[export] Fix visibility rules

COPYBARA_INTEGRATE_REVIEW=https://github.com/grpc/grpc/pull/36216 from drfloob:conceal-core-cred-creation a44a299273
FUTURE_COPYBARA_INTEGRATE_REVIEW=https://github.com/grpc/grpc/pull/36216 from drfloob:conceal-core-cred-creation a44a299273

----
DO NOT SUBMIT. This PR is for testing purposes only. [cl/625436677](http://cl/625436677) [cl/625425746](http://cl/625425746) [cl/625390977](http://cl/625390977) [cl/625347240](http://cl/625347240)

PiperOrigin-RevId: 625436677

BUILD

@@ -1243,6 +1243,7 @@ grpc_cc_library(
         "gpr",
         "grpc++_base_unsecure",
         "grpc++_codegen_proto",
+        "grpc_core_credentials_header",
         "grpc_public_hdrs",
         "grpc_security_base",
         "grpc_unsecure",
@@ -2267,6 +2268,7 @@ grpc_cc_library(
         "exec_ctx",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_public_hdrs",
         "grpc_trace",
         "handshaker",
@@ -2328,6 +2330,14 @@ grpc_cc_library(
     ],
 )
 
+# TODO(hork): split credentials types into their own source files and targets.
+grpc_cc_library(
+    name = "grpc_core_credentials_header",
+    hdrs = ["include/grpc/credentials.h"],
+    language = "c++",
+    visibility = ["@grpc:core_credentials"],
+)
+
 grpc_cc_library(
     name = "alts_util",
     srcs = [
@@ -2355,6 +2365,7 @@ grpc_cc_library(
     deps = [
         "alts_upb",
         "gpr",
+        "grpc_core_credentials_header",
         "grpc_public_hdrs",
     ],
 )
@@ -2428,6 +2439,7 @@ grpc_cc_library(
         "grpc",
         "grpc++_codegen_proto",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_credentials_util",
         "grpc_health_upb",
         "grpc_public_hdrs",
@@ -2509,6 +2521,7 @@ grpc_cc_library(
         "exec_ctx",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_health_upb",
         "grpc_public_hdrs",
         "grpc_security_base",
@@ -3860,6 +3873,7 @@ grpc_cc_library(
         "exec_ctx",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_public_hdrs",
         "grpc_security_base",
         "handshaker",
@@ -3929,6 +3943,7 @@ grpc_cc_library(
         "exec_ctx",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_credentials_util",
         "grpc_security_base",
         "grpc_trace",
@@ -4017,6 +4032,7 @@ grpc_cc_library(
         "exec_ctx",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_security_base",
         "tsi_alts_frame_protector",
         "tsi_base",
@@ -4134,6 +4150,7 @@ grpc_cc_library(
         "config_vars",
         "gpr",
         "grpc_base",
+        "grpc_core_credentials_header",
         "grpc_credentials_util",
         "grpc_public_hdrs",
         "grpc_security_base",

CMakeLists.txt

@@ -2694,6 +2694,7 @@ foreach(_hdr
   include/grpc/byte_buffer_reader.h
   include/grpc/census.h
   include/grpc/compression.h
+  include/grpc/credentials.h
   include/grpc/event_engine/endpoint_config.h
   include/grpc/event_engine/event_engine.h
   include/grpc/event_engine/extensible.h
@@ -3395,6 +3396,7 @@ foreach(_hdr
   include/grpc/byte_buffer_reader.h
   include/grpc/census.h
   include/grpc/compression.h
+  include/grpc/credentials.h
   include/grpc/event_engine/endpoint_config.h
   include/grpc/event_engine/event_engine.h
   include/grpc/event_engine/extensible.h
@@ -5452,6 +5454,7 @@ foreach(_hdr
   include/grpc/byte_buffer.h
   include/grpc/byte_buffer_reader.h
   include/grpc/compression.h
+  include/grpc/credentials.h
   include/grpc/event_engine/endpoint_config.h
   include/grpc/event_engine/event_engine.h
   include/grpc/event_engine/extensible.h

