@gotgenes/pi-permission-system 25.3.0 → 26.0.0

package/src/handlers/gates/runner.ts

@@ -1,16 +1,22 @@
 import type { AskEscalator } from "#src/authority/authorizer-selection";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type { DecisionReporter } from "#src/decision-reporter";
-import {
-  formatDenyReason,
-  formatUnavailableReason,
-  formatUserDeniedReason,
-} from "#src/denial-messages";
 import { applyPermissionGate } from "#src/permission-gate";
+import { createPermissionRequestId } from "#src/permission-request-id";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import {
+  renderPolicyDenial,
+  renderUnavailableDenial,
+  renderUserDenial,
+} from "#src/presentation/agent-renderer";
+import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
-import type { GateDescriptor, GateResult } from "./descriptor";
+import type {
+  DecisionEventFacts,
+  GateDescriptor,
+  GateResult,
+} from "./descriptor";
 import { isGateBypass } from "./descriptor";
 import {
   buildDecisionEvent,
@@ -46,33 +52,44 @@ export class GateRunner {
   /**
    * Execute a gate: null → allow; bypass → log/emit side effects then allow;
    * descriptor → full check→log→emit→approve cycle.
+   *
+   * The request id is minted here, before the branch, so a request that never
+   * prompts is identified exactly as one that does.
    */
-  async run(
-    gate: GateResult,
-    agentName: string | null,
-    toolCallId: string,
-  ): Promise<GateOutcome> {
+  async run(gate: GateResult, agentName: string | null): Promise<GateOutcome> {
     if (!gate) {
       return { action: "allow" };
     }
+    const requestId = createPermissionRequestId();
     if (isGateBypass(gate)) {
       if (gate.log) {
-        this.reporter.writeReviewLog(gate.log.event, gate.log.details);
+        this.reporter.writeReviewLog(gate.log.event, {
+          ...gate.log.details,
+          requestId,
+        });
       }
       if (gate.decision) {
-        this.reporter.emitDecision(gate.decision);
+        this.emitDecision(requestId, gate.decision);
       }
       return { action: "allow" };
     }
-    return this.runDescriptor(gate, agentName, toolCallId);
+    return this.runDescriptor(gate, agentName, requestId);
   }
 
   // ── Private helpers ──────────────────────────────────────────────────────
 
+  /**
+   * The one place a decision event acquires its request id, so no emit path
+   * can be added that forgets it.
+   */
+  private emitDecision(requestId: string, facts: DecisionEventFacts): void {
+    this.reporter.emitDecision({ requestId, ...facts });
+  }
+
   private async runDescriptor(
     descriptor: GateDescriptor,
     agentName: string | null,
-    toolCallId: string,
+    requestId: string,
   ): Promise<GateOutcome> {
     // 1. Resolve permission state — pre-check, pre-resolved, or via resolver
     let check: PermissionCheckResult;
@@ -94,15 +111,27 @@ export class GateRunner {
       });
     }
 
+    // The fields every review-log write for this gate shares, whatever the
+    // resolution — built once so a field added here reaches all of them. The
+    // payload's request facts are stamped here rather than by each gate, for
+    // the same reason `requestId` is: a gate cannot forget what it never
+    // supplies (ADR 0011 §6).
+    const logContext = {
+      ...descriptor.logContext,
+      ...renderReviewLogFacts(descriptor.payload),
+      agentName,
+      requestId,
+    };
+
     // 2. Session-hit fast path
     if (check.source === "session") {
       this.reporter.writeReviewLog("permission_request.session_approved", {
-        ...descriptor.logContext,
-        agentName,
+        ...logContext,
         resolution: "session_approved",
         sessionApprovalPattern: check.matchedPattern,
       });
-      this.reporter.emitDecision(
+      this.emitDecision(
+        requestId,
         buildDecisionEvent(
           descriptor.decision,
           check,
@@ -121,11 +150,11 @@ export class GateRunner {
     const yoloGrant = resolveYoloGrant(check, this.isYoloEnabled());
     if (yoloGrant) {
       this.reporter.writeReviewLog("permission_request.auto_approved", {
-        ...descriptor.logContext,
-        agentName,
+        ...logContext,
         resolution: "auto_approved",
       });
-      this.reporter.emitDecision(
+      this.emitDecision(
+        requestId,
         buildDecisionEvent(
           descriptor.decision,
           yoloGrant,
@@ -140,16 +169,16 @@ export class GateRunner {
     // 3. Apply the deny/ask/allow gate — always escalate on ask; the selected
     // Authorizer answers (the DenyingAuthorizer by denying with a marker).
 
