@rover-studio/answer-me 0.1.0-rc.1

package/distribution/npm/skills/answerme/scripts/enroll-answerme-creator.ps1

@@ -0,0 +1,764 @@
+[CmdletBinding()]
+param(
+    [string]$ApiBaseUrl,
+    [switch]$AllowInsecureLoopbackHttpForTest,
+    [string]$CredentialPath = $env:ANSWERME_CREATOR_CREDENTIAL_PATH,
+    [object]$WaitTimeoutSeconds = 300,
+    [ValidateRange(1, 30)]
+    [int]$PollSeconds = 2,
+    [switch]$SkipPopup,
+    [switch]$ValidateOnly
+)
+
+$ErrorActionPreference = 'Stop'
+$httpSupport = Join-Path $PSScriptRoot 'windows-http.ps1'
+if (-not (Test-Path -LiteralPath $httpSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows HTTP helper is missing.'
+}
+. $httpSupport
+$AnswerMeProtocolVersion = '1.1'
+$AnswerMeSkillVersion = '0.3.0'
+$AnswerMeNetworkCalled = $false
+$AnswerMeVerificationDelivery = $null
+
+function Write-AnswerMeEnrollmentFailure {
+    param(
+        [Parameter(Mandatory = $true)][string]$Stage,
+        [Parameter(Mandatory = $true)][string]$Code,
+        [Parameter(Mandatory = $true)][string]$Message,
+        [Parameter(Mandatory = $true)][int]$ExitCode,
+        [AllowNull()][object]$Reason,
+        [int]$RetryAfterSeconds = 0,
+        [AllowNull()][string]$CredentialStoreStage,
+        [bool]$TargetChanged = $false,
+        [bool]$BackupCreated = $false,
+        [AllowNull()][string]$RollbackStatus
+    )
+
+    [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        stage = $Stage
+        code = $Code
+        message = $Message
+        reason = $Reason
+        retryAfterSeconds = $RetryAfterSeconds
+        verificationDelivery = $AnswerMeVerificationDelivery
+        credentialState = $null
+        credentialStoreStage = $CredentialStoreStage
+        targetChanged = $TargetChanged
+        backupCreated = $BackupCreated
+        rollbackStatus = $RollbackStatus
+        networkCalled = $AnswerMeNetworkCalled
+    } | ConvertTo-Json -Depth 8
+    exit $ExitCode
+}
+
+function Get-AnswerMeDefaultCreatorCredentialPath {
+    if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
+        return $null
+    }
+    $localAppData = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
+    if ([string]::IsNullOrWhiteSpace($localAppData)) {
+        return $null
+    }
+    return Join-Path $localAppData 'AnswerMe\creator-credential.clixml'
+}
+
+function ConvertFrom-AnswerMeEnrollmentResponse {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    if ([string]::IsNullOrWhiteSpace([string]$Response.Content)) {
+        return $null
+    }
+    try {
+        return $Response.Content | ConvertFrom-Json
+    }
+    catch {
+        return $null
+    }
+}
+
+function Test-AnswerMeEnrollmentNoStore {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    return ([string]$Response.Headers['Cache-Control']).Trim() -ceq 'no-store'
+}
+
+function Test-AnswerMeEnrollmentResponseFields {
+    param(
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string[]]$ExpectedFields
+    )
+
+    if ($null -eq $Body) { return $false }
+    $actual = @($Body.PSObject.Properties.Name | Sort-Object)
+    $expected = @($ExpectedFields | Sort-Object)
+    return $actual.Count -eq $expected.Count -and
+        -not (Compare-Object -ReferenceObject $expected -DifferenceObject $actual)
+}
+
+function Test-AnswerMeEnrollmentJsonString {
+    param(
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string]$PropertyName,
+        [int]$MaximumLength = 0
+    )
+
+    if ($null -eq $Body) { return $false }
+    $property = $Body.PSObject.Properties[$PropertyName]
+    if ($null -eq $property -or $property.Value -isnot [string]) { return $false }
+    $value = [string]$property.Value
+    return -not [string]::IsNullOrWhiteSpace($value) -and
+        ($MaximumLength -le 0 -or $value.Length -le $MaximumLength)
+}
+
+function Test-AnswerMeEnrollmentJsonInt64 {
+    param(
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string]$PropertyName
+    )
+