Makefile

@@ -1728,6 +1728,7 @@ PUBLIC_HEADERS_C += \
     include/grpc/byte_buffer_reader.h \
     include/grpc/census.h \
     include/grpc/compression.h \
+    include/grpc/credentials.h \
     include/grpc/event_engine/endpoint_config.h \
     include/grpc/event_engine/event_engine.h \
     include/grpc/event_engine/extensible.h \

Package.swift

@@ -45,6 +45,7 @@ let package = Package(
         "include/grpc/byte_buffer_reader.h",
         "include/grpc/census.h",
         "include/grpc/compression.h",
+        "include/grpc/credentials.h",
         "include/grpc/event_engine/endpoint_config.h",
         "include/grpc/event_engine/event_engine.h",
         "include/grpc/event_engine/extensible.h",

bazel/grpc_build_system.bzl

@@ -102,6 +102,7 @@ def _update_visibility(visibility):
         "chaotic_good": PRIVATE,
         "client_channel": PRIVATE,
         "cli": PRIVATE,
+        "core_credentials": PRIVATE,
         "debug_location": PRIVATE,
         "endpoint_tests": PRIVATE,
         "exec_ctx": PRIVATE,
@@ -116,6 +117,7 @@ def _update_visibility(visibility):
         "iomgr_internal_errqueue": PRIVATE,
         "iomgr_buffer_list": PRIVATE,
         "json_reader_legacy": PRIVATE,
+        "otel_plugin": PRIVATE,
         "public": PUBLIC,
         "ref_counted_ptr": PRIVATE,
         "tcp_tracer": PRIVATE,

build_autogenerated.yaml

@@ -149,6 +149,7 @@ libs:
   - include/grpc/byte_buffer_reader.h
   - include/grpc/census.h
   - include/grpc/compression.h
+  - include/grpc/credentials.h
   - include/grpc/event_engine/endpoint_config.h
   - include/grpc/event_engine/event_engine.h
   - include/grpc/event_engine/extensible.h
@@ -2136,6 +2137,7 @@ libs:
   - include/grpc/byte_buffer_reader.h
   - include/grpc/census.h
   - include/grpc/compression.h
+  - include/grpc/credentials.h
   - include/grpc/event_engine/endpoint_config.h
   - include/grpc/event_engine/event_engine.h
   - include/grpc/event_engine/extensible.h
@@ -4321,6 +4323,7 @@ libs:
   - include/grpc/byte_buffer.h
   - include/grpc/byte_buffer_reader.h
   - include/grpc/compression.h
+  - include/grpc/credentials.h
   - include/grpc/event_engine/endpoint_config.h
   - include/grpc/event_engine/event_engine.h
   - include/grpc/event_engine/extensible.h

gRPC-Core.podspec

@@ -119,6 +119,7 @@ Pod::Spec.new do |s|
                       'include/grpc/byte_buffer_reader.h',
                       'include/grpc/census.h',
                       'include/grpc/compression.h',
+                      'include/grpc/credentials.h',
                       'include/grpc/event_engine/endpoint_config.h',
                       'include/grpc/event_engine/event_engine.h',
                       'include/grpc/event_engine/extensible.h',

