@rover-studio/answer-me 0.1.0-rc.1

package/distribution/npm/skills/answerme/scripts/open-answerme-page.windows.ps1

@@ -0,0 +1,272 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$Url,
+    [string]$WindowTitleContains = '',
+    [ValidateRange(1, 30)]
+    [int]$WaitSeconds = 10,
+    [ValidateRange(1, 10)]
+    [int]$ForegroundAttempts = 4,
+    [ValidateRange(10, 250)]
+    [int]$WindowPollMilliseconds = 25,
+    [ValidateRange(5, 100)]
+    [int]$ForegroundPollMilliseconds = 10,
+    [ValidateRange(10, 500)]
+    [int]$ForegroundAttemptMilliseconds = 100,
+    [switch]$ValidateOnly
+)
+
+$ErrorActionPreference = 'Stop'
+
+$processStartInfoSupport = Join-Path $PSScriptRoot 'windows-process-start-info.ps1'
+if (-not (Test-Path -LiteralPath $processStartInfoSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows process argument helper is missing.'
+}
+. $processStartInfoSupport
+
+$operationStopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+
+function New-PopupFailureResult {
+    param(
+        [Parameter(Mandatory = $true)][string]$Code,
+        [Parameter(Mandatory = $true)][string]$Message
+    )
+
+    return [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        code = $Code
+        message = $Message
+        inputMode = 'url-only'
+        computerControlPerformed = $false
+        elapsedMilliseconds = $operationStopwatch.ElapsedMilliseconds
+    }
+}
+
+$parsedUrl = $null
+if (-not [Uri]::TryCreate($Url, [UriKind]::Absolute, [ref]$parsedUrl) -or $parsedUrl.Scheme -notin @('http', 'https')) {
+    New-PopupFailureResult -Code 'invalid-url' -Message 'Url must be an absolute HTTP or HTTPS URL.' |
+        ConvertTo-Json -Depth 4
+    return
+}
+
+$edgeCandidates = @(
+    (Get-ItemProperty -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe' -ErrorAction SilentlyContinue).'(default)',
+    (Get-ItemProperty -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe' -ErrorAction SilentlyContinue).'(default)',
+    'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe',
+    'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
+) | Where-Object { $_ -and (Test-Path -LiteralPath $_ -PathType Leaf) } | Select-Object -Unique
+
+if ($edgeCandidates.Count -eq 0) {
+    New-PopupFailureResult -Code 'browser-not-found' -Message 'Microsoft Edge executable was not found.' |
+        ConvertTo-Json -Depth 4
+    return
+}
+$edgePath = @($edgeCandidates)[0]
+
+if ($ValidateOnly) {
+    [PSCustomObject]@{
+        ok = $true
+        status = 'validated'
+        inputMode = 'url-only'
+        browserFamily = 'edge'
+        browserPath = $edgePath
+        urlScheme = $parsedUrl.Scheme
+        foregroundStrategyVersion = 3
+        foregroundAttempts = $ForegroundAttempts
+        requiresNewWindowHandle = $true
+        computerControlPerformed = $false
+        elapsedMilliseconds = $operationStopwatch.ElapsedMilliseconds
+    } | ConvertTo-Json -Depth 4
+    return
+}
+
+try {
+    if (-not ('AnswerMePageWindowNative' -as [type])) {
+        Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using System.Text;
+
+public static class AnswerMePageWindowNative {
+    public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);
+    [DllImport("user32.dll")] public static extern bool EnumWindows(EnumWindowsProc callback, IntPtr lParam);
+    [DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
+    [DllImport("user32.dll", CharSet = CharSet.Unicode)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
+    [DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);
+    [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
+    [DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();