+    if ($null -eq $Body) { return $false }
+    $property = $Body.PSObject.Properties[$PropertyName]
+    if ($null -eq $property) { return $false }
+    $value = $property.Value
+    return ($value -is [int] -or $value -is [long]) -and [long]$value -ge 0
+}
+
+function Test-AnswerMeEnrollmentCapabilitiesResponse {
+    param([AllowNull()][object]$Body)
+
+    if ($Body -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeEnrollmentResponseFields `
+            -Body $Body `
+            -ExpectedFields @('protocolVersion', 'schemaVersions', 'clientProtocol', 'capabilities', 'requestId')) -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $Body -PropertyName 'protocolVersion') -or
+        [string]$Body.protocolVersion -cne $AnswerMeProtocolVersion -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $Body -PropertyName 'requestId')) {
+        return $false
+    }
+
+    if ($Body.schemaVersions -isnot [Array] -or
+        @($Body.schemaVersions).Count -ne 1 -or
+        ($Body.schemaVersions[0] -isnot [int] -and $Body.schemaVersions[0] -isnot [long]) -or
+        [long]$Body.schemaVersions[0] -ne 1) {
+        return $false
+    }
+
+    $clientProtocol = $Body.clientProtocol
+    if ($clientProtocol -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeEnrollmentResponseFields `
+            -Body $clientProtocol `
+            -ExpectedFields @('supportedVersions', 'recommendedVersion', 'minimumCompatibleSkillVersion')) -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $clientProtocol -PropertyName 'recommendedVersion') -or
+        [string]$clientProtocol.recommendedVersion -cne $AnswerMeProtocolVersion -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $clientProtocol -PropertyName 'minimumCompatibleSkillVersion') -or
+        [string]$clientProtocol.minimumCompatibleSkillVersion -cne '0.1.0' -or
+        $clientProtocol.supportedVersions -isnot [Array]) {
+        return $false
+    }
+    $supportedVersions = @($clientProtocol.supportedVersions)
+    if ($supportedVersions.Count -ne 2 -or
+        $supportedVersions[0] -isnot [string] -or
+        $supportedVersions[1] -isnot [string] -or
+        $supportedVersions -cnotcontains '1.0' -or
+        $supportedVersions -cnotcontains $AnswerMeProtocolVersion) {
+        return $false
+    }
+
+    $capabilities = $Body.capabilities
+    if ($capabilities -isnot [PSCustomObject] -or
+        -not (Test-AnswerMeEnrollmentResponseFields `
+            -Body $capabilities `
+            -ExpectedFields @('createInteraction', 'resultQuery', 'resultWait')) -or
+        $capabilities.createInteraction -isnot [bool] -or
+        $capabilities.createInteraction -ne $true -or
+        $capabilities.resultQuery -isnot [bool]) {
+        return $false
+    }
+
+    $resultWait = $capabilities.resultWait
+    return $resultWait -is [PSCustomObject] -and
+        (Test-AnswerMeEnrollmentResponseFields `
+            -Body $resultWait `
+            -ExpectedFields @('enabled', 'defaultWaitSeconds', 'maxWaitSeconds')) -and
+        $resultWait.enabled -is [bool] -and
+        ($resultWait.defaultWaitSeconds -is [int] -or $resultWait.defaultWaitSeconds -is [long]) -and
+        [long]$resultWait.defaultWaitSeconds -eq 55 -and
+        ($resultWait.maxWaitSeconds -is [int] -or $resultWait.maxWaitSeconds -is [long]) -and
+        [long]$resultWait.maxWaitSeconds -eq 600
+}
+
+function Get-AnswerMeEnrollmentRetryAfterSeconds {
+    param([Parameter(Mandatory = $true)][object]$Response)
+
+    $parsed = 0
+    if ([int]::TryParse([string]$Response.Headers['Retry-After'], [ref]$parsed) -and $parsed -ge 0) {
+        return $parsed
+    }
+    return 0
+}
+
+function Get-AnswerMeEnrollmentAllowedRemoteFailure {
+    param(
+        [Parameter(Mandatory = $true)][ValidateSet('create', 'status', 'claim')][string]$Endpoint,
+        [Parameter(Mandatory = $true)][object]$Response,
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string]$FallbackCode
+    )