grpc.def

@@ -19,6 +19,70 @@ EXPORTS
     grpc_compression_options_enable_algorithm
     grpc_compression_options_disable_algorithm
     grpc_compression_options_is_algorithm_enabled
+    grpc_service_account_jwt_access_credentials_create
+    grpc_external_account_credentials_create
+    grpc_google_refresh_token_credentials_create
+    grpc_access_token_credentials_create
+    grpc_google_iam_credentials_create
+    grpc_sts_credentials_create
+    grpc_auth_metadata_context_copy
+    grpc_auth_metadata_context_reset
+    grpc_metadata_credentials_create_from_plugin
+    grpc_call_credentials_release
+    grpc_google_default_credentials_create
+    grpc_ssl_server_certificate_config_create
+    grpc_ssl_server_certificate_config_destroy
+    grpc_ssl_credentials_create
+    grpc_ssl_credentials_create_ex
+    grpc_ssl_server_credentials_create
+    grpc_ssl_server_credentials_create_ex
+    grpc_ssl_server_credentials_create_options_using_config
+    grpc_ssl_server_credentials_create_options_using_config_fetcher
+    grpc_ssl_server_credentials_options_destroy
+    grpc_ssl_server_credentials_create_with_options
+    grpc_server_credentials_set_auth_metadata_processor
+    grpc_composite_call_credentials_create
+    grpc_google_compute_engine_credentials_create
+    grpc_composite_channel_credentials_create
+    grpc_alts_credentials_client_options_create
+    grpc_alts_credentials_server_options_create
+    grpc_alts_credentials_client_options_add_target_service_account
+    grpc_alts_credentials_options_destroy
+    grpc_alts_credentials_create
+    grpc_alts_server_credentials_create
+    grpc_tls_identity_pairs_create
+    grpc_tls_identity_pairs_add_pair
+    grpc_tls_identity_pairs_destroy
+    grpc_tls_certificate_provider_static_data_create
+    grpc_tls_certificate_provider_file_watcher_create
+    grpc_tls_certificate_provider_release
+    grpc_tls_credentials_options_create
+    grpc_tls_credentials_options_set_min_tls_version
+    grpc_tls_credentials_options_set_max_tls_version
+    grpc_tls_credentials_options_copy
+    grpc_tls_credentials_options_destroy
+    grpc_tls_credentials_options_set_certificate_provider
+    grpc_tls_credentials_options_watch_root_certs
+    grpc_tls_credentials_options_set_root_cert_name
+    grpc_tls_credentials_options_watch_identity_key_cert_pairs
+    grpc_tls_credentials_options_set_identity_cert_name
+    grpc_tls_credentials_options_set_cert_request_type
+    grpc_tls_credentials_options_set_crl_directory
+    grpc_tls_credentials_options_set_verify_server_cert
+    grpc_tls_credentials_options_set_send_client_ca_list
+    grpc_ssl_session_cache_create_lru
+    grpc_ssl_session_cache_destroy
+    grpc_ssl_session_cache_create_channel_arg
+    grpc_set_ssl_roots_override_callback
+    grpc_max_auth_token_lifetime
+    grpc_insecure_credentials_create
+    grpc_insecure_server_credentials_create
+    grpc_xds_credentials_create
+    grpc_xds_server_credentials_create
+    grpc_local_credentials_create
+    grpc_local_server_credentials_create
+    grpc_tls_credentials_options_set_check_call_host
+    grpc_tls_credentials_options_set_tls_session_key_log_file_path
     grpc_metadata_array_init
     grpc_metadata_array_destroy
     grpc_call_details_init
@@ -64,6 +128,7 @@ EXPORTS
     grpc_call_failed_before_recv_message
     grpc_call_ref
     grpc_call_unref
+    grpc_call_set_credentials
     grpc_server_request_call
     grpc_server_register_method
     grpc_server_request_registered_call
@@ -110,74 +175,9 @@ EXPORTS
     grpc_auth_context_add_property
     grpc_auth_context_add_cstring_property
     grpc_auth_context_set_peer_identity_property_name
-    grpc_ssl_session_cache_create_lru
-    grpc_ssl_session_cache_destroy
-    grpc_ssl_session_cache_create_channel_arg
-    grpc_call_credentials_release
-    grpc_google_default_credentials_create
-    grpc_set_ssl_roots_override_callback
-    grpc_ssl_credentials_create
-    grpc_ssl_credentials_create_ex
-    grpc_composite_channel_credentials_create
-    grpc_composite_call_credentials_create
-    grpc_google_compute_engine_credentials_create
-    grpc_max_auth_token_lifetime
-    grpc_service_account_jwt_access_credentials_create
-    grpc_external_account_credentials_create
-    grpc_google_refresh_token_credentials_create
-    grpc_access_token_credentials_create
-    grpc_google_iam_credentials_create
-    grpc_sts_credentials_create
-    grpc_auth_metadata_context_copy
-    grpc_auth_metadata_context_reset
-    grpc_metadata_credentials_create_from_plugin
-    grpc_ssl_server_certificate_config_create
-    grpc_ssl_server_certificate_config_destroy
-    grpc_ssl_server_credentials_create
-    grpc_ssl_server_credentials_create_ex
-    grpc_ssl_server_credentials_create_options_using_config
-    grpc_ssl_server_credentials_create_options_using_config_fetcher
-    grpc_ssl_server_credentials_options_destroy
-    grpc_ssl_server_credentials_create_with_options
-    grpc_call_set_credentials
-    grpc_server_credentials_set_auth_metadata_processor
-    grpc_alts_credentials_client_options_create
-    grpc_alts_credentials_server_options_create
-    grpc_alts_credentials_client_options_add_target_service_account
-    grpc_alts_credentials_options_destroy
-    grpc_alts_credentials_create
-    grpc_alts_server_credentials_create
-    grpc_local_credentials_create
-    grpc_local_server_credentials_create
-    grpc_tls_identity_pairs_create
-    grpc_tls_identity_pairs_add_pair
-    grpc_tls_identity_pairs_destroy
-    grpc_tls_certificate_provider_static_data_create
-    grpc_tls_certificate_provider_file_watcher_create
-    grpc_tls_certificate_provider_release
-    grpc_tls_credentials_options_create
-    grpc_tls_credentials_options_set_min_tls_version
-    grpc_tls_credentials_options_set_max_tls_version
-    grpc_tls_credentials_options_copy
-    grpc_tls_credentials_options_destroy
-    grpc_tls_credentials_options_set_certificate_provider
-    grpc_tls_credentials_options_watch_root_certs
-    grpc_tls_credentials_options_set_root_cert_name
-    grpc_tls_credentials_options_watch_identity_key_cert_pairs
-    grpc_tls_credentials_options_set_identity_cert_name
-    grpc_tls_credentials_options_set_cert_request_type
-    grpc_tls_credentials_options_set_crl_directory
-    grpc_tls_credentials_options_set_verify_server_cert
-    grpc_tls_credentials_options_set_send_client_ca_list
-    grpc_tls_credentials_options_set_check_call_host
-    grpc_insecure_credentials_create
-    grpc_insecure_server_credentials_create
-    grpc_xds_credentials_create
-    grpc_xds_server_credentials_create
     grpc_authorization_policy_provider_static_data_create
     grpc_authorization_policy_provider_file_watcher_create
     grpc_authorization_policy_provider_release
-    grpc_tls_credentials_options_set_tls_session_key_log_file_path
     grpc_slice_ref
     grpc_slice_unref
     grpc_slice_copy

