zapo-js 0.2.0 → 1.0.0

package/dist/esm/message/crypto/addon-crypto.js

@@ -0,0 +1,244 @@
+import { aesGcmDecrypt, aesGcmEncrypt, sha256 } from '../../crypto/index.js';
+import { assertMessageSecret, createUseCaseSecret, WA_MESSAGE_SECRET_BYTES, WA_USE_CASE_SECRET_MODIFICATION_TYPES } from '../crypto/use-case-secret.js';
+import { unwrapMessage } from '../encode/content.js';
+import { proto } from '../../proto.js';
+import { bytesToHex, EMPTY_BYTES, TEXT_ENCODER, toBytesView } from '../../util/bytes.js';
+const WA_ADDON_ENCRYPTION_NONCE_BYTES = 12;
+/** Returns `true` when an addon kind binds its AES-GCM ciphertext to additional data (polls + event responses). */
+export function shouldUseAddonAdditionalData(modificationType) {
+    return (modificationType === WA_USE_CASE_SECRET_MODIFICATION_TYPES.POLL_VOTE ||
+        modificationType === WA_USE_CASE_SECRET_MODIFICATION_TYPES.EVENT_RESPONSE);
+}
+/** Builds the canonical AES-GCM `additionalData` bytes for an addon (stanza id + NUL + sender). */
+export function buildAddonAdditionalData(stanzaId, addOnSenderJid) {
+    if (!stanzaId.trim()) {
+        throw new Error('stanza id must be a non-empty string');
+    }
+    if (!addOnSenderJid.trim()) {
+        throw new Error('addon sender jid must be a non-empty string');
+    }
+    return TEXT_ENCODER.encode(`${stanzaId}\u0000${addOnSenderJid}`);
+}
+/** Encrypts an addon payload (poll vote, reaction, edit, ...) with the per-use-case secret. */
+export async function encryptAddonPayload(input) {
+    const secret = await createUseCaseSecret({
+        messageSecret: assertMessageSecret(input.messageSecret),
+        stanzaId: input.stanzaId,
+        parentMsgOriginalSender: input.parentMsgOriginalSender,
+        modificationSender: input.modificationSender,
+        modificationType: input.modificationType
+    });
+    const iv = assertAddonIv(input.iv);
+    const additionalData = resolveAddonAdditionalData(input);
+    return aesGcmEncrypt(secret, iv, toBytesView(input.payload), additionalData);
+}
+/** Decrypts an addon payload encrypted with {@link encryptAddonPayload}. */
+export async function decryptAddonPayload(input) {
+    const secret = await createUseCaseSecret({
+        messageSecret: assertMessageSecret(input.messageSecret),
+        stanzaId: input.stanzaId,
+        parentMsgOriginalSender: input.parentMsgOriginalSender,
+        modificationSender: input.modificationSender,
+        modificationType: input.modificationType
+    });
+    const iv = assertAddonIv(input.iv);
+    const additionalData = resolveAddonAdditionalData(input);
+    return aesGcmDecrypt(secret, iv, toBytesView(input.ciphertext), additionalData);
+}
+/**
+ * Inspects a message and, when it contains an encrypted addon (reaction,
+ * poll vote, edit, comment, event response, ...), returns the parsed
+ * envelope with its kind and target message key. Returns `null` otherwise.