+    [DllImport("user32.dll")] public static extern bool AttachThreadInput(uint idAttach, uint idAttachTo, bool attach);
+    [DllImport("user32.dll")] public static extern bool ShowWindowAsync(IntPtr hWnd, int command);
+    [DllImport("user32.dll")] public static extern bool BringWindowToTop(IntPtr hWnd);
+    [DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr hWnd);
+    [DllImport("user32.dll")] public static extern IntPtr SetActiveWindow(IntPtr hWnd);
+    [DllImport("user32.dll")] public static extern IntPtr SetFocus(IntPtr hWnd);
+    [DllImport("user32.dll")] public static extern bool PeekMessage(out NativeMessage message, IntPtr hWnd, uint min, uint max, uint remove);
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct NativeMessage {
+        public IntPtr hWnd;
+        public uint message;
+        public UIntPtr wParam;
+        public IntPtr lParam;
+        public uint time;
+        public int pointX;
+        public int pointY;
+        public uint privateValue;
+    }
+
+    public static List<WindowInfo> EdgeWindows() {
+        var result = new List<WindowInfo>();
+        EnumWindows((hWnd, _) => {
+            if (!IsWindowVisible(hWnd)) return true;
+            uint processId;
+            uint threadId = GetWindowThreadProcessId(hWnd, out processId);
+            var text = new StringBuilder(512);
+            GetWindowText(hWnd, text, text.Capacity);
+            try {
+                var process = System.Diagnostics.Process.GetProcessById((int)processId);
+                if (String.Equals(process.ProcessName, "msedge", StringComparison.OrdinalIgnoreCase)) {
+                    result.Add(new WindowInfo { Hwnd = hWnd, Title = text.ToString(), ProcessId = processId, ThreadId = threadId });
+                }
+            } catch { }
+            return true;
+        }, IntPtr.Zero);
+        return result;
+    }
+
+    public sealed class WindowInfo {
+        public IntPtr Hwnd { get; set; }
+        public string Title { get; set; }
+        public uint ProcessId { get; set; }
+        public uint ThreadId { get; set; }
+    }
+}
+'@
+    }
+
+    $beforeWindows = [AnswerMePageWindowNative]::EdgeWindows()
+    $beforeHandles = [System.Collections.Generic.HashSet[long]]::new()
+    foreach ($window in $beforeWindows) { [void]$beforeHandles.Add($window.Hwnd.ToInt64()) }
+
+    $processInfo = [System.Diagnostics.ProcessStartInfo]::new()
+    $processInfo.FileName = $edgePath
+    $processInfo.UseShellExecute = $false
+    $processInfo.CreateNoWindow = $true
+    $processInfo.RedirectStandardOutput = $true
+    $processInfo.RedirectStandardError = $true
+    Set-AnswerMeProcessArguments `
+        -StartInfo $processInfo `
+        -Arguments @('--new-window', $parsedUrl.AbsoluteUri)
+    $startedProcess = [System.Diagnostics.Process]::Start($processInfo)
+    if ($startedProcess) {
+        $startedProcess.BeginOutputReadLine()
+        $startedProcess.BeginErrorReadLine()
+    }
+
+    $deadline = [DateTimeOffset]::UtcNow.AddSeconds($WaitSeconds)
+    $target = $null
+    while ([DateTimeOffset]::UtcNow -lt $deadline -and -not $target) {
+        $windows = [AnswerMePageWindowNative]::EdgeWindows()
+        $target = $windows | Where-Object {
+            -not $beforeHandles.Contains($_.Hwnd.ToInt64()) -and
+            ([string]::IsNullOrEmpty($WindowTitleContains) -or $_.Title -like "*$WindowTitleContains*")
+        } | Select-Object -First 1
+        if (-not $target) {
+            Start-Sleep -Milliseconds $WindowPollMilliseconds
+        }
+    }
+
+    if (-not $target) {
+        throw "Edge opened but no new visible window matching '$WindowTitleContains' was found."
