@opengeni/contracts 0.19.0 → 0.19.4

package/dist/index.js

@@ -1737,6 +1737,261 @@ function sortJson(value) {
   return value;
 }
 
+// src/secret-redaction.ts
+var MIN_REDACTABLE_VALUE_LENGTH = 6;
+var REDACTED = "[redacted]";
+var MAX_REDACTION_DEPTH = 64;
+var CYCLE_MARKER = "[OpenGeni omitted cyclic value during secret redaction]";
+var DEPTH_MARKER = "[OpenGeni omitted value beyond secret-redaction depth]";
+var SENSITIVE_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxyauthorization",
+  "cookie",
+  "setcookie",
+  "accesstoken",
+  "refreshtoken",
+  "idtoken",
+  "apikey",
+  "secret",
+  "clientsecret",
+  "password",
+  "passwd",
+  "privatekey",
+  "credential",
+  "credentials",
+  "credentialencrypted",
+  "encryptedcredential",
+  "headersencrypted",
+  "encryptedpkceverifier",
+  "codeverifier",
+  "signingkey"
+]);
+var CREDENTIAL_HEADER_PATTERNS = [
+  /^(?:proxy-)?authorization$/i,
+  /^(?:set-)?cookie$/i,
+  /^(?:x[-_])?api[-_]?key$/i,
+  /^(?:x[-_])?(?:access|refresh|id)[-_]?token$/i,
+  /^(?:x[-_])?(?:auth|session)[-_]?(?:token|key|secret)$/i,
+  /^(?:x[-_])?(?:client|app|consumer)[-_]?secret$/i,
+  /^x-opengeni-access-key$/i
+];
+var SECRET_KEY_SOURCE = "(?:proxy[-_ ]?authorization|authorization|set[-_ ]?cookie|cookie|access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)";
+var UNQUOTED_SECRET_KEY_SOURCE = "(?:access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|api[-_ ]?key|client[-_ ]?secret|secret|password|passwd|private[-_ ]?key|credential(?:s|[-_ ]?encrypted)?|encrypted[-_ ]?credential|encrypted[-_ ]?pkce[-_ ]?verifier|code[-_ ]?verifier|signing[-_ ]?key)";
+var AUTHORIZATION_HEADER_PATTERN = /(\b(?:proxy-)?authorization[^\S\r\n]*:[^\S\r\n]*)([^\r\n'"`]+)/gi;
+var COOKIE_HEADER_PATTERN = /(\b(?:set-cookie|cookie)\s*:\s*)([^\r\n'"`]+)/gi;
+var API_KEY_HEADER_PATTERN = /(\b(?:x[-_])?api[-_]?key[^\S\r\n]*:[^\S\r\n]*)([^\r\n'"`]+)/gi;
+var CURL_USER_PATTERN = /((?:^|\s)(?:-u|--user)(?:=|\s+))(?:("[^"]*")|('[^']*')|([^\s]+))/gm;
+var URL_USERINFO_PATTERN = /(https?:\/\/)[^\s/@]+@/gi;
+var SIGNED_QUERY_PATTERN = new RegExp(
+  `([?&](?:sig|signature|x-amz-signature|x-amz-credential|x-amz-security-token|x-goog-signature|x-goog-credential|access_token|refresh_token|token)=)([^&#\\s'"<>]+)`,
+  "gi"
+);
+var QUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(
+  `((?:["']${SECRET_KEY_SOURCE}["']|\\b${SECRET_KEY_SOURCE})\\s*[:=]\\s*)(["'])(.*?)\\2`,
+  "gi"
+);
+var UNQUOTED_SECRET_ASSIGNMENT_PATTERN = new RegExp(
+  `((?:\\b${UNQUOTED_SECRET_KEY_SOURCE})\\s*[:=]\\s*)([^\\s,;}&]+)`,
+  "gi"
+);
+var SECRET_ENV_ASSIGNMENT_PATTERN = /((?:^|[\s;])(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|AUTHORIZATION|COOKIE)[A-Za-z0-9_]*\s*=\s*)(?:("[^"]*")|('[^']*')|([^\s;]+))/gim;
+var PROVIDER_TOKEN_PATTERNS = [
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,
+  /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+  /\bAIza[0-9A-Za-z_-]{30,}\b/g,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+  /\bogd_[A-Za-z0-9._~-]{10,}\b/g,
+  /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g
+];
+function isSensitiveFieldName(name) {
+  return SENSITIVE_FIELD_NAMES.has(normalizeFieldName(name));
+}
+function isCredentialHeaderName(name) {
+  return CREDENTIAL_HEADER_PATTERNS.some((pattern) => pattern.test(name));
+}
+function redactSensitiveKey(key, knownSecrets = []) {
+  return replacePreparedSecrets(key, prepareSecrets(knownSecrets));
+}
+function redactSensitiveText(text, knownSecrets = []) {
+  let redacted = replacePreparedSecrets(text, prepareSecrets(knownSecrets));
+  redacted = redacted.replace(
+    AUTHORIZATION_HEADER_PATTERN,
+    (match, prefix, rawValue) => {
+      const value = rawValue.trimEnd();