grpc.gemspec

@@ -51,6 +51,7 @@ Gem::Specification.new do |s|
   s.files += %w( include/grpc/byte_buffer_reader.h )
   s.files += %w( include/grpc/census.h )
   s.files += %w( include/grpc/compression.h )
+  s.files += %w( include/grpc/credentials.h )
   s.files += %w( include/grpc/event_engine/endpoint_config.h )
   s.files += %w( include/grpc/event_engine/event_engine.h )
   s.files += %w( include/grpc/event_engine/extensible.h )

include/grpc/grpc.h

@@ -361,6 +361,13 @@ GRPCAPI void grpc_call_ref(grpc_call* call);
     THREAD SAFETY: grpc_call_unref is thread-compatible */
 GRPCAPI void grpc_call_unref(grpc_call* call);
 
+typedef struct grpc_call_credentials grpc_call_credentials;
+
+/** Sets a credentials to a call. Can only be called on the client side before
+   grpc_call_start_batch. */
+GRPCAPI grpc_call_error grpc_call_set_credentials(grpc_call* call,
+                                                  grpc_call_credentials* creds);
+
 /** Request notification of a new call.
     Once a call is received, a notification tagged with \a tag_new is added to
     \a cq_for_notification. \a call, \a details and \a request_metadata are

include/grpc/grpc_crl_provider.h

@@ -25,6 +25,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 

include/grpc/module.modulemap

@@ -6,6 +6,7 @@ header "byte_buffer.h"
   header "byte_buffer_reader.h"
   header "census.h"
   header "compression.h"
+  header "credentials.h"
   header "fork.h"
   header "grpc.h"
   header "grpc_audit_logging.h"

include/grpcpp/security/tls_certificate_provider.h

@@ -20,6 +20,7 @@
 #include <memory>
 #include <vector>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/status.h>

package.xml

@@ -33,6 +33,7 @@
     <file baseinstalldir="/" name="include/grpc/byte_buffer_reader.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/census.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/compression.h" role="src" />
+    <file baseinstalldir="/" name="include/grpc/credentials.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/event_engine/endpoint_config.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/event_engine/event_engine.h" role="src" />
     <file baseinstalldir="/" name="include/grpc/event_engine/extensible.h" role="src" />