+    }
+
+    $foregroundBefore = [AnswerMePageWindowNative]::GetForegroundWindow()
+    $currentThread = [AnswerMePageWindowNative]::GetCurrentThreadId()
+    $message = [AnswerMePageWindowNative+NativeMessage]::new()
+    [void][AnswerMePageWindowNative]::PeekMessage([ref]$message, [IntPtr]::Zero, 0, 0, 0)
+
+    $attemptEvidence = @()
+    $foregroundAfter = $foregroundBefore
+    for ($attempt = 1; $attempt -le $ForegroundAttempts -and $foregroundAfter -ne $target.Hwnd; $attempt++) {
+        $attemptBefore = [AnswerMePageWindowNative]::GetForegroundWindow()
+        $foregroundThread = 0
+        $foregroundProcess = 0
+        if ($attemptBefore -ne [IntPtr]::Zero) {
+            $foregroundThread = [AnswerMePageWindowNative]::GetWindowThreadProcessId($attemptBefore, [ref]$foregroundProcess)
+        }
+
+        $attachedCurrent = $false
+        $attachedForeground = $false
+        try {
+            if ($currentThread -ne $target.ThreadId) {
+                $attachedCurrent = [AnswerMePageWindowNative]::AttachThreadInput($currentThread, $target.ThreadId, $true)
+            }
+            if ($foregroundThread -ne 0 -and $foregroundThread -ne $target.ThreadId -and $foregroundThread -ne $currentThread) {
+                $attachedForeground = [AnswerMePageWindowNative]::AttachThreadInput($foregroundThread, $target.ThreadId, $true)
+            }
+            $show = [AnswerMePageWindowNative]::ShowWindowAsync($target.Hwnd, 9)
+            $bring = [AnswerMePageWindowNative]::BringWindowToTop($target.Hwnd)
+            $setForeground = [AnswerMePageWindowNative]::SetForegroundWindow($target.Hwnd)
+            $active = [AnswerMePageWindowNative]::SetActiveWindow($target.Hwnd)
+            $focus = [AnswerMePageWindowNative]::SetFocus($target.Hwnd)
+        }
+        finally {
+            if ($attachedForeground) { [void][AnswerMePageWindowNative]::AttachThreadInput($foregroundThread, $target.ThreadId, $false) }
+            if ($attachedCurrent) { [void][AnswerMePageWindowNative]::AttachThreadInput($currentThread, $target.ThreadId, $false) }
+        }
+
+        $attemptDeadline = [DateTimeOffset]::UtcNow.AddMilliseconds($ForegroundAttemptMilliseconds)
+        do {
+            $foregroundAfter = [AnswerMePageWindowNative]::GetForegroundWindow()
+            if ($foregroundAfter -eq $target.Hwnd) { break }
+            Start-Sleep -Milliseconds $ForegroundPollMilliseconds
+        } while ([DateTimeOffset]::UtcNow -lt $attemptDeadline)
+        $attemptEvidence += [PSCustomObject]@{
+            attempt = $attempt
+            foregroundBefore = $attemptBefore.ToInt64()
+            foregroundAfter = $foregroundAfter.ToInt64()
+            attachedCurrent = $attachedCurrent
+            attachedForeground = $attachedForeground
+            show = $show
+            bring = $bring
+            setForeground = $setForeground
+            active = $active.ToInt64()
+            focus = $focus.ToInt64()
+        }
+    }
+
+    $ok = $foregroundAfter -eq $target.Hwnd
+    [PSCustomObject]@{
+        ok = $ok
+        status = if ($ok) { 'foreground-verified' } else { 'failed' }
+        code = if ($ok) { $null } else { 'foreground-verification-failed' }
+        inputMode = 'url-only'
+        browserFamily = 'edge'
+        targetHwnd = $target.Hwnd.ToInt64()
+        targetTitle = $target.Title
+        targetProcessId = $target.ProcessId
+        startedProcessId = if ($startedProcess) { $startedProcess.Id } else { $null }
+        foregroundBefore = $foregroundBefore.ToInt64()
+        foregroundAfter = $foregroundAfter.ToInt64()
+        foregroundStrategyVersion = 3
+        requiresNewWindowHandle = $true
+        computerControlPerformed = $true
+        elapsedMilliseconds = $operationStopwatch.ElapsedMilliseconds
+        attempts = $attemptEvidence
+    } | ConvertTo-Json -Depth 8
+
+}
+catch {
+    [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        code = 'open-or-foreground-failed'