+ */
+export function identifyEncryptedAddon(message) {
+    const msg = unwrapMessage(message);
+    if (msg.encReactionMessage) {
+        const { targetMessageKey, encPayload, encIv } = msg.encReactionMessage;
+        if (targetMessageKey && encPayload && encIv) {
+            return {
+                kind: 'reaction',
+                targetMessageKey,
+                encPayload: encPayload,
+                encIv: encIv,
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.ENC_REACTION,
+                raw: message
+            };
+        }
+    }
+    if (msg.pollUpdateMessage) {
+        const { pollCreationMessageKey, vote } = msg.pollUpdateMessage;
+        if (pollCreationMessageKey && vote?.encPayload && vote.encIv) {
+            return {
+                kind: 'poll_vote',
+                targetMessageKey: pollCreationMessageKey,
+                encPayload: vote.encPayload,
+                encIv: vote.encIv,
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.POLL_VOTE,
+                raw: message
+            };
+        }
+    }
+    if (msg.encEventResponseMessage) {
+        const { eventCreationMessageKey, encPayload, encIv } = msg.encEventResponseMessage;
+        if (eventCreationMessageKey && encPayload && encIv) {
+            return {
+                kind: 'event_response',
+                targetMessageKey: eventCreationMessageKey,
+                encPayload: encPayload,
+                encIv: encIv,
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.EVENT_RESPONSE,
+                raw: message
+            };
+        }
+    }
+    if (msg.encCommentMessage) {
+        const { targetMessageKey, encPayload, encIv } = msg.encCommentMessage;
+        if (targetMessageKey && encPayload && encIv) {
+            return {
+                kind: 'comment',
+                targetMessageKey,
+                encPayload: encPayload,
+                encIv: encIv,
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.ENC_COMMENT,
+                raw: message
+            };
+        }
+    }
+    if (msg.secretEncryptedMessage) {
+        const { targetMessageKey, encPayload, encIv, secretEncType } = msg.secretEncryptedMessage;
+        if (targetMessageKey?.id &&
+            encPayload &&
+            encIv &&
+            encIv.byteLength === WA_ADDON_ENCRYPTION_NONCE_BYTES) {
+            const mapped = mapSecretEncType(secretEncType);
+            if (mapped) {
+                return {
+                    kind: mapped.kind,
+                    targetMessageKey,
+                    encPayload,
+                    encIv,
+                    modificationType: mapped.modificationType,
+                    raw: message
+                };
+            }
+        }
+    }
+    return null;
+}
+function mapSecretEncType(secretEncType) {
+    switch (secretEncType) {
+        case proto.Message.SecretEncryptedMessage.SecretEncType.MESSAGE_EDIT:
+            return {
+                kind: 'message_edit',
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.MESSAGE_EDIT
+            };
+        case proto.Message.SecretEncryptedMessage.SecretEncType.EVENT_EDIT:
+            return {
+                kind: 'event_edit',
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.EVENT_EDIT_ENCRYPTED
+            };
+        case proto.Message.SecretEncryptedMessage.SecretEncType.POLL_EDIT:
+            return {
+                kind: 'poll_edit',
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.POLL_EDIT_ENCRYPTED
+            };
+        case proto.Message.SecretEncryptedMessage.SecretEncType.POLL_ADD_OPTION:
+            return {
+                kind: 'poll_add_option',
+                modificationType: WA_USE_CASE_SECRET_MODIFICATION_TYPES.POLL_ADD_OPTION
+            };
+        default:
+            return null;
+    }
+}
+/** Decodes the decrypted addon plaintext into its typed protobuf message based on `kind`. */
+export function decodeAddonPlaintext(kind, plaintext) {
+    switch (kind) {
+        case 'reaction':
+            return { kind, reaction: proto.Message.ReactionMessage.decode(plaintext) };
+        case 'poll_vote':
+            return {
+                kind,
+                pollVote: proto.Message.PollVoteMessage.decode(plaintext),
+                selectedOptionNames: null
+            };
+        case 'event_response':
+            return { kind, eventResponse: proto.Message.EventResponseMessage.decode(plaintext) };
+        case 'comment':
+            return { kind, comment: proto.Message.CommentMessage.decode(plaintext) };
+        case 'message_edit':
+        case 'event_edit':
+        case 'poll_edit':
+        case 'poll_add_option':
+            return { kind, message: proto.Message.decode(plaintext) };
+    }
+}
+export async function resolveParentMessageSecret(targetMessageId, messageSecretStore, messageStore) {
+    const cached = await messageSecretStore.get(targetMessageId);
+    if (cached)
+        return cached;
+    const record = await messageStore.getById(targetMessageId);
+    if (!record?.messageBytes)
+        return null;
+    try {
+        const decoded = proto.Message.decode(record.messageBytes);
+        const secret = decoded.messageContextInfo?.messageSecret;
+        if (!secret || secret.byteLength !== WA_MESSAGE_SECRET_BYTES)
+            return null;
+        return { secret, senderJid: record.senderJid ?? '' };
+    }
+    catch {
+        return null;
+    }
+}
+export async function resolvePollOptionNames(selectedOptions, pollCreationMessageId, messageStore) {
+    const record = await messageStore.getById(pollCreationMessageId);
+    if (!record?.messageBytes)
+        return null;
+    let decoded;
+    try {
+        decoded = proto.Message.decode(record.messageBytes);
+    }
+    catch {
+        return null;
+    }
+    const pollMsg = unwrapMessage(decoded);
+    const options = pollMsg.pollCreationMessage?.options ??