src/core/BUILD

@@ -3655,6 +3655,7 @@ grpc_cc_library(
         "validation_errors",
         "//:alts_util",
         "//:gpr",
+        "//:grpc_core_credentials_header",
         "//:ref_counted_ptr",
     ],
 )
@@ -3808,6 +3809,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:handshaker",
         "//:iomgr",
@@ -3846,6 +3848,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:handshaker",
         "//:iomgr",
@@ -3905,6 +3908,7 @@ grpc_cc_library(
         "//:gpr",
         "//:grpc_base",
         "//:grpc_client_channel",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:handshaker",
         "//:iomgr",
@@ -3948,6 +3952,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:grpc_trace",
         "//:handshaker",
@@ -4004,6 +4009,7 @@ grpc_cc_library(
         "//:gpr",
         "//:grpc_alts_credentials",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_jwt_credentials",
         "//:grpc_public_hdrs",
         "//:grpc_security_base",
@@ -4078,6 +4084,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_credentials_util",
         "//:grpc_public_hdrs",
         "//:grpc_security_base",
@@ -4117,6 +4124,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:grpc_trace",
         "//:promise",
@@ -4164,6 +4172,7 @@ grpc_cc_library(
         "//:api_trace",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_credentials_util",
         "//:grpc_security_base",
         "//:grpc_trace",
@@ -4219,6 +4228,7 @@ grpc_cc_library(
         "time",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_credentials_util",
         "//:grpc_security_base",
         "//:httpcli",
@@ -4255,6 +4265,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:handshaker",
         "//:iomgr",
@@ -5143,6 +5154,7 @@ grpc_cc_library(
         "//:gpr",
         "//:grpc_base",
         "//:grpc_client_channel",
+        "//:grpc_core_credentials_header",
         "//:grpc_credentials_util",
         "//:grpc_public_hdrs",
         "//:grpc_security_base",
@@ -5222,6 +5234,7 @@ grpc_cc_library(
         "//:exec_ctx",
         "//:gpr",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_public_hdrs",
         "//:grpc_security_base",
         "//:grpc_service_config_impl",
@@ -5256,6 +5269,7 @@ grpc_cc_library(
         "//:config",
         "//:gpr",
         "//:gpr_platform",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:ref_counted_ptr",
     ],
@@ -6966,6 +6980,7 @@ grpc_cc_library(
         "//:gpr",
         "//:gpr_platform",
         "//:grpc_base",
+        "//:grpc_core_credentials_header",
         "//:grpc_security_base",
         "//:grpc_trace",
         "//:httpcli",

src/core/ext/filters/backend_metrics/backend_metric_filter.cc

@@ -25,6 +25,7 @@
 #include <utility>
 
 #include "absl/strings/string_view.h"
+#include "third_party/grpc/src/core/lib/channel/promise_based_filter.h"
 #include "upb/base/string_view.h"
 #include "upb/mem/arena.hpp"
 #include "xds/data/orca/v3/orca_load_report.upb.h"
@@ -121,9 +122,9 @@ const grpc_channel_filter BackendMetricFilter::kFilter =
     MakePromiseBasedFilter<BackendMetricFilter, FilterEndpoint::kServer>(
         "backend_metric");
 
-absl::StatusOr<BackendMetricFilter> BackendMetricFilter::Create(
-    const ChannelArgs&, ChannelFilter::Args) {
-  return BackendMetricFilter();
+absl::StatusOr<std::unique_ptr<BackendMetricFilter>>
+BackendMetricFilter::Create(const ChannelArgs&, ChannelFilter::Args) {
+  return std::make_unique<BackendMetricFilter>();
 }
 
 void BackendMetricFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {

src/core/ext/filters/backend_metrics/backend_metric_filter.h

@@ -35,8 +35,8 @@ class BackendMetricFilter : public ImplementChannelFilter<BackendMetricFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<BackendMetricFilter> Create(const ChannelArgs& args,
-                                                    ChannelFilter::Args);
+  static absl::StatusOr<std::unique_ptr<BackendMetricFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
 
   class Call {
    public:

src/core/ext/filters/channel_idle/legacy_channel_idle_filter.cc

@@ -25,6 +25,7 @@
 #include "absl/base/thread_annotations.h"
 #include "absl/meta/type_traits.h"
 #include "absl/random/random.h"
+#include "absl/status/statusor.h"
 #include "absl/types/optional.h"
 