+        message = $_.Exception.Message
+        inputMode = 'url-only'
+        browserFamily = 'edge'
+        computerControlPerformed = $true
+        elapsedMilliseconds = $operationStopwatch.ElapsedMilliseconds
+    } | ConvertTo-Json -Depth 4
+}

package/distribution/npm/skills/answerme/scripts/remove-answerme-result-token.ps1

@@ -0,0 +1,63 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$InteractionId,
+    [string]$ResultTokenStoreRoot = $env:ANSWERME_RESULT_TOKEN_STORE_ROOT,
+    [switch]$AllowNonDefaultResultTokenStore
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Write-AnswerMeCleanupFailure {
+    param(
+        [Parameter(Mandatory = $true)][string]$Code,
+        [Parameter(Mandatory = $true)][string]$Message,
+        [Parameter(Mandatory = $true)][int]$ExitCode
+    )
+
+    [PSCustomObject]@{
+        ok = $false
+        status = 'failed'
+        code = $Code
+        message = $Message
+        interactionId = $InteractionId
+    } | ConvertTo-Json -Compress
+    exit $ExitCode
+}
+
+if ([string]::IsNullOrWhiteSpace($InteractionId)) {
+    Write-AnswerMeCleanupFailure `
+        -Code 'interaction-id-missing' `
+        -Message 'InteractionId is required.' `
+        -ExitCode 2
+}
+
+$adapterPath = Join-Path $PSScriptRoot 'result-token-store.windows.ps1'
+if (-not (Test-Path -LiteralPath $adapterPath -PathType Leaf)) {
+    Write-AnswerMeCleanupFailure `
+        -Code 'result-token-store-adapter-missing' `
+        -Message 'A protected Result Token Store adapter is required.' `
+        -ExitCode 3
+}
+
+try {
+    . $adapterPath
+    $result = Remove-AnswerMeResultToken `
+        -InteractionId $InteractionId `
+        -StoreRoot $ResultTokenStoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultResultTokenStore
+    [PSCustomObject]@{
+        ok = $true
+        status = 'credential-cleanup-complete'
+        interactionId = $InteractionId
+        removed = [bool]$result.removed
+        provider = $result.provider
+    } | ConvertTo-Json -Compress
+    exit 0
+}
+catch {
+    Write-AnswerMeCleanupFailure `
+        -Code 'result-token-cleanup-failed' `
+        -Message $_.Exception.Message `
+        -ExitCode 3
+}

package/distribution/npm/skills/answerme/scripts/result-token-store.windows.ps1

@@ -0,0 +1,261 @@
+$ErrorActionPreference = 'Stop'
+
+$cryptoSupport = Join-Path $PSScriptRoot 'windows-crypto.ps1'
+if (-not (Test-Path -LiteralPath $cryptoSupport -PathType Leaf)) {
+    throw 'The AnswerMe Windows cryptography helper is missing.'
+}
+. $cryptoSupport
+
+function Get-AnswerMeDefaultResultTokenStoreRoot {
+    if ([Environment]::OSVersion.Platform -ne [PlatformID]::Win32NT) {
+        throw 'The Windows Result Token Store adapter requires Windows.'
+    }
+    $localAppData = [Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)
+    if ([string]::IsNullOrWhiteSpace($localAppData)) {
+        throw 'LocalApplicationData is unavailable for the current Windows account.'
+    }
+    return [IO.Path]::GetFullPath((Join-Path $localAppData 'AnswerMe\result-token-credentials'))
+}
+
+function Resolve-AnswerMeResultTokenStoreRoot {
+    param(
+        [string]$StoreRoot,
+        [switch]$AllowNonDefaultStoreRoot
+    )
+
+    $defaultRoot = Get-AnswerMeDefaultResultTokenStoreRoot
+    if ([string]::IsNullOrWhiteSpace($StoreRoot)) {
+        return $defaultRoot
+    }
+    $resolved = [IO.Path]::GetFullPath($StoreRoot)
+    if (-not $AllowNonDefaultStoreRoot -and
+        -not $resolved.Equals($defaultRoot, [StringComparison]::OrdinalIgnoreCase)) {
+        throw "A non-default Result Token Store root is allowed only for isolated tests: $resolved"
+    }
+    return $resolved
+}
+
+function Get-AnswerMeResultTokenRecordHash {
+    param([Parameter(Mandatory = $true)][string]$InteractionId)
+
+    if ([string]::IsNullOrWhiteSpace($InteractionId)) {
+        throw 'InteractionId is required for Result Token storage.'