+
+    $generic = [PSCustomObject]@{ code = $FallbackCode; reason = $null; retryAfterSeconds = 0 }
+    if ($Body -isnot [PSCustomObject]) { return $generic }
+    $actualFields = @($Body.PSObject.Properties.Name)
+    if ($actualFields | Where-Object { $_ -cnotin @('code', 'requestId', 'path', 'reason') }) {
+        return $generic
+    }
+    if (-not (Test-AnswerMeEnrollmentJsonString -Body $Body -PropertyName 'code') -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $Body -PropertyName 'requestId')) {
+        return $generic
+    }
+    if ($null -ne $Body.PSObject.Properties['path'] -and $Body.path -isnot [string]) { return $generic }
+    if ($null -ne $Body.PSObject.Properties['reason'] -and $Body.reason -isnot [string]) { return $generic }
+
+    $status = [int]$Response.StatusCode
+    $code = [string]$Body.code
+    $reason = if ($null -ne $Body.PSObject.Properties['reason']) { [string]$Body.reason } else { $null }
+    $allowed = $false
+    switch ("$Endpoint`:$status") {
+        'create:503' {
+            $allowed = $code -ceq 'enrollment_unavailable' -and
+                $reason -cin @('automatic_issuance_disabled', 'issuance_unavailable')
+        }
+        'status:404' {
+            $allowed = $code -ceq 'enrollment_not_found' -and
+                ($null -eq $reason -or $reason -ceq 'enrollment_not_found')
+        }
+        'status:503' {
+            $allowed = $code -ceq 'enrollment_unavailable' -and $reason -ceq 'claim_unavailable'
+        }
+        'claim:401' {
+            $allowed = $code -ceq 'claim_invalid' -and $reason -ceq 'claim_invalid'
+        }
+        'claim:404' {
+            $allowed = $code -ceq 'enrollment_not_found' -and $reason -ceq 'enrollment_not_found'
+        }
+        'claim:409' {
+            $allowed = $code -ceq 'enrollment_conflict' -and
+                $reason -cin @(
+                    'enrollment_pending',
+                    'enrollment_failed',
+                    'enrollment_already_claimed',
+                    'enrollment_replay',
+                    'verification_token_replay'
+                )
+        }
+        'claim:410' {
+            $allowed = $code -ceq 'enrollment_expired' -and
+                $reason -cin @('enrollment_expired', 'verification_token_expired')
+        }
+        'claim:429' {
+            $allowed = $code -ceq 'claim_rate_limited' -and $reason -ceq 'claim_rate_limited'
+        }
+        'claim:503' {
+            $allowed = $code -ceq 'enrollment_unavailable' -and $reason -ceq 'claim_unavailable'
+        }
+    }
+    if (-not $allowed) { return $generic }
+    return [PSCustomObject]@{
+        code = $code
+        reason = $reason
+        retryAfterSeconds = Get-AnswerMeEnrollmentRetryAfterSeconds -Response $Response
+    }
+}
+
+function Write-AnswerMeEnrollmentRemoteFailure {
+    param(
+        [Parameter(Mandatory = $true)][string]$Stage,
+        [Parameter(Mandatory = $true)][ValidateSet('create', 'status', 'claim')][string]$Endpoint,
+        [Parameter(Mandatory = $true)][object]$Response,
+        [AllowNull()][object]$Body,
+        [Parameter(Mandatory = $true)][string]$FallbackCode,
+        [int]$ExitCode = 4
+    )
+
+    $failure = Get-AnswerMeEnrollmentAllowedRemoteFailure `
+        -Endpoint $Endpoint `
+        -Response $Response `
+        -Body $Body `
+        -FallbackCode $FallbackCode
+    Write-AnswerMeEnrollmentFailure `
+        -Stage $Stage `
+        -Code $failure.code `
+        -Message "AnswerMe enrollment failed during $Stage." `
+        -ExitCode $ExitCode `
+        -Reason $failure.reason `
+        -RetryAfterSeconds $failure.retryAfterSeconds
+}
+
+function Write-AnswerMeEnrollmentVerificationUrlEvent {
+    param([Parameter(Mandatory = $true)][Uri]$VerificationUrl)
+
+    $event = [PSCustomObject][ordered]@{
+        event = 'answerme.creator-enrollment.verification-url'
+        stage = 'verification-handoff'