+      const trailingWhitespace = rawValue.slice(value.length);
+      const schemeMatch = value.match(/^([A-Za-z][A-Za-z0-9_-]*)(\s+)(.+)$/);
+      if (schemeMatch) {
+        const scheme = schemeMatch[1];
+        const whitespace = schemeMatch[2];
+        const credential = schemeMatch[3];
+        if (scheme && whitespace && credential) {
+          return isRedactionMarker(credential.trim()) ? match : `${prefix}${scheme}${whitespace}${REDACTED}${trailingWhitespace}`;
+        }
+      }
+      return isRedactionMarker(value) ? match : `${prefix}${REDACTED}${trailingWhitespace}`;
+    }
+  );
+  redacted = redacted.replace(COOKIE_HEADER_PATTERN, `$1${REDACTED}`);
+  redacted = redacted.replace(API_KEY_HEADER_PATTERN, `$1${REDACTED}`);
+  redacted = redacted.replace(CURL_USER_PATTERN, (_match, prefix) => {
+    return `${prefix}${REDACTED}`;
+  });
+  redacted = redacted.replace(URL_USERINFO_PATTERN, `$1${REDACTED}@`);
+  redacted = redacted.replace(SIGNED_QUERY_PATTERN, `$1${REDACTED}`);
+  redacted = redacted.replace(
+    QUOTED_SECRET_ASSIGNMENT_PATTERN,
+    (match, prefix, quote, value) => isRedactionMarker(value) ? match : `${prefix}${quote}${REDACTED}${quote}`
+  );
+  redacted = redacted.replace(
+    UNQUOTED_SECRET_ASSIGNMENT_PATTERN,
+    (match, prefix, value) => isRedactionMarker(value) ? match : `${prefix}${REDACTED}`
+  );
+  redacted = redacted.replace(
+    SECRET_ENV_ASSIGNMENT_PATTERN,
+    (match, prefix, doubleQuoted, singleQuoted, bare) => {
+      const value = doubleQuoted ?? singleQuoted ?? bare ?? "";
+      return isRedactionMarker(stripMatchingQuotes(value)) ? match : `${prefix}${REDACTED}`;
+    }
+  );
+  for (const pattern of PROVIDER_TOKEN_PATTERNS) {
+    redacted = redacted.replace(pattern, REDACTED);
+  }
+  return redacted;
+}
+function redactSensitiveData(value, knownSecrets = []) {
+  return redactSensitiveDataDeep(value, knownSecrets, /* @__PURE__ */ new WeakSet(), 0);
+}
+function createSecretRedactor(knownSecrets) {
+  const prepared = prepareSecrets(knownSecrets).map(({ marker, value }) => ({
+    name: marker.slice("[redacted:".length, -1),
+    value
+  }));
+  return (value) => redactSensitiveData(value, prepared);
+}
+function redactSerializedJson(serialized, knownSecrets = []) {
+  try {
+    return JSON.stringify(redactSensitiveData(JSON.parse(serialized), knownSecrets));
+  } catch {
+    return redactSensitiveText(serialized, knownSecrets);
+  }
+}
+function identityRedactor(value) {
+  return value;
+}
+function redactSensitiveDataDeep(value, knownSecrets, seen, depth) {
+  if (typeof value === "string") {
+    return redactSensitiveText(value, knownSecrets);
+  }
+  if (!value || typeof value !== "object" || value instanceof Date) {
+    return value;
+  }
+  if (depth >= MAX_REDACTION_DEPTH) {
+    return DEPTH_MARKER;
+  }
+  if (seen.has(value)) {
+    return CYCLE_MARKER;
+  }
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((item) => redactSensitiveDataDeep(item, knownSecrets, seen, depth + 1));
+    }
+    if (!isPlainObject(value)) {
+      return value;
+    }
+    const usedKeys = /* @__PURE__ */ new Set();
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => {
+        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);
+        if (isSensitiveFieldName(key)) {
+          return [safeKey, REDACTED];
+        }
+        if (normalizeFieldName(key) === "headers") {
+          return [safeKey, redactHeaderMap(child, knownSecrets, seen, depth + 1)];
+        }
+        return [safeKey, redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1)];
+      })
+    );
+  } finally {
+    seen.delete(value);
+  }
+}
+function redactHeaderMap(value, knownSecrets, seen, depth) {