+    }
+    $idBytes = [Text.Encoding]::UTF8.GetBytes($InteractionId)
+    $hashBytes = $null
+    try {
+        $hashBytes = Get-AnswerMeSha256Bytes -Bytes $idBytes
+        return ConvertTo-AnswerMeLowerHex -Bytes $hashBytes
+    }
+    finally {
+        Clear-AnswerMeSensitiveByteArray -Bytes $idBytes
+        Clear-AnswerMeSensitiveByteArray -Bytes $hashBytes
+    }
+}
+
+function Get-AnswerMeResultTokenCredentialPath {
+    param(
+        [Parameter(Mandatory = $true)][string]$InteractionId,
+        [Parameter(Mandatory = $true)][string]$ResolvedStoreRoot
+    )
+
+    $fileName = "{0}.clixml" -f (Get-AnswerMeResultTokenRecordHash -InteractionId $InteractionId)
+    $path = [IO.Path]::GetFullPath((Join-Path $ResolvedStoreRoot $fileName))
+    $parent = [IO.Path]::GetDirectoryName($path)
+    if (-not $parent.Equals($ResolvedStoreRoot, [StringComparison]::OrdinalIgnoreCase)) {
+        throw 'Resolved credential path escaped the Result Token Store root.'
+    }
+    return $path
+}
+
+function Import-AnswerMeResultTokenCredential {
+    param(
+        [Parameter(Mandatory = $true)][string]$CredentialPath,
+        [Parameter(Mandatory = $true)][string]$InteractionId
+    )
+
+    try {
+        $credential = Import-Clixml -LiteralPath $CredentialPath
+    }
+    catch {
+        throw 'The encrypted Result Token credential cannot be read by this Windows account.'
+    }
+    $expectedUserName = 'answerme-result-token:{0}' -f (
+        Get-AnswerMeResultTokenRecordHash -InteractionId $InteractionId
+    )
+    if ($credential -isnot [PSCredential] -or $credential.UserName -cne $expectedUserName) {
+        throw 'The encrypted Result Token credential does not match the requested interaction.'
+    }
+    return $credential
+}
+
+function Assert-AnswerMeResultTokenStore {
+    [CmdletBinding()]
+    param(
+        [string]$StoreRoot,
+        [switch]$AllowNonDefaultStoreRoot
+    )
+
+    $resolvedRoot = Resolve-AnswerMeResultTokenStoreRoot `
+        -StoreRoot $StoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultStoreRoot
+    New-Item -ItemType Directory -Path $resolvedRoot -Force | Out-Null
+
+    $probeId = "answerme-store-probe-$([Guid]::NewGuid().ToString('N'))"
+    $probePath = Join-Path $resolvedRoot ".$probeId.clixml"
+    $probeSecret = "probe-$([Guid]::NewGuid().ToString('N'))"
+    try {
+        $secure = ConvertTo-SecureString $probeSecret -AsPlainText -Force
+        $probeUserName = 'answerme-result-token:{0}' -f (
+            Get-AnswerMeResultTokenRecordHash -InteractionId $probeId
+        )
+        $credential = [PSCredential]::new($probeUserName, $secure)
+        $credential | Export-Clixml -LiteralPath $probePath
+        $roundTrip = Import-AnswerMeResultTokenCredential `
+            -CredentialPath $probePath `
+            -InteractionId $probeId
+        if ($roundTrip.GetNetworkCredential().Password -cne $probeSecret) {
+            throw 'DPAPI Result Token Store probe did not round-trip.'
+        }
+        return [PSCustomObject]@{
+            available = $true
+            provider = 'windows-dpapi'
+            storeRoot = $resolvedRoot
+        }
+    }
+    finally {
+        $secure = $null
+        $credential = $null
+        $roundTrip = $null
+        $probeSecret = $null
+        if (Test-Path -LiteralPath $probePath -PathType Leaf) {
+            Remove-Item -LiteralPath $probePath -Force
+        }
+    }
+}
+
+function Save-AnswerMeResultToken {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$InteractionId,
+        [Parameter(Mandatory = $true)][string]$ResultToken,
+        [string]$StoreRoot,
+        [switch]$AllowNonDefaultStoreRoot
+    )
+
+    if ([string]::IsNullOrWhiteSpace($ResultToken)) {
+        throw 'Result Token is required for protected persistence.'
