'link-only'
+        code = 'popup-skipped'
+        browserFamily = $null
+        targetTitle = $null
+        computerControlPerformed = $false
+        elapsedMilliseconds = 0
+    }
+    if (-not $SkipPopup) {
+        if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
+            $delivery = [PSCustomObject]@{
+                ok = $false
+                status = 'link-only'
+                code = 'desktop-adapter-unavailable'
+                browserFamily = $null
+                targetTitle = $null
+                computerControlPerformed = $false
+                elapsedMilliseconds = 0
+            }
+        }
+        else {
+            $popupAdapter = Join-Path $PSScriptRoot 'open-answerme-page.windows.ps1'
+            if (-not (Test-Path -LiteralPath $popupAdapter -PathType Leaf)) {
+                $delivery = [PSCustomObject]@{
+                    ok = $false
+                    status = 'failed'
+                    code = 'popup-adapter-missing'
+                    browserFamily = $null
+                    targetTitle = $null
+                    computerControlPerformed = $false
+                    elapsedMilliseconds = 0
+                }
+            }
+            else {
+                try {
+                    $popupRaw = & $popupAdapter -Url ([string]$body.answerUrl)
+                    $popup = ($popupRaw | Out-String) | ConvertFrom-Json
+                    $delivery = [PSCustomObject]@{
+                        ok = $popup.ok -eq $true
+                        status = [string]$popup.status
+                        code = [string]$popup.code
+                        browserFamily = [string]$popup.browserFamily
+                        targetTitle = [string]$popup.targetTitle
+                        computerControlPerformed = $popup.computerControlPerformed -eq $true
+                        elapsedMilliseconds = [long]$popup.elapsedMilliseconds
+                    }
+                }
+                catch {
+                    $delivery = [PSCustomObject]@{
+                        ok = $false
+                        status = 'failed'
+                        code = 'popup-adapter-invalid-result'
+                        browserFamily = $null
+                        targetTitle = $null
+                        computerControlPerformed = $false
+                        elapsedMilliseconds = 0
+                    }
+                }
+            }
+        }
+    }
+    $AnswerMeTimings.popupMilliseconds = [long]$popupStopwatch.ElapsedMilliseconds
+
+    [PSCustomObject]@{
+        ok = $true
+        status = [string]$body.status
+        inputMode = $inputMode
+        interactionId = $body.interactionId
+        answerUrl = $body.answerUrl
+        resultTokenPersisted = $true
+        resultTokenProvider = $persistedToken.provider
+        expiresAt = $body.expiresAt
+        requestId = $body.requestId
+        questionCount = @($template.questions).Count
+        waitDecision = $body.waitDecision
+        delivery = $delivery
+        timings = Get-AnswerMeTimings
+        networkCalled = $true
+        automaticEnrollmentAttempted = $AnswerMeAutomaticEnrollmentAttempted
+        originalRequestRetried = $AnswerMeOriginalRequestRetried
+    } | ConvertTo-Json -Depth 8
+    exit 0
+}
+catch {
+    Write-AnswerMeFailure `
+        -Code 'create-request-failed' `
+        -Message 'AnswerMe creation failed before a verified response could be returned.' `
+        -ExitCode 4 `
+        -NetworkCalled $true `
+        -IdempotencyKey $resolvedIdempotencyKey
+}