+  if (!isPlainObject(value)) {
+    return redactSensitiveDataDeep(value, knownSecrets, seen, depth);
+  }
+  if (depth >= MAX_REDACTION_DEPTH) return DEPTH_MARKER;
+  if (seen.has(value)) return CYCLE_MARKER;
+  seen.add(value);
+  try {
+    const usedKeys = /* @__PURE__ */ new Set();
+    return Object.fromEntries(
+      Object.entries(value).map(([key, child]) => {
+        const safeKey = nextUniqueKey(redactSensitiveKey(key, knownSecrets), usedKeys);
+        return [
+          safeKey,
+          isCredentialHeaderName(key) ? REDACTED : redactSensitiveDataDeep(child, knownSecrets, seen, depth + 1)
+        ];
+      })
+    );
+  } finally {
+    seen.delete(value);
+  }
+}
+function prepareSecrets(knownSecrets) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const secret of knownSecrets) {
+    if (secret.value.length < MIN_REDACTABLE_VALUE_LENGTH || unique.has(secret.value)) {
+      continue;
+    }
+    unique.set(secret.value, `[redacted:${safeSecretName(secret.name)}]`);
+  }
+  return [...unique].map(([value, marker]) => ({ marker, value })).sort((a, b) => b.value.length - a.value.length || a.marker.localeCompare(b.marker));
+}
+function replacePreparedSecrets(text, prepared) {
+  let redacted = text;
+  for (const secret of prepared) {
+    if (redacted.includes(secret.value)) {
+      redacted = redacted.split(secret.value).join(secret.marker);
+    }
+  }
+  return redacted;
+}
+function nextUniqueKey(base, usedKeys) {
+  let candidate = base;
+  let suffix = 2;
+  while (usedKeys.has(candidate)) {
+    candidate = `${base}#${suffix}`;
+    suffix += 1;
+  }
+  usedKeys.add(candidate);
+  return candidate;
+}
+function safeSecretName(name) {
+  const safe = name.toUpperCase().replace(/[^A-Z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
+  return safe.slice(0, 64) || "KNOWN_SECRET";
+}
+function normalizeFieldName(name) {
+  return name.toLowerCase().replace(/[-_\s]/g, "");
+}
+function isPlainObject(value) {
+  if (!value || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function isRedactionMarker(value) {
+  return /^\[redacted(?::[A-Z0-9_]{1,64})?\]$/.test(value);
+}
+function stripMatchingQuotes(value) {
+  if (value.length >= 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+
 // src/index.ts
 var SessionStatus = z2.enum([
   "queued",
@@ -2107,8 +2362,10 @@ var ErrorCode = z2.enum([
 ]);
 var ErrorEnvelope = z2.object({
   error: z2.object({
+    status: z2.number().int().min(400).max(599),
     code: ErrorCode,
     message: z2.string(),
+    retryable: z2.boolean(),
     requestId: z2.string().optional(),
     details: z2.record(z2.string(), z2.unknown()).optional()
   })
@@ -3224,6 +3481,22 @@ var KnowledgeSourceKind = z2.enum([
   "other"
 ]);
 var DocumentSearchMode = z2.enum(["hybrid", "vector", "keyword"]);
+var DocumentVisibility = z2.enum(["workspace", "private"]);
+var DocumentCurationStatus = z2.enum([
+  "none",
+  "pending",
+  "suggested",
+  "auto_filed",
+  "failed"
+]);
+var DocumentCuration = z2.object({
+  suggestedBaseId: z2.string().uuid().nullable(),
+  suggestedBaseName: z2.string().nullable(),
+  confidence: z2.number().min(0).max(1),
+  reason: z2.string().nullable(),
+  originalTitle: z2.string().nullable(),
+  model: z2.string().nullable()
+});
 var DocumentBase = z2.object({
   id: z2.string().uuid(),
   workspaceId: z2.string().uuid(),
@@ -3251,6 +3524,13 @@ var Document = z2.object({
   sourceUpdatedAt: z2.string().nullable(),
   sourceVersion: z2.string().nullable(),
   aclTags: z2.array(z2.string()),
+  visibility: DocumentVisibility,
+  createdBy: z2.string().nullable(),
+  agentAccess: z2.boolean(),
+  summary: z2.string().nullable(),
+  topics: z2.array(z2.string()),