 #include <grpc/impl/channel_arg_names.h>
@@ -133,18 +134,17 @@ struct LegacyMaxAgeFilter::Config {
 // will be removed at that time also, so just disable the deprecation warning
 // for now.
 ABSL_INTERNAL_DISABLE_DEPRECATED_DECLARATION_WARNING
-absl::StatusOr<LegacyClientIdleFilter> LegacyClientIdleFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args filter_args) {
-  LegacyClientIdleFilter filter(filter_args.channel_stack(),
-                                GetClientIdleTimeout(args));
-  return absl::StatusOr<LegacyClientIdleFilter>(std::move(filter));
+absl::StatusOr<std::unique_ptr<LegacyClientIdleFilter>>
+LegacyClientIdleFilter::Create(const ChannelArgs& args,
+                               ChannelFilter::Args filter_args) {
+  return std::make_unique<LegacyClientIdleFilter>(filter_args.channel_stack(),
+                                                  GetClientIdleTimeout(args));
 }
 
-absl::StatusOr<LegacyMaxAgeFilter> LegacyMaxAgeFilter::Create(
+absl::StatusOr<std::unique_ptr<LegacyMaxAgeFilter>> LegacyMaxAgeFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args filter_args) {
-  LegacyMaxAgeFilter filter(filter_args.channel_stack(),
-                            Config::FromChannelArgs(args));
-  return absl::StatusOr<LegacyMaxAgeFilter>(std::move(filter));
+  return std::make_unique<LegacyMaxAgeFilter>(filter_args.channel_stack(),
+                                              Config::FromChannelArgs(args));
 }
 ABSL_INTERNAL_RESTORE_DEPRECATED_DECLARATION_WARNING
 

src/core/ext/filters/channel_idle/legacy_channel_idle_filter.h

@@ -42,6 +42,11 @@ namespace grpc_core {
 
 class LegacyChannelIdleFilter : public ChannelFilter {
  public:
+  LegacyChannelIdleFilter(grpc_channel_stack* channel_stack,
+                          Duration client_idle_timeout)
+      : channel_stack_(channel_stack),
+        client_idle_timeout_(client_idle_timeout) {}
+
   ~LegacyChannelIdleFilter() override = default;
 
   LegacyChannelIdleFilter(const LegacyChannelIdleFilter&) = delete;
@@ -59,11 +64,6 @@ class LegacyChannelIdleFilter : public ChannelFilter {
   using SingleSetActivityPtr =
       SingleSetPtr<Activity, typename ActivityPtr::deleter_type>;
 
-  LegacyChannelIdleFilter(grpc_channel_stack* channel_stack,
-                          Duration client_idle_timeout)
-      : channel_stack_(channel_stack),
-        client_idle_timeout_(client_idle_timeout) {}
-
   grpc_channel_stack* channel_stack() { return channel_stack_; };
 
   virtual void Shutdown();
@@ -94,10 +94,9 @@ class LegacyClientIdleFilter final : public LegacyChannelIdleFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<LegacyClientIdleFilter> Create(
+  static absl::StatusOr<std::unique_ptr<LegacyClientIdleFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
- private:
   using LegacyChannelIdleFilter::LegacyChannelIdleFilter;
 };
 
@@ -106,9 +105,12 @@ class LegacyMaxAgeFilter final : public LegacyChannelIdleFilter {
   static const grpc_channel_filter kFilter;
   struct Config;
 
-  static absl::StatusOr<LegacyMaxAgeFilter> Create(
+  static absl::StatusOr<std::unique_ptr<LegacyMaxAgeFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,
+                     const Config& max_age_config);
+
   void PostInit() override;
 
  private:
@@ -128,9 +130,6 @@ class LegacyMaxAgeFilter final : public LegacyChannelIdleFilter {
     LegacyMaxAgeFilter* filter_;
   };
 
-  LegacyMaxAgeFilter(grpc_channel_stack* channel_stack,
-                     const Config& max_age_config);
-
   void Shutdown() override;
 