-    // Construct messages from the centralized formatter.
+    // The agent-facing renders of this ask. The rule reason is the operator's
+    // deny-with-reason text, which lives on the resolved check rather than the
+    // payload: no human render wants it, because a deny never prompts.
+    const { payload } = descriptor;
     const messages = {
-      denyReason: formatDenyReason(descriptor.denialContext),
+      denyReason: renderPolicyDenial(payload, check.reason ?? null),
       unavailableReason: (decision: PermissionPromptDecision) =>
-        formatUnavailableReason(
-          descriptor.denialContext,
-          decision.denialReason,
-        ),
+        renderUnavailableDenial(payload, decision.denialReason ?? null),
       userDeniedReason: (decision: PermissionPromptDecision) =>
-        formatUserDeniedReason(descriptor.denialContext, decision.denialReason),
+        renderUserDenial(payload, decision.denialReason ?? null),
     };
 
     let autoApproved = false;
@@ -159,7 +188,8 @@ export class GateRunner {
       sessionApproval: descriptor.sessionApproval?.toGateApproval(),
       promptForApproval: async () => {
         const decision = await this.prompter.escalate({
-          requestId: toolCallId,
+          requestId,
+          payload,
           ...descriptor.promptDetails,
           ...(descriptor.sessionApproval
             ? { sessionApproval: descriptor.sessionApproval.toForwardedData() }
@@ -171,7 +201,7 @@ export class GateRunner {
       },
       writeLog: (event, details) =>
         this.reporter.writeReviewLog(event, details),
-      logContext: { ...descriptor.logContext, agentName },
+      logContext,
       messages,
     });
 
@@ -180,7 +210,8 @@ export class GateRunner {
       gateResult.action === "allow" && gateResult.sessionApproval !== undefined;
 
     // 5. Emit decision event
-    this.reporter.emitDecision(
+    this.emitDecision(
+      requestId,
       buildDecisionEvent(
         descriptor.decision,
         check,

package/src/handlers/gates/skill-input-gate-pipeline.ts

@@ -40,7 +40,7 @@ export interface GateNotifier {
 
 /**
  * Owns the skill-input gate assembly: raw permission pre-check, deny notify,
- * `describeSkillInputGate` descriptor, request-id mint, and `runner.run(...)`.
+ * `describeSkillInputGate` descriptor, and `runner.run(...)`.
  *
  * Constructed once in the composition root and injected into
  * `PermissionGateHandler`, mirroring `ToolCallGatePipeline` for the `input`
@@ -70,29 +70,18 @@ export class SkillInputGatePipeline {
     return runner.run(
       describeSkillInputGate(skillName, agentName, check),
       agentName,
-      createSkillInputRequestId(),
     );
   }
 }
 
 // ── Helpers ───────────────────────────────────────────────────────────────────
 