+        pollMsg.pollCreationMessageV2?.options ??
+        pollMsg.pollCreationMessageV3?.options ??
+        pollMsg.pollCreationMessageV5?.options;
+    if (!options || options.length === 0)
+        return null;
+    const hashToName = new Map();
+    for (const option of options) {
+        if (!option.optionName)
+            continue;
+        const hash = sha256(TEXT_ENCODER.encode(option.optionName));
+        hashToName.set(bytesToHex(hash), option.optionName);
+    }
+    const names = [];
+    for (const selected of selectedOptions) {
+        const hex = bytesToHex(selected);
+        const name = hashToName.get(hex);
+        if (!name)
+            return null;
+        names.push(name);
+    }
+    return names;
+}
+function assertAddonIv(iv) {
+    const normalized = toBytesView(iv);
+    if (normalized.byteLength !== WA_ADDON_ENCRYPTION_NONCE_BYTES) {
+        throw new Error(`addon iv must be ${WA_ADDON_ENCRYPTION_NONCE_BYTES} bytes (got ${normalized.byteLength})`);
+    }
+    return normalized;
+}
+function resolveAddonAdditionalData(input) {
+    if (input.additionalData) {
+        return toBytesView(input.additionalData);
+    }
+    if (!shouldUseAddonAdditionalData(input.modificationType)) {
+        return EMPTY_BYTES;
+    }
+    return buildAddonAdditionalData(input.stanzaId, input.modificationSender);
+}

package/dist/esm/message/{icdc.js → crypto/icdc.js}

@@ -1,24 +1,22 @@
-import { sha256, toRawPubKey } from '../crypto/index.js';
-import { parseSignalAddressFromJid } from '../protocol/jid.js';
-import { concatBytes } from '../util/bytes.js';
-const ICDC_HASH_LENGTH = 8;
+import { sha256, toRawPubKey } from '../../crypto/index.js';
+import { parseSignalAddressFromJid } from '../../protocol/jid.js';
+const ICDC_DEFAULT_HASH_LENGTH = 8;
 const ICDC_FRESHNESS_THRESHOLD_MS = 30 * 24 * 60 * 60 * 1000;
 const DEVICE_LIST_METADATA_VERSION = 2;
-const EMPTY_KEY_HASH = new Uint8Array(ICDC_HASH_LENGTH);
-export async function computeDeviceKeyHash(identityKeys) {
+export function computeDeviceKeyHash(identityKeys, hashLength) {
+    const length = hashLength ?? ICDC_DEFAULT_HASH_LENGTH;
     if (identityKeys.length === 0) {
-        return EMPTY_KEY_HASH;
+        return new Uint8Array(length);
     }
     const rawKeys = new Array(identityKeys.length);
     for (let i = 0; i < identityKeys.length; i += 1) {
         rawKeys[i] =
             identityKeys[i].byteLength === 33 ? toRawPubKey(identityKeys[i]) : identityKeys[i];
     }
-    const combined = concatBytes(rawKeys);
-    const hash = await sha256(combined);
-    return hash.subarray(0, ICDC_HASH_LENGTH);
+    const hash = sha256(rawKeys);
+    return hash.subarray(0, length);
 }
-export async function resolveIcdcMeta(deviceJids, signalStore, updatedAtMs, localIdentity) {
+export async function resolveIcdcMeta(deviceJids, identityStore, updatedAtMs, localIdentity, hashLength) {
     if (deviceJids.length === 0) {
         return null;
     }
@@ -26,7 +24,7 @@ export async function resolveIcdcMeta(deviceJids, signalStore, updatedAtMs, loca
     for (let i = 0; i < deviceJids.length; i += 1) {
         addresses[i] = parseSignalAddressFromJid(deviceJids[i]);
     }
-    const remoteKeys = await signalStore.getRemoteIdentities(addresses);
+    const remoteKeys = await identityStore.getRemoteIdentities(addresses);
     const keys = [];