   SingleSetActivityPtr max_age_activity_;

src/core/ext/filters/fault_injection/fault_injection_filter.cc

@@ -29,6 +29,7 @@
 
 #include "absl/meta/type_traits.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
@@ -135,16 +136,16 @@ class FaultInjectionFilter::InjectionDecision {
   FaultHandle active_fault_{false};
 };
 
-absl::StatusOr<FaultInjectionFilter> FaultInjectionFilter::Create(
-    const ChannelArgs&, ChannelFilter::Args filter_args) {
-  return FaultInjectionFilter(filter_args);
+absl::StatusOr<std::unique_ptr<FaultInjectionFilter>>
+FaultInjectionFilter::Create(const ChannelArgs&,
+                             ChannelFilter::Args filter_args) {
+  return std::make_unique<FaultInjectionFilter>(filter_args);
 }
 
 FaultInjectionFilter::FaultInjectionFilter(ChannelFilter::Args filter_args)
     : index_(filter_args.instance_id()),
       service_config_parser_index_(
-          FaultInjectionServiceConfigParser::ParserIndex()),
-      mu_(new Mutex) {}
+          FaultInjectionServiceConfigParser::ParserIndex()) {}
 
 // Construct a promise for one call.
 ArenaPromise<absl::Status> FaultInjectionFilter::Call::OnClientInitialMetadata(
@@ -226,7 +227,7 @@ FaultInjectionFilter::MakeInjectionDecision(
   bool delay_request = delay != Duration::Zero();
   bool abort_request = abort_code != GRPC_STATUS_OK;
   if (delay_request || abort_request) {
-    MutexLock lock(mu_.get());
+    MutexLock lock(&mu_);
     if (delay_request) {
       delay_request =
           UnderFraction(&delay_rand_generator_, delay_percentage_numerator,

src/core/ext/filters/fault_injection/fault_injection_filter.h

@@ -45,9 +45,11 @@ class FaultInjectionFilter
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<FaultInjectionFilter> Create(
+  static absl::StatusOr<std::unique_ptr<FaultInjectionFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit FaultInjectionFilter(ChannelFilter::Args filter_args);
+
   // Construct a promise for one call.
   class Call {
    public:
@@ -61,8 +63,6 @@ class FaultInjectionFilter
   };
 
  private:
-  explicit FaultInjectionFilter(ChannelFilter::Args filter_args);
-
   class InjectionDecision;
   InjectionDecision MakeInjectionDecision(
       const ClientMetadata& initial_metadata);
@@ -70,7 +70,7 @@ class FaultInjectionFilter
   // The relative index of instances of the same filter.
   size_t index_;
   const size_t service_config_parser_index_;
-  std::unique_ptr<Mutex> mu_;
+  Mutex mu_;
   absl::InsecureBitGen abort_rand_generator_ ABSL_GUARDED_BY(mu_);
   absl::InsecureBitGen delay_rand_generator_ ABSL_GUARDED_BY(mu_);
 };

src/core/ext/filters/http/client/http_client_filter.cc

@@ -27,6 +27,7 @@
 #include <vector>
 
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -136,16 +137,16 @@ HttpClientFilter::HttpClientFilter(HttpSchemeMetadata::ValueType scheme,
                                    Slice user_agent,
                                    bool test_only_use_put_requests)
     : scheme_(scheme),
-      user_agent_(std::move(user_agent)),
-      test_only_use_put_requests_(test_only_use_put_requests) {}
+      test_only_use_put_requests_(test_only_use_put_requests),
+      user_agent_(std::move(user_agent)) {}
 
-absl::StatusOr<HttpClientFilter> HttpClientFilter::Create(
+absl::StatusOr<std::unique_ptr<HttpClientFilter>> HttpClientFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   auto* transport = args.GetObject<Transport>();
   if (transport == nullptr) {
     return absl::InvalidArgumentError("HttpClientFilter needs a transport");
   }
-  return HttpClientFilter(
+  return std::make_unique<HttpClientFilter>(
       SchemeFromArgs(args),
       UserAgentFromArgs(args, transport->GetTransportName()),
       args.GetInt(GRPC_ARG_TEST_ONLY_USE_PUT_REQUESTS).value_