-/**
- * Mint a unique id for a skill-input permission request.
- *
- * Format is `skill-input-<timestamp>-<random>-<pid>`, matching the
- * `createPermissionRequestId("skill-input")` pattern it replaces (#330).
- */
-export function createSkillInputRequestId(): string {
-  return `skill-input-${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${process.pid}`;
-}
-
 /**
  * Format the deny warning shown in the UI when a skill is blocked.
  *
  * Intentionally untagged (no `[pi-permission-system]` prefix) — this is a
- * UI notify distinct from the gate deny reasons the runner routes through
- * `formatDenyReason`.
+ * UI notify distinct from the agent-facing deny reasons the runner routes
+ * through `renderPolicyDenial`.
  */
 export function formatSkillDenyNotice(
   skillName: string,

package/src/handlers/gates/skill-input.ts

@@ -1,4 +1,3 @@
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildSkillAskPayload } from "#src/presentation/skill-ask-payload";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
@@ -17,21 +16,14 @@ export function describeSkillInputGate(
   preCheck: PermissionCheckResult,
 ): GateDescriptor {
   const payload = buildSkillAskPayload(skillName, agentName);
-  const message = renderLegacyMessage(payload);
   return {
     surface: "skill",
     input: { name: skillName },
     preCheck,
-    denialContext: {
-      kind: "skill_input",
-      skillName,
-      agentName: agentName ?? undefined,
-    },
+    payload,
     promptDetails: {
       source: "skill_input",
       agentName,
-      message,
-      payload,
       skillName,
       accessIntent: accessFactsFromValue("skill", skillName),
     },
@@ -39,7 +31,6 @@ export function describeSkillInputGate(
       source: "skill_input",
       skillName,
       agentName,
-      message,
     },
     decision: {
       surface: "skill",

package/src/handlers/gates/skill-read.ts

@@ -1,5 +1,4 @@
 import type { PathNormalizer } from "#src/path-normalizer";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildSkillPathAskPayload } from "#src/presentation/skill-ask-payload";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
@@ -44,22 +43,14 @@ export function describeSkillReadGate(
   }
 
   const payload = buildSkillPathAskPayload(matchedSkill, path, tcc.agentName);
-  const skillReadMessage = renderLegacyMessage(payload);
 
   return {
     surface: "skill",
     input: { name: matchedSkill.name },
-    denialContext: {
-      kind: "skill_read",
-      skillName: matchedSkill.name,
-      readPath: path,
-      agentName: tcc.agentName ?? undefined,
-    },
+    payload,
     promptDetails: {
       source: "skill_read",
       agentName: tcc.agentName,
-      message: skillReadMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       skillName: matchedSkill.name,
@@ -68,10 +59,10 @@ export function describeSkillReadGate(
     },
     logContext: {
       source: "skill_read",
+      toolCallId: tcc.toolCallId,
       skillName: matchedSkill.name,
       agentName: tcc.agentName,
       path,
-      message: skillReadMessage,
     },
     decision: {
       surface: "skill",

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -137,11 +137,7 @@ export class ToolCallGatePipeline {
     ];
 
     for (const produce of gateProducers) {
-      const outcome = await runner.run(
-        await produce(),
-        tcc.agentName,
-        tcc.toolCallId,
-      );
+      const outcome = await runner.run(await produce(), tcc.agentName);
       if (outcome.action === "block") {
         return outcome;
       }

package/src/handlers/gates/tool.ts

@@ -6,7 +6,6 @@ import {
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
 import { suggestSessionPattern } from "#src/pattern-suggest";
-import { renderLegacyMessage } from "#src/presentation/legacy-message";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
@@ -81,7 +80,6 @@ export function describeToolGate(
     input: tcc.input,
     formatter,
   });
-  const askMessage = renderLegacyMessage(payload);
 
   const decisionValue = deriveDecisionValue(
     gateSurface,
@@ -98,12 +96,7 @@ export function describeToolGate(
   return {
     surface: gateSurface,
     input: tcc.input,
-    denialContext: {
-      kind: "tool",
-      check,
-      agentName: tcc.agentName ?? undefined,
-      input: tcc.input,
-    },
+    payload,
     sessionApproval: SessionApproval.single(
       suggestion.surface,
       suggestion.pattern,
@@ -111,8 +104,6 @@ export function describeToolGate(
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
-      message: askMessage,
-      payload,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       sessionLabel: suggestion.label,
@@ -123,7 +114,6 @@ export function describeToolGate(
       source: "tool_call",
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
-      message: askMessage,
       ...permissionLogContext,
     },
     decision: {

package/src/handlers/tool-call-boundary.ts

@@ -1,6 +1,7 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { DecisionRecorder } from "#src/decision-audit";
 import type { DecisionReporter } from "#src/decision-reporter";
+import { createPermissionRequestId } from "#src/permission-request-id";
 import { toRecord } from "#src/value-guards";
 import type { GateOutcome } from "./gates/types";
 