+        verificationUrl = $VerificationUrl.AbsoluteUri
+    }
+    [Console]::Error.WriteLine(($event | ConvertTo-Json -Compress))
+    [Console]::Error.Flush()
+    $acknowledgementToken = [Environment]::GetEnvironmentVariable(
+        'ANSWERME_INTERNAL_VERIFICATION_EVENT_ACK',
+        'Process'
+    )
+    if (-not [string]::IsNullOrWhiteSpace($acknowledgementToken)) {
+        $acknowledgement = [Console]::In.ReadLine()
+        if ($acknowledgement -cne $acknowledgementToken) {
+            Write-AnswerMeEnrollmentFailure `
+                -Stage 'verification-handoff' `
+                -Code 'verification-event-acknowledgement-invalid' `
+                -Message 'The verification URL event was not acknowledged by the parent process.' `
+                -ExitCode 4
+        }
+    }
+}
+
+function Test-AnswerMeEnrollmentSameOrigin {
+    param(
+        [Parameter(Mandatory = $true)][Uri]$Left,
+        [Parameter(Mandatory = $true)][Uri]$Right
+    )
+
+    return $Left.Scheme.Equals($Right.Scheme, [StringComparison]::OrdinalIgnoreCase) -and
+        $Left.DnsSafeHost.Equals($Right.DnsSafeHost, [StringComparison]::OrdinalIgnoreCase) -and
+        $Left.Port -eq $Right.Port
+}
+
+function Invoke-AnswerMeEnrollmentCredentialInstall {
+    param(
+        [Parameter(Mandatory = $true)][Security.SecureString]$CreatorKey,
+        [Parameter(Mandatory = $true)][Uri]$ResolvedApiBaseUrl,
+        [Parameter(Mandatory = $true)][string]$CreatorId,
+        [Parameter(Mandatory = $true)][string]$ResolvedCredentialPath
+    )
+
+    $adapterPath = Join-Path $PSScriptRoot 'creator-credential-store.windows.ps1'
+    if (-not (Test-Path -LiteralPath $adapterPath -PathType Leaf)) {
+        throw (New-AnswerMeEnrollmentDependencyException `
+            -Code 'credential-store-adapter-missing' `
+            -Message 'The protected Creator credential store adapter is required.')
+    }
+    try {
+        . $adapterPath
+    }
+    catch {
+        throw (New-AnswerMeEnrollmentDependencyException `
+            -Code 'credential-store-adapter-unavailable' `
+            -Message 'The protected Creator credential store adapter could not be loaded.')
+    }
+    return Install-AnswerMeCreatorCredential `
+        -CreatorKey $CreatorKey `
+        -ApiBaseUrl $ResolvedApiBaseUrl.AbsoluteUri.TrimEnd('/') `
+        -CreatorId $CreatorId `
+        -TargetCredentialPath $ResolvedCredentialPath `
+        -AllowInsecureLoopbackHttpForTest:$AllowInsecureLoopbackHttpForTest
+}
+
+function New-AnswerMeEnrollmentDependencyException {
+    param(
+        [Parameter(Mandatory = $true)][string]$Code,
+        [Parameter(Mandatory = $true)][string]$Message
+    )
+
+    $exception = [InvalidOperationException]::new($Message)
+    $exception.Data['AnswerMeCode'] = $Code
+    $exception.Data['AnswerMeStage'] = 'preflight'
+    $exception.Data['AnswerMeTargetChanged'] = $false
+    $exception.Data['AnswerMeBackupCreated'] = $false
+    $exception.Data['AnswerMeRollbackStatus'] = 'not-required'
+    $exception.Data['AnswerMeNetworkCalled'] = $false
+    return $exception
+}
+
+$apiPolicyPath = Join-Path $PSScriptRoot 'answerme-api-base-url.ps1'
+if (-not (Test-Path -LiteralPath $apiPolicyPath -PathType Leaf)) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'preflight' `
+        -Code 'api-base-url-policy-missing' `
+        -Message 'The AnswerMe API base URL policy is required.' `
+        -ExitCode 3
+}
+try {
+    . $apiPolicyPath
+}
+catch {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'preflight' `
+        -Code 'api-base-url-policy-unavailable' `
+        -Message 'The AnswerMe API base URL policy could not be loaded.' `
+        -ExitCode 3
+}
+
+try {
+    $parsedBaseUrl = Resolve-AnswerMeApiBaseUrl `
+        -ApiBaseUrl $ApiBaseUrl `
+        -AllowInsecureLoopbackHttpForTest:$AllowInsecureLoopbackHttpForTest
+    if ($null -eq $parsedBaseUrl) {
+        throw 'A trusted AnswerMe API base URL is required.'