     for (let i = 0; i < addresses.length; i += 1) {
         const key = remoteKeys[i];
@@ -42,7 +40,7 @@ export async function resolveIcdcMeta(deviceJids, signalStore, updatedAtMs, loca
     if (keys.length === 0) {
         return null;
     }
-    const keyHash = await computeDeviceKeyHash(keys);
+    const keyHash = computeDeviceKeyHash(keys, hashLength);
     const timestamp = updatedAtMs !== undefined && Date.now() - updatedAtMs < ICDC_FRESHNESS_THRESHOLD_MS
         ? Math.floor(updatedAtMs / 1000)
         : undefined;

package/dist/esm/message/crypto/phash.js

@@ -0,0 +1,133 @@
+import { sha256 } from '../../crypto/core/index.js';
+import { WA_DEFAULTS } from '../../protocol/constants.js';
+import { bytesToBase64 } from '../../util/bytes.js';
+const PHASH_DIGEST_PREFIX = 6;
+const CHAR_DOT = 0x2e;
+const CHAR_ZERO = 0x30;
+const CHAR_COLON = 0x3a;
+const CHAR_AT = 0x40;
+const CHAR_C = 0x63;
+const CHAR_U = 0x75;
+const CHAR_S = 0x73;
+const MAX_PARTICIPANTS = 2048;
+const PER_WID_BYTES = 96;
+const SCRATCH = new Uint8Array(MAX_PARTICIPANTS * PER_WID_BYTES);
+const OFFSETS = new Uint32Array(MAX_PARTICIPANTS + 1);
+const ORDER = new Uint32Array(MAX_PARTICIPANTS);
+export function computePhashV2(participants) {
+    if (participants.length === 0)
+        return '2:';
+    const n = participants.length;
+    if (n > MAX_PARTICIPANTS) {
+        throw new Error(`phash participant count ${n} exceeds MAX_PARTICIPANTS ${MAX_PARTICIPANTS}`);
+    }
+    let off = 0;
+    for (let i = 0; i < n; i += 1) {
+        OFFSETS[i] = off;
+        const nextOff = writeCanonicalUtf8(SCRATCH, off, participants[i]);
+        if (nextOff > SCRATCH.length) {
+            throw new Error(`phash canonical buffer overflow at participant ${i}: needs ${nextOff} bytes, scratch is ${SCRATCH.length}`);
+        }
+        off = nextOff;
+    }
+    OFFSETS[n] = off;
+    for (let i = 0; i < n; i += 1)
+        ORDER[i] = i;
+    ORDER.subarray(0, n).sort((a, b) => compareScratchSlice(SCRATCH, OFFSETS, a, b));
+    const parts = new Array(n);
+    for (let i = 0; i < n; i += 1) {
+        const idx = ORDER[i];
+        parts[i] = SCRATCH.subarray(OFFSETS[idx], OFFSETS[idx + 1]);
+    }
+    const digest = sha256(parts);
+    return `2:${bytesToBase64(digest.subarray(0, PHASH_DIGEST_PREFIX))}`;
+}
+function writeCanonicalUtf8(out, start, jid) {
+    const atIndex = jid.indexOf('@');
+    if (atIndex < 1 || atIndex >= jid.length - 1) {
+        return writeAscii(out, start, jid, 0, jid.length);
+    }
+    const colonIndex = jid.indexOf(':', 0);
+    const userEnd = colonIndex >= 0 && colonIndex < atIndex ? colonIndex : atIndex;
+    const hasZeroAgent = userEnd >= 2 &&
+        jid.charCodeAt(userEnd - 2) === CHAR_DOT &&
+        jid.charCodeAt(userEnd - 1) === CHAR_ZERO;
+    const baseUserEnd = hasZeroAgent ? userEnd - 2 : userEnd;
+    let off = writeAscii(out, start, jid, 0, baseUserEnd);
+    out[off++] = CHAR_DOT;
+    out[off++] = CHAR_ZERO;
+    out[off++] = CHAR_COLON;
+    let device = 0;
+    if (colonIndex >= 0 && colonIndex < atIndex) {
+        for (let i = colonIndex + 1; i < atIndex; i += 1) {
+            const digit = jid.charCodeAt(i) - CHAR_ZERO;
+            if (digit < 0 || digit > 9) {
+                device = 0;
+                break;
+            }
+            device = device * 10 + digit;