@@ -53,18 +54,40 @@ export function createFailClosedToolCall(
         ? { block: true, reason: outcome.reason }
         : {};
     } catch (error) {
-      audit.recordError();
-      reporter.writeReviewLog("permission_request.blocked", {
-        toolName: bestEffortToolName(event),
-        command: bestEffortCommand(event),
-        resolution: "gate_error",
-        error: errorMessage(error),
-      });
+      recordGateError(reporter, audit, event, error);
       return { block: true, reason: formatGateErrorReason(error) };
     }
   };
 }
 
+/**
+ * Record a gate error without ever throwing.
+ *
+ * The block below this must be reached: the SDK does not catch a throwing
+ * handler, so an exception escaping the recording work would leave the command
+ * ungated. The request id is minted here rather than borrowed — the throw may
+ * have come from anywhere in the pipeline, so no gate's id is available.
+ */
+function recordGateError(
+  reporter: DecisionReporter,
+  audit: DecisionRecorder,
+  event: unknown,
+  error: unknown,
+): void {
+  try {
+    audit.recordError();
+    reporter.writeReviewLog("permission_request.blocked", {
+      requestId: createPermissionRequestId(),
+      toolName: bestEffortToolName(event),
+      command: bestEffortCommand(event),
+      resolution: "gate_error",
+      error: errorMessage(error),
+    });
+  } catch {
+    // The block is the guarantee; its bookkeeping is not.
+  }
+}
+
 // ── Defensive event readers (never throw) ──────────────────────────────────
 
 /** Best-effort tool name from a raw event; never throws. */

package/src/log-field-cap.ts

@@ -0,0 +1,82 @@
+/**
+ * The permission review log's width bound (ADR 0011 §6).
+ *
+ * The log renders the prompt payload under its own configured limits, and this
+ * is the limit: every string it writes is narrowed to a configured width. The
+ * bound is applied at `writeLine`, the single place a log line is produced, so
+ * a write path cannot be added that escapes it — the same discipline redaction
+ * already has there.
+ *
+ * A cap is not redaction, and the two must not be conflated
+ * (`docs/decisions/0010-permission-log-secret-exposure.md`). This narrows by
+ * length alone and never reads a value to decide what to shorten; redaction
+ * masks a value because of the key name it is bound to, and still does, so a
+ * sensitive-keyed value is masked whole however long it was.
+ */
+
+/**
+ * The width when the operator configures none.
+ *
+ * Not a new number: it is the bound that already governed `toolInputPreview`,
+ * promoted from one field to every field so the log has one limit rather than
+ * one limit and an unbounded remainder.
+ */
+export const DEFAULT_REVIEW_LOG_FIELD_MAX_WIDTH = 1000;
+
+/** The two-field shape this module reads off the extension config. */
+export interface ReviewLogWidthConfig {
+  readonly reviewLogFieldMaxWidth?: number;
+}
+
+/** The configured review-log field width, or the built-in default. */
+export function resolveReviewLogFieldWidth(
+  config: ReviewLogWidthConfig,
+): number {
+  return config.reviewLogFieldMaxWidth ?? DEFAULT_REVIEW_LOG_FIELD_MAX_WIDTH;
+}
+
+/**
+ * Narrow every string in a log-detail record to `maxWidth`.
+ *
+ * Recurses through plain objects and arrays so a nested detail is bounded too,
+ * and touches strings only — a number, a boolean, or a null passes through as
+ * it was. A shortened value is marked with a bare ellipsis, the same marker the
+ * dialog uses: a character count is a number the reader cannot act on
+ * (ADR 0011 §4).
+ */
+export function capLogFieldWidths<T>(details: T, maxWidth: number): T {
+  return capValue(details, maxWidth) as T;
+}
+
+function capValue(value: unknown, maxWidth: number): unknown {
+  if (typeof value === "string") {
+    return value.length <= maxWidth
+      ? value
+      : `${value.slice(0, maxWidth)}\u2026`;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => capValue(entry, maxWidth));
+  }
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        capValue(entry, maxWidth),
+      ]),
+    );
+  }
+  return value;
+}
+
+/**
+ * Whether a value is a record this cap should descend into.
+ *
+ * A class instance (a `Date`, an `Error`) is left alone: rebuilding it as a
+ * plain object would change what the writer serializes, and the cap's job is
+ * to shorten strings, not to reshape a value.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null) return false;
+  const prototype: unknown = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}