+    }
+}
+catch {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'preflight' `
+        -Code 'api-base-url-invalid' `
+        -Message $_.Exception.Message `
+        -ExitCode 2
+}
+
+$waitText = [string]$WaitTimeoutSeconds
+$waitValue = 0
+$waitValid = [int]::TryParse(
+    $waitText,
+    [Globalization.NumberStyles]::Integer,
+    [Globalization.CultureInfo]::InvariantCulture,
+    [ref]$waitValue
+) -and $waitValue -ge 30 -and $waitValue -le 600
+if (-not $waitValid) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'preflight' `
+        -Code 'enrollment-wait-timeout-invalid' `
+        -Message 'WaitTimeoutSeconds must be an integer from 30 through 600.' `
+        -ExitCode 2
+}
+
+if ([string]::IsNullOrWhiteSpace($CredentialPath)) {
+    $CredentialPath = Get-AnswerMeDefaultCreatorCredentialPath
+}
+if ([string]::IsNullOrWhiteSpace($CredentialPath)) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'preflight' `
+        -Code 'credential-path-unavailable' `
+        -Message 'A protected Creator credential target is required.' `
+        -ExitCode 3
+}
+$resolvedCredentialPath = [IO.Path]::GetFullPath($CredentialPath)
+
+if ($ValidateOnly) {
+    [PSCustomObject]@{
+        ok = $true
+        status = 'validated'
+        stage = 'preflight'
+        apiBaseUrl = $parsedBaseUrl.AbsoluteUri.TrimEnd('/')
+        waitTimeoutSeconds = $waitValue
+        pollSeconds = $PollSeconds
+        sameOriginVerificationRequired = $true
+        privateClaimRequired = $true
+        protectedCredentialInstallRequired = $true
+        networkCalled = $false
+    } | ConvertTo-Json -Depth 5
+    exit 0
+}
+
+$commonHeaders = @{
+    Accept = 'application/json'
+    'X-AnswerMe-Protocol-Version' = $AnswerMeProtocolVersion
+    'X-AnswerMe-Skill-Version' = $AnswerMeSkillVersion
+}
+$capabilitiesUri = ([Uri]::new($parsedBaseUrl, '/api/v1/capabilities')).AbsoluteUri
+$AnswerMeNetworkCalled = $true
+try {
+    $capabilitiesResponse = Invoke-AnswerMeWebRequest `
+        -Uri $capabilitiesUri `
+        -Method Get `
+        -Headers $commonHeaders `
+        -TimeoutSec 15
+}
+catch {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'capabilities' `
+        -Code 'capabilities-unavailable' `
+        -Message 'AnswerMe capabilities could not be read.' `
+        -ExitCode 4
+}
+$capabilitiesBody = ConvertFrom-AnswerMeEnrollmentResponse -Response $capabilitiesResponse
+if ([int]$capabilitiesResponse.StatusCode -ne 200 -or
+    -not (Test-AnswerMeEnrollmentCapabilitiesResponse -Body $capabilitiesBody)) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'capabilities' `
+        -Code 'capabilities-invalid' `
+        -Message 'AnswerMe capabilities did not match the complete enrollment protocol contract.' `
+        -ExitCode 4
+}
+
+$createUri = ([Uri]::new($parsedBaseUrl, '/api/v1/creator-enrollments')).AbsoluteUri
+try {
+    $createResponse = Invoke-AnswerMeWebRequest `
+        -Uri $createUri `
+        -Method Post `
+        -Headers $commonHeaders `
+        -TimeoutSec 15
+}
+catch {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'create-enrollment' `
+        -Code 'enrollment-connection-unknown' `
+        -Message 'Creator enrollment creation has an unknown outcome.' `
+        -ExitCode 4
+}
+$createBody = ConvertFrom-AnswerMeEnrollmentResponse -Response $createResponse
+if ([int]$createResponse.StatusCode -ne 201) {
+    Write-AnswerMeEnrollmentRemoteFailure `
+        -Stage 'create-enrollment' `
+        -Endpoint 'create' `
+        -Response $createResponse `
+        -Body $createBody `
+        -FallbackCode 'enrollment-create-http-status'
+}
+if (-not (Test-AnswerMeEnrollmentNoStore -Response $createResponse) -or
+    -not (Test-AnswerMeEnrollmentResponseFields `
+        -Body $createBody `