+  curationStatus: DocumentCurationStatus,
+  curation: DocumentCuration.nullable(),
   createdAt: z2.string(),
   updatedAt: z2.string()
 });
@@ -3293,7 +3573,22 @@ var AddDocumentRequest = z2.object({
   sourceCreatedAt: z2.string().datetime({ offset: true }).optional(),
   sourceUpdatedAt: z2.string().datetime({ offset: true }).optional(),
   sourceVersion: z2.string().min(1).optional(),
-  aclTags: z2.array(z2.string().min(1)).optional()
+  aclTags: z2.array(z2.string().min(1)).optional(),
+  visibility: DocumentVisibility.optional(),
+  agentAccess: z2.boolean().optional()
+});
+var CreateKnowledgeDropRequest = z2.object({
+  text: z2.string().min(1).max(2e6).optional(),
+  fileId: z2.string().uuid().optional(),
+  filename: z2.string().min(1).optional(),
+  title: z2.string().min(1).optional(),
+  visibility: DocumentVisibility.optional(),
+  agentAccess: z2.boolean().optional()
+}).refine((value) => value.text === void 0 !== (value.fileId === void 0), {
+  message: "provide exactly one of text or fileId"
+});
+var MoveDocumentRequest = z2.object({
+  targetBaseId: z2.string().uuid().optional()
 });
 var DocumentSearchRequest = z2.object({
   query: z2.string().min(1),
@@ -3698,6 +3993,17 @@ var UpdateSessionGoalRequest = z2.object({
 var UpdateSessionRequest = z2.object({
   title: z2.string().min(1).max(200)
 });
+var UpdateSessionToolPolicyRequest = z2.union([
+  z2.object({
+    mode: z2.literal("workspace_default"),
+    expectedVersion: z2.number().int().positive()
+  }).strict(),
+  z2.object({
+    mode: z2.literal("explicit").optional(),
+    tools: z2.array(ToolRef).max(64),
+    expectedVersion: z2.number().int().positive()
+  }).strict()
+]);
 var UpdateSessionPinRequest = z2.object({
   pinned: z2.boolean(),
   expectedVersion: z2.number().int().nonnegative().optional()
@@ -3771,6 +4077,7 @@ var SessionAuthorizationOperation = z2.enum([
   "session.human_input.write",
   "session.title.write",
   "session.mcp.approval_policy.write",
+  "session.tool_policy.write",
   "session.goal.read",
   "session.goal.write",
   "session.child.create"
@@ -3982,6 +4289,8 @@ var NewSessionDraft = z2.object({
   text: z2.string(),
   resources: z2.array(ResourceRef),
   tools: z2.array(ToolRef),
+  /** False means the workspace-default MCP policy is still inherited. */
+  toolsProvided: z2.boolean().default(false),
   model: z2.string().min(1),
   reasoningEffort: ReasoningEffort,
   options: NewSessionDraftOptions,
@@ -3991,6 +4300,7 @@ var SaveNewSessionDraftRequest = NewSessionDraft.pick({
   text: true,
   resources: true,
   tools: true,
+  toolsProvided: true,
   model: true,
   reasoningEffort: true,
   options: true
@@ -4941,6 +5251,10 @@ var Session = z2.object({
   // Origin of the persisted tool allow-list. Optional for rolling client
   // compatibility; current servers emit it and legacy rows map to `legacy`.
   toolPolicy: SessionToolPolicy.optional(),
+  // Optimistic-concurrency fence for durable policy mutations. Optional for
+  // older clients/fixtures; current servers always emit the authoritative
+  // value.
+  toolPolicyVersion: z2.number().int().positive().optional(),
   // Secret-safe current resolution, computed at an API/read or execution
   // boundary from IDs only. Optional because internal DB readers need not load
   // the workspace runtime registry.
@@ -5170,6 +5484,7 @@ var SessionEventType = z2.enum([
   // PTY session ended (exitCode/reason)
   "session.title_set",
   "session.mcp.approval_policy.updated",
+  "session.tool_policy.updated",
   // Multi-account Codex (P1): the account a session's turn runs on changed
   // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives
   // the in-session "Running on:" indicator's live flip.