package/src/logging.ts

@@ -4,6 +4,7 @@ import {
   EXTENSION_ID,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
+import { capLogFieldWidths, resolveReviewLogFieldWidth } from "./log-field-cap";
 import {
   OWNER_ONLY_FILE_MODE,
   restrictExistingPathToOwner,
@@ -37,11 +38,20 @@ export function createPermissionSystemLogger(
   // re-invoked per session, unlike module scope, which now outlives one.
   const hardened = new Set<string>();
 
+  /**
+   * The only place a log line is produced.
+   *
+   * `maxFieldWidth` bounds every string the line carries; it is supplied for
+   * the review stream and withheld for the debug stream, which is opt-in and
+   * exists to be read in full. Capping happens before redaction, which masks
+   * by key name and so still masks a sensitive value whole.
+   */
   const writeLine = (
     stream: "debug" | "review",
     path: string,
     event: string,
     details: Record<string, unknown>,
+    maxFieldWidth?: number,
   ): string | undefined => {
     const directoryError = ensureLogsDirectory();
     if (directoryError) {
@@ -49,12 +59,16 @@ export function createPermissionSystemLogger(
     }
 
     try {
+      const bounded =
+        maxFieldWidth === undefined
+          ? details
+          : capLogFieldWidths(details, maxFieldWidth);
       const line = redactedJsonStringify({
         timestamp: new Date().toISOString(),
         extension: EXTENSION_ID,
         stream,
         event,
-        ...details,
+        ...bounded,
       });
       if (!line) {
         return `Failed to write permission-system ${stream} log '${path}': event could not be serialized.`;
@@ -89,11 +103,18 @@ export function createPermissionSystemLogger(
     event: string,
     details: Record<string, unknown> = {},
   ): string | undefined => {
-    if (!options.getConfig().permissionReviewLog) {
+    const config = options.getConfig();
+    if (!config.permissionReviewLog) {
       return undefined;
     }
 
-    return writeLine("review", reviewLogPath, event, details);
+    return writeLine(
+      "review",
+      reviewLogPath,
+      event,
+      details,
+      resolveReviewLogFieldWidth(config),
+    );
   };
 
   return { debug, review };

package/src/permission-events.ts

@@ -8,6 +8,8 @@
  * removed or renamed without a semver-major version bump.
  */
 
+import type { PromptRequestFacts } from "#src/presentation/prompt-payload";
+
 /** Minimal event bus interface required by the emit helpers. */
 export interface PermissionEventBus {
   emit(channel: string, data: unknown): void;
@@ -79,8 +81,19 @@ export interface PermissionUiPromptEvent {
   value: string | null;
   /** Agent name (when known). */
   agentName: string | null;
-  /** Message displayed to the user. */
-  message: string;
+  /**
+   * The ask's invariant core (ADR 0011 §3), verbatim from the prompt payload.
+   *
+   * Nested rather than flattened so the event and the payload share one shape:
+   * a fact added to `PromptRequestFacts` reaches the bus without a second
+   * hand-maintained declaration. Carries no evidence and no annotations — the
+   * bus is the narrowest renderer (ADR 0011 §6), observable by any loaded
+   * extension without the operator having named it.
+   *
+   * `request.surface` is the *gate* surface the rule fired on; the top-level
+   * `surface` is the display projection. Both are here on purpose.
+   */
+  request: PromptRequestFacts;
   /** Forwarding context, or null for a direct prompt. */
   forwarding: ForwardedPromptContext | null;
 }
@@ -101,6 +114,12 @@ export type PermissionDecisionResolution =
 