+            if (device > Number.MAX_SAFE_INTEGER) {
+                device = 0;
+                break;
+            }
+        }
+    }
+    off = writeUintAscii(out, off, device);
+    out[off++] = CHAR_AT;
+    const serverStart = atIndex + 1;
+    const serverLen = jid.length - serverStart;
+    const isCUs = serverLen === 4 &&
+        jid.charCodeAt(serverStart) === CHAR_C &&
+        jid.charCodeAt(serverStart + 1) === CHAR_DOT &&
+        jid.charCodeAt(serverStart + 2) === CHAR_U &&
+        jid.charCodeAt(serverStart + 3) === CHAR_S;
+    if (isCUs) {
+        off = writeAscii(out, off, WA_DEFAULTS.HOST_DOMAIN, 0, WA_DEFAULTS.HOST_DOMAIN.length);
+    }
+    else {
+        off = writeAscii(out, off, jid, serverStart, jid.length);
+    }
+    return off;
+}
+function writeAscii(out, outOff, str, start, end) {
+    for (let i = start; i < end; i += 1) {
+        out[outOff + (i - start)] = str.charCodeAt(i);
+    }
+    return outOff + (end - start);
+}
+function writeUintAscii(out, off, value) {
+    if (value === 0) {
+        out[off] = CHAR_ZERO;
+        return off + 1;
+    }
+    let temp = value;
+    let digits = 0;
+    while (temp > 0) {
+        digits += 1;
+        temp = (temp - (temp % 10)) / 10;
+    }
+    let cursor = off + digits - 1;
+    let v = value;
+    while (v > 0) {
+        out[cursor] = CHAR_ZERO + (v % 10);
+        cursor -= 1;
+        v = (v - (v % 10)) / 10;
+    }
+    return off + digits;
+}
+function compareScratchSlice(scratch, offsets, a, b) {
+    const aStart = offsets[a];
+    const aEnd = offsets[a + 1];
+    const bStart = offsets[b];
+    const bEnd = offsets[b + 1];
+    const aLen = aEnd - aStart;
+    const bLen = bEnd - bStart;
+    const cmpLen = aLen < bLen ? aLen : bLen;
+    for (let k = 0; k < cmpLen; k += 1) {
+        const av = scratch[aStart + k];
+        const bv = scratch[bStart + k];
+        if (av !== bv)
+            return av - bv;
+    }
+    return aLen - bLen;
+}

package/dist/esm/message/{reporting-token.js → crypto/reporting-token.js}

@@ -1,6 +1,6 @@
-import { hkdf, hmacSign, importHmacKey } from '../crypto/index.js';
-import { proto } from '../proto.js';
-import { base64ToBytesChecked, concatBytes, EMPTY_BYTES, TEXT_ENCODER, toBytesView } from '../util/bytes.js';
+import { hkdf, hmacSha256Sign } from '../../crypto/index.js';
+import { proto } from '../../proto.js';
+import { base64ToBytesChecked, concatBytes, EMPTY_BYTES, TEXT_ENCODER } from '../../util/bytes.js';
 const WA_REPORTING_TOKEN_BYTES = 16;
 const WA_REPORTING_TOKEN_KEY_BYTES = 32;
 const WA_REPORTING_TOKEN_USE_CASE = 'Report Token';
@@ -9,13 +9,14 @@ const WA_REPORTING_TOKEN_CONFIG_BYTES = base64ToBytesChecked(WA_REPORTING_TOKEN_
 export const WA_REPORTING_TOKEN_VERSION = 2;
 let reportingTokenConfigSpec = null;
 const reportingTokenConfigCache = new Map();
+// eslint-disable-next-line @typescript-eslint/require-await
 export async function buildReportingTokenArtifacts(input) {
     const stanzaId = input.stanzaId.trim();
     if (!stanzaId || !isMessageReportingTokenCompatible(input.message)) {
         return null;
     }
     const messageSecret = input.message.messageContextInfo?.messageSecret;
-    if (!messageSecret || toBytesView(messageSecret).byteLength === 0) {
+    if (!messageSecret || messageSecret.byteLength === 0) {
         return null;
     }