@@ -5310,7 +5625,8 @@ var SESSION_EVENT_SEMANTIC_CLASS_TYPES = {
     "workspace.inference.resumed",
     "session.queue.changed",
     "session.queue.prompt.cancelled",
-    "session.mcp.approval_policy.updated"
+    "session.mcp.approval_policy.updated",
+    "session.tool_policy.updated"
   ],
   terminal: [
     "turn.completed",
@@ -6892,10 +7208,14 @@ var GitHubRepository = z2.object({
   accountType: z2.string().nullable()
 });
 var GitHubRepositoryScope = z2.enum(["all", "selected"]);
+var GitHubBindingStatus = z2.enum(["disabled", "unbound", "bound"]);
+var GitHubInstallationLifecycle = z2.enum(["active", "suspended", "deleted", "unverified"]);
 var GitHubInstallationBinding = z2.object({
   installationId: z2.number().int().positive(),
+  githubAccountId: z2.number().int().positive().nullable(),
   accountLogin: z2.string().nullable(),
   accountType: z2.string().nullable(),
+  lifecycle: GitHubInstallationLifecycle,
   repositoryScope: GitHubRepositoryScope,
   repositoryCount: z2.number().int().nonnegative(),
   createdAt: z2.string(),
@@ -6903,6 +7223,7 @@ var GitHubInstallationBinding = z2.object({
 });
 var GitHubAppInfo = z2.object({
   configured: z2.boolean(),
+  status: GitHubBindingStatus,
   appId: z2.string().nullable(),
   clientId: z2.string().nullable(),
   appSlug: z2.string().nullable(),
@@ -7568,6 +7889,7 @@ var WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(
 );
 var OPENGENI_API_CONTRACT_REVISION = "2026-07-turn-instructions-v1";
 var OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract";
+var OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id";
 var ClientConfig = /* @__PURE__ */ defineModelContractSchema(
   () => z2.object({
     deploymentRevision: z2.string(),
@@ -7707,6 +8029,7 @@ export {
   CreateDocumentBaseRequest,
   CreateFileUploadRequest,
   CreateFileUploadResponse,
+  CreateKnowledgeDropRequest,
   CreateKnowledgeMemoryRequest,
   CreateRigRequest,
   CreateScheduledTaskRequest,
@@ -7738,10 +8061,13 @@ export {
   DiscoverMcpCapabilitiesResponse,
   Document,
   DocumentBase,
+  DocumentCuration,
+  DocumentCurationStatus,
   DocumentSearchMode,
   DocumentSearchRequest,
   DocumentSearchResult,
   DocumentStatus,
+  DocumentVisibility,
   EditSessionQueueItemRequest,
   EffectiveControlBlocker,
   EffectiveControlResumeOption,
@@ -7801,7 +8127,9 @@ export {
   GitFileStatusCode,
   GitHubAppInfo,
   GitHubAppManifestCreate,
+  GitHubBindingStatus,
   GitHubInstallationBinding,
+  GitHubInstallationLifecycle,
   GitHubRepositoriesResponse,
   GitHubRepository,
   GitHubRepositoryScope,
@@ -7864,6 +8192,7 @@ export {
   ModelCredentialSourceV1,
   ModelPricingScheduleV1,
   ModelPricingV1,
+  MoveDocumentRequest,
   MoveSessionQueueItemRequest,
   NestedAgentDepthAttemptValue,
   NestedAgentDepthPolicySource,
@@ -7874,6 +8203,7 @@ export {
   OAuthStartResponse,
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION,
+  OPENGENI_CORRELATION_HEADER,
   OPENGENI_HOST_EXPORT_SCHEMA_REVISION,
   PackInstallation,
   PackInstallationStatus,
@@ -8055,6 +8385,7 @@ export {
   UpdateSessionMcpApprovalPolicyResponse,
   UpdateSessionPinRequest,
   UpdateSessionRequest,
+  UpdateSessionToolPolicyRequest,
   UpdateVariableSetRequest,
   UpdateWorkspaceEnvironmentRequest,
   UpdateWorkspaceMemberRequest,
@@ -8111,13 +8442,17 @@ export {
   compactSessionEventResult,
   compareCodexFleetCanonicalStringsV1,
   createCodexFleetReplayRecordV1,
+  createSecretRedactor,
   defaultRepositoryMountPath,
   effectiveCodexFleetCacheStateV1,
   evaluateCodexFleetDecisionV1,
   evaluateWorkspaceModelPolicy,
   gitCredentialBindingIdForRepository,
   gitCredentialProviderForRepository,
+  identityRedactor,
   isClearedRunStateBlob,
+  isCredentialHeaderName,
+  isSensitiveFieldName,
   measureSessionEventJson,
   mergeResourceRefs,
   mergeToolRefs,
@@ -8128,6 +8463,10 @@ export {
   readCodexFleetReplayRecordV1,
   readTurnExecutionPolicyV1,
   reasoningEffortForMetadata,
+  redactSensitiveData,
+  redactSensitiveKey,
+  redactSensitiveText,
+  redactSerializedJson,
   replayCodexFleetDecisionV1,
   resolveRetainedOutputRange,
   resolveSessionEventTypeFilters,