+        -ExpectedFields @('enrollmentId', 'verificationUrl', 'claimCredential', 'verificationExpiresAt', 'requestId')) -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $createBody -PropertyName 'enrollmentId' -MaximumLength 128) -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $createBody -PropertyName 'verificationUrl') -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $createBody -PropertyName 'claimCredential' -MaximumLength 128) -or
+    -not (Test-AnswerMeEnrollmentJsonInt64 -Body $createBody -PropertyName 'verificationExpiresAt') -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $createBody -PropertyName 'requestId')) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'create-enrollment' `
+        -Code 'enrollment-create-response-invalid' `
+        -Message 'Creator enrollment creation omitted a required no-store handoff field.' `
+        -ExitCode 4
+}
+
+$enrollmentId = [string]$createBody.enrollmentId
+$claimCredential = [string]$createBody.claimCredential
+$verificationUrl = $null
+if (-not [Uri]::TryCreate([string]$createBody.verificationUrl, [UriKind]::Absolute, [ref]$verificationUrl) -or
+    -not (Test-AnswerMeEnrollmentSameOrigin -Left $parsedBaseUrl -Right $verificationUrl) -or
+    -not [string]::IsNullOrEmpty($verificationUrl.UserInfo) -or
+    -not [string]::IsNullOrEmpty($verificationUrl.Fragment) -or
+    $verificationUrl.AbsoluteUri.IndexOf($claimCredential, [StringComparison]::Ordinal) -ge 0 -or
+    $verificationUrl.AbsoluteUri.IndexOf([Uri]::EscapeDataString($claimCredential), [StringComparison]::Ordinal) -ge 0) {
+    $claimCredential = $null
+    $createBody.claimCredential = $null
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'verification-handoff' `
+        -Code 'verification-url-invalid' `
+        -Message 'The enrollment verification URL did not satisfy the trusted same-origin contract.' `
+        -ExitCode 4
+}
+$createBody.claimCredential = $null
+
+$AnswerMeVerificationDelivery = [PSCustomObject]@{
+    status = 'link-only'
+    code = 'popup-skipped'
+    foregroundVerified = $false
+    computerControlPerformed = $false
+    manualUrl = $verificationUrl.AbsoluteUri
+}
+if (-not $SkipPopup) {
+    $popupScript = Join-Path $PSScriptRoot 'open-answerme-page.windows.ps1'
+    if (-not (Test-Path -LiteralPath $popupScript -PathType Leaf)) {
+        Write-AnswerMeEnrollmentFailure `
+            -Stage 'verification-handoff' `
+            -Code 'popup-adapter-missing' `
+            -Message 'The enrollment verification page could not be opened.' `
+            -ExitCode 3
+    }
+    try {
+        $popupRaw = & $popupScript -Url $verificationUrl.AbsoluteUri
+        $popup = ($popupRaw | Out-String) | ConvertFrom-Json
+        $AnswerMeVerificationDelivery = [PSCustomObject]@{
+            status = [string]$popup.status
+            code = [string]$popup.code
+            foregroundVerified = $popup.ok -eq $true -and [string]$popup.status -ceq 'foreground-verified'
+            computerControlPerformed = $popup.computerControlPerformed -eq $true
+            manualUrl = $verificationUrl.AbsoluteUri
+        }
+    }
+    catch {
+        Write-AnswerMeEnrollmentFailure `
+            -Stage 'verification-handoff' `
+            -Code 'popup-adapter-invalid-result' `
+            -Message 'The enrollment verification page delivery result was invalid.' `
+            -ExitCode 4
+    }
+}
+if ($AnswerMeVerificationDelivery.foregroundVerified -ne $true) {
+    Write-AnswerMeEnrollmentVerificationUrlEvent -VerificationUrl $verificationUrl
+}
+
+$escapedEnrollmentId = [Uri]::EscapeDataString($enrollmentId)
+$statusUri = ([Uri]::new($parsedBaseUrl, "/api/v1/creator-enrollments/$escapedEnrollmentId")).AbsoluteUri
+$deadline = [DateTimeOffset]::UtcNow.AddSeconds($waitValue)
+$verified = $false