     const reportingTokenContent = computeReportingTokenContent(proto.Message.encode(input.message).finish(), input.version ?? WA_REPORTING_TOKEN_VERSION);
@@ -23,9 +24,8 @@ export async function buildReportingTokenArtifacts(input) {
         return null;
     }
     const secretInfo = TEXT_ENCODER.encode(stanzaId + input.senderUserJid + input.remoteJid + WA_REPORTING_TOKEN_USE_CASE);
-    const reportingTokenKey = await hkdf(toBytesView(messageSecret), null, secretInfo, WA_REPORTING_TOKEN_KEY_BYTES);
-    const hmacKey = await importHmacKey(reportingTokenKey);
-    const reportingToken = (await hmacSign(hmacKey, reportingTokenContent)).subarray(0, WA_REPORTING_TOKEN_BYTES);
+    const reportingTokenKey = hkdf(messageSecret, null, secretInfo, WA_REPORTING_TOKEN_KEY_BYTES);
+    const reportingToken = hmacSha256Sign(reportingTokenKey, reportingTokenContent).subarray(0, WA_REPORTING_TOKEN_BYTES);
     const version = input.version ?? WA_REPORTING_TOKEN_VERSION;
     return {
         node: {

package/dist/esm/message/{use-case-secret.js → crypto/use-case-secret.js}

@@ -1,5 +1,5 @@
-import { hkdf, randomBytesAsync } from '../crypto/index.js';
-import { TEXT_ENCODER, toBytesView } from '../util/bytes.js';
+import { hkdf, randomBytesAsync } from '../../crypto/index.js';
+import { TEXT_ENCODER, toBytesView } from '../../util/bytes.js';
 export const WA_MESSAGE_SECRET_BYTES = 32;
 export const WA_USE_CASE_SECRET_MODIFICATION_TYPES = Object.freeze({
     POLL_VOTE: 'Poll Vote',
@@ -8,8 +8,14 @@ export const WA_USE_CASE_SECRET_MODIFICATION_TYPES = Object.freeze({
     REPORT_TOKEN: 'Report Token',
     EVENT_RESPONSE: 'Event Response',
     EVENT_EDIT_ENCRYPTED: 'Event Edit',
-    MESSAGE_EDIT: 'Message Edit'
+    MESSAGE_EDIT: 'Message Edit',
+    POLL_EDIT_ENCRYPTED: 'Poll Edit',
+    POLL_ADD_OPTION: 'Poll Add Option'
 });
+/**
+ * Validates that `messageSecret` is exactly 32 bytes and returns it as a
+ * zero-copy Uint8Array view (throws otherwise).
+ */
 export function assertMessageSecret(messageSecret, context = 'message secret') {
     const bytes = toBytesView(messageSecret);
     if (bytes.byteLength !== WA_MESSAGE_SECRET_BYTES) {
@@ -17,9 +23,14 @@ export function assertMessageSecret(messageSecret, context = 'message secret') {
     }
     return bytes;
 }
+/**
+ * Returns `message` unchanged when a message secret is already present;
+ * otherwise generates a fresh 32-byte secret and attaches it under
+ * `messageContextInfo.messageSecret`.
+ */
 export async function ensureMessageSecret(message) {
     const messageSecret = message.messageContextInfo?.messageSecret;
-    if (messageSecret && toBytesView(messageSecret).byteLength > 0) {
+    if (messageSecret && messageSecret.byteLength > 0) {
         return message;
     }
     const generatedMessageSecret = await randomBytesAsync(WA_MESSAGE_SECRET_BYTES);
@@ -31,6 +42,12 @@ export async function ensureMessageSecret(message) {
         }
     };
 }
+/**
+ * Derives the per-use-case secret (poll vote, reaction, edit, ...) via HKDF
+ * over `messageSecret` and the canonical `stanzaId + sender + sender +
+ * modificationType` info string.
+ */
+// eslint-disable-next-line @typescript-eslint/require-await
 export async function createUseCaseSecret(input) {
     if (!input.stanzaId.trim()) {
         throw new Error('stanza id must be a non-empty string');