+    }
+    $resolvedRoot = Resolve-AnswerMeResultTokenStoreRoot `
+        -StoreRoot $StoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultStoreRoot
+    New-Item -ItemType Directory -Path $resolvedRoot -Force | Out-Null
+    $credentialPath = Get-AnswerMeResultTokenCredentialPath `
+        -InteractionId $InteractionId `
+        -ResolvedStoreRoot $resolvedRoot
+
+    if (Test-Path -LiteralPath $credentialPath -PathType Leaf) {
+        $existing = Import-AnswerMeResultTokenCredential `
+            -CredentialPath $credentialPath `
+            -InteractionId $InteractionId
+        if ($existing.GetNetworkCredential().Password -cne $ResultToken) {
+            throw 'A different Result Token is already stored for this interaction.'
+        }
+        return [PSCustomObject]@{
+            persisted = $true
+            idempotentReplay = $true
+            provider = 'windows-dpapi'
+            interactionId = $InteractionId
+            credentialPath = $credentialPath
+        }
+    }
+
+    $temporaryPath = Join-Path $resolvedRoot ".$([Guid]::NewGuid().ToString('N')).tmp.clixml"
+    try {
+        $secureToken = ConvertTo-SecureString $ResultToken -AsPlainText -Force
+        $credentialUserName = 'answerme-result-token:{0}' -f (
+            Get-AnswerMeResultTokenRecordHash -InteractionId $InteractionId
+        )
+        $credential = [PSCredential]::new($credentialUserName, $secureToken)
+        $credential | Export-Clixml -LiteralPath $temporaryPath
+        $roundTrip = Import-AnswerMeResultTokenCredential `
+            -CredentialPath $temporaryPath `
+            -InteractionId $InteractionId
+        if ($roundTrip.GetNetworkCredential().Password -cne $ResultToken) {
+            throw 'The persisted Result Token failed readback verification.'
+        }
+        Move-Item -LiteralPath $temporaryPath -Destination $credentialPath
+        return [PSCustomObject]@{
+            persisted = $true
+            idempotentReplay = $false
+            provider = 'windows-dpapi'
+            interactionId = $InteractionId
+            credentialPath = $credentialPath
+        }
+    }
+    finally {
+        $secureToken = $null
+        $credential = $null
+        $roundTrip = $null
+        if (Test-Path -LiteralPath $temporaryPath -PathType Leaf) {
+            Remove-Item -LiteralPath $temporaryPath -Force
+        }
+    }
+}
+
+function Get-AnswerMeResultToken {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$InteractionId,
+        [string]$StoreRoot,
+        [switch]$AllowNonDefaultStoreRoot
+    )
+
+    $resolvedRoot = Resolve-AnswerMeResultTokenStoreRoot `
+        -StoreRoot $StoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultStoreRoot
+    $credentialPath = Get-AnswerMeResultTokenCredentialPath `
+        -InteractionId $InteractionId `
+        -ResolvedStoreRoot $resolvedRoot
+    if (-not (Test-Path -LiteralPath $credentialPath -PathType Leaf)) {
+        throw 'No protected Result Token credential exists for this interaction.'
+    }
+    $credential = Import-AnswerMeResultTokenCredential `
+        -CredentialPath $credentialPath `
+        -InteractionId $InteractionId
+    return $credential.GetNetworkCredential().Password
+}
+
+function Remove-AnswerMeResultToken {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$InteractionId,
+        [string]$StoreRoot,
+        [switch]$AllowNonDefaultStoreRoot
+    )
+
+    $resolvedRoot = Resolve-AnswerMeResultTokenStoreRoot `
+        -StoreRoot $StoreRoot `
+        -AllowNonDefaultStoreRoot:$AllowNonDefaultStoreRoot
+    $credentialPath = Get-AnswerMeResultTokenCredentialPath `
+        -InteractionId $InteractionId `
+        -ResolvedStoreRoot $resolvedRoot
+    if (-not (Test-Path -LiteralPath $credentialPath -PathType Leaf)) {
+        return [PSCustomObject]@{
+            removed = $false
+            provider = 'windows-dpapi'
+            interactionId = $InteractionId
+            credentialPath = $credentialPath
+        }
+    }
+    Import-AnswerMeResultTokenCredential `
+        -CredentialPath $credentialPath `
+        -InteractionId $InteractionId | Out-Null
+    Remove-Item -LiteralPath $credentialPath -Force
+    return [PSCustomObject]@{
+        removed = $true
+        provider = 'windows-dpapi'
+        interactionId = $InteractionId
+        credentialPath = $credentialPath
+    }
+}