+while ([DateTimeOffset]::UtcNow -lt $deadline) {
+    try {
+        $statusResponse = Invoke-AnswerMeWebRequest `
+            -Uri $statusUri `
+            -Method Get `
+            -Headers $commonHeaders `
+            -TimeoutSec 15
+    }
+    catch {
+        $claimCredential = $null
+        Write-AnswerMeEnrollmentFailure `
+            -Stage 'wait-verification' `
+            -Code 'enrollment-status-connection-unknown' `
+            -Message 'Creator enrollment status has an unknown outcome.' `
+            -ExitCode 4
+    }
+    $statusBody = ConvertFrom-AnswerMeEnrollmentResponse -Response $statusResponse
+    if ([int]$statusResponse.StatusCode -ne 200) {
+        $claimCredential = $null
+        Write-AnswerMeEnrollmentRemoteFailure `
+            -Stage 'wait-verification' `
+            -Endpoint 'status' `
+            -Response $statusResponse `
+            -Body $statusBody `
+            -FallbackCode 'enrollment-status-http-status'
+    }
+    if (-not (Test-AnswerMeEnrollmentNoStore -Response $statusResponse) -or
+        -not (Test-AnswerMeEnrollmentResponseFields -Body $statusBody -ExpectedFields @('status', 'requestId')) -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $statusBody -PropertyName 'status') -or
+        -not (Test-AnswerMeEnrollmentJsonString -Body $statusBody -PropertyName 'requestId') -or
+        [string]$statusBody.status -cnotin @('pending', 'verified', 'complete', 'failed', 'expired')) {
+        $claimCredential = $null
+        Write-AnswerMeEnrollmentFailure `
+            -Stage 'wait-verification' `
+            -Code 'enrollment-status-response-invalid' `
+            -Message 'Creator enrollment status omitted its no-store state.' `
+            -ExitCode 4
+    }
+    $remoteStatus = [string]$statusBody.status
+    if ($remoteStatus -ceq 'verified') {
+        $verified = $true
+        break
+    }
+    if ($remoteStatus -ceq 'pending') {
+        $remainingMilliseconds = [Math]::Max(0, [Math]::Floor(($deadline - [DateTimeOffset]::UtcNow).TotalMilliseconds))
+        $sleepMilliseconds = [int][Math]::Min($remainingMilliseconds, $PollSeconds * 1000)
+        if ($sleepMilliseconds -gt 0) { Start-Sleep -Milliseconds $sleepMilliseconds }
+        continue
+    }
+    $claimCredential = $null
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'wait-verification' `
+        -Code $(if ($remoteStatus -ceq 'expired') { 'enrollment_expired' } else { 'enrollment_conflict' }) `
+        -Message 'Creator enrollment reached a terminal state before private claim.' `
+        -ExitCode 4 `
+        -Reason "enrollment_$remoteStatus"
+}
+if (-not $verified) {
+    $claimCredential = $null
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'wait-verification' `
+        -Code 'enrollment-pending' `
+        -Message 'Creator enrollment remained pending until the bounded deadline.' `
+        -ExitCode 5 `
+        -Reason 'enrollment_pending'
+}
+
+$claimUri = ([Uri]::new($parsedBaseUrl, "/api/v1/creator-enrollments/$escapedEnrollmentId/claim")).AbsoluteUri
+$claimHeaders = @{
+    Accept = 'application/json'
+    Authorization = "Bearer $claimCredential"
+    'X-AnswerMe-Protocol-Version' = $AnswerMeProtocolVersion
+    'X-AnswerMe-Skill-Version' = $AnswerMeSkillVersion
+}
+try {
+    $claimResponse = Invoke-AnswerMeWebRequest `
+        -Uri $claimUri `
+        -Method Post `
+        -Headers $claimHeaders `
+        -TimeoutSec 15
+}
+catch {
+    $claimCredential = $null
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'claim' `
+        -Code 'claim-outcome-unknown' `
+        -Message 'The private Creator credential claim has an unknown outcome and will not be retried.' `
+        -ExitCode 4
+}
+$claimCredential = $null
+$claimHeaders.Authorization = $null