 /** Payload emitted on `permissions:decision`. */
 export interface PermissionDecisionEvent {
+  /**
+   * Identifies the permission request this decision resolves, minted when the
+   * request was created. Distinct from the host's tool-call id: one tool call
+   * runs several gates and so raises several requests.
+   */
+  requestId: string;
   /** Permission surface: "bash", "read", "mcp", "skill", "external_directory", etc. */
   surface: string;
   /** The value that was evaluated (command, tool name, skill name, path). */

package/src/permission-prompts.ts

@@ -1,8 +1,9 @@
 import { classifyToolKind } from "./access-intent/tool-kind";
 
-// NOTE: the ask prompts are now payload builders under src/presentation/;
-// denial text lives in denial-messages.ts. This module retains only the
-// pre-check reasons, which are agent-facing rather than user-facing.
+// NOTE: the ask prompts are now payload builders under src/presentation/, and
+// denial text is a render over the payload (presentation/agent-renderer.ts).
+// This module retains only the pre-check reasons, refused before any payload
+// exists to render.
 
 export function formatMissingToolNameReason(): string {
   return "Tool call was blocked because no tool name was provided. Use a registered tool name from pi.getAllTools().";

package/src/permission-request-id.ts

@@ -0,0 +1,17 @@
+import { randomUUID } from "node:crypto";
+
+/**
+ * Mint the identifier for one permission request, at the moment the request is
+ * created rather than at the moment it prompts.
+ *
+ * Distinct from the host's `toolCallId`, which keeps flowing alongside it as
+ * the join back to the Pi transcript: a single tool call runs several gates and
+ * therefore raises several permission requests, so the SDK's id cannot identify
+ * one of them.
+ *
+ * The `perm-` prefix keeps the id self-identifying in a review log that also
+ * carries SDK tool-call ids.
+ */
+export function createPermissionRequestId(): string {
+  return `perm-${randomUUID()}`;
+}

package/src/permission-session.ts

@@ -219,7 +219,7 @@ export class PermissionSession implements ToolCallGateInputs {
    * so the pipeline reads a clean value rather than pulling raw config.
    */
   getToolPreviewLimits(): ToolPreviewFormatterOptions {
-    return resolveToolPreviewLimits(this.config);
+    return resolveToolPreviewLimits();
   }
 
   /**

package/src/permission-ui-prompt.ts

@@ -11,6 +11,7 @@
  * prompter or forwarding modules (no import cycles, correct layering).
  */
 
+import type { PromptPayload } from "#src/presentation/prompt-payload";
 import type {
   ForwardedPromptContext,
   PermissionUiPromptEvent,
@@ -21,7 +22,8 @@ export interface DirectPromptInput {
   requestId: string;
   source: "tool_call" | "skill_input" | "skill_read";
   agentName: string | null;
-  message: string;
+  /** The ask's complete payload; the event carries its invariant core alone. */
+  payload: PromptPayload;
   toolName?: string;
   skillName?: string;
   path?: string;
@@ -62,7 +64,7 @@ export function buildUiPrompt(input: UiPromptInput): PermissionUiPromptEvent {
     surface: input.surface !== undefined ? input.surface : directSurface(input),
     value: input.value !== undefined ? input.value : directValue(input),
     agentName: input.agentName,
-    message: input.message,
+    request: input.payload.request,
     forwarding: input.forwarding ?? null,
   };
 }