+$claimBody = ConvertFrom-AnswerMeEnrollmentResponse -Response $claimResponse
+if ([int]$claimResponse.StatusCode -ne 200) {
+    Write-AnswerMeEnrollmentRemoteFailure `
+        -Stage 'claim' `
+        -Endpoint 'claim' `
+        -Response $claimResponse `
+        -Body $claimBody `
+        -FallbackCode 'claim-http-status'
+}
+if (-not (Test-AnswerMeEnrollmentNoStore -Response $claimResponse) -or
+    -not (Test-AnswerMeEnrollmentResponseFields `
+        -Body $claimBody `
+        -ExpectedFields @('creatorId', 'creatorApiKey', 'requestId')) -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $claimBody -PropertyName 'creatorId') -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $claimBody -PropertyName 'creatorApiKey') -or
+    -not (Test-AnswerMeEnrollmentJsonString -Body $claimBody -PropertyName 'requestId')) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'claim' `
+        -Code 'claim-response-invalid' `
+        -Message 'The private claim response omitted a required no-store credential field.' `
+        -ExitCode 4
+}
+
+$creatorApiKey = [string]$claimBody.creatorApiKey
+$secureCreatorKey = $null
+try {
+    $secureCreatorKey = ConvertTo-SecureString $creatorApiKey -AsPlainText -Force
+    $claimBody.creatorApiKey = $null
+    $creatorApiKey = $null
+    $install = Invoke-AnswerMeEnrollmentCredentialInstall `
+        -CreatorKey $secureCreatorKey `
+        -ResolvedApiBaseUrl $parsedBaseUrl `
+        -CreatorId ([string]$claimBody.creatorId) `
+        -ResolvedCredentialPath $resolvedCredentialPath
+}
+catch {
+    $installException = $_.Exception
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'credential-install' `
+        -Code $(if ($installException.Data.Contains('AnswerMeCode')) { [string]$installException.Data['AnswerMeCode'] } else { 'credential-install-failed' }) `
+        -Message 'The claimed Creator credential was not confirmed in protected storage.' `
+        -ExitCode 5 `
+        -CredentialStoreStage $(if ($installException.Data.Contains('AnswerMeStage')) { [string]$installException.Data['AnswerMeStage'] } else { $null }) `
+        -TargetChanged $(if ($installException.Data.Contains('AnswerMeTargetChanged')) { [bool]$installException.Data['AnswerMeTargetChanged'] } else { $false }) `
+        -BackupCreated $(if ($installException.Data.Contains('AnswerMeBackupCreated')) { [bool]$installException.Data['AnswerMeBackupCreated'] } else { $false }) `
+        -RollbackStatus $(if ($installException.Data.Contains('AnswerMeRollbackStatus')) { [string]$installException.Data['AnswerMeRollbackStatus'] } else { $null })
+}
+finally {
+    $claimBody.creatorApiKey = $null
+    $creatorApiKey = $null
+    $secureCreatorKey = $null
+}
+
+if ($null -eq $install -or
+    -not (Test-AnswerMeEnrollmentResponseFields `
+        -Body $install `
+        -ExpectedFields @('ok', 'status', 'creatorId', 'targetChanged', 'backupCreated', 'rollbackStatus', 'networkCalled')) -or
+    $install.ok -ne $true -or
+    [string]$install.status -cnotin @('installed', 'no-op') -or
+    [string]$install.creatorId -cne [string]$claimBody.creatorId -or
+    $install.networkCalled -ne $false) {
+    Write-AnswerMeEnrollmentFailure `
+        -Stage 'credential-install' `
+        -Code 'credential-install-result-invalid' `
+        -Message 'The protected credential store did not confirm a valid install result.' `
+        -ExitCode 5
+}
+
+[PSCustomObject]@{
+    ok = $true
+    status = 'credential-configured'
+    stage = 'complete'
+    credentialState = [string]$install.status
+    targetChanged = $install.targetChanged -eq $true
+    backupCreated = $install.backupCreated -eq $true
+    rollbackStatus = [string]$install.rollbackStatus
+    verificationDelivery = $AnswerMeVerificationDelivery
+    networkCalled = $true
+} | ConvertTo-Json -Depth 8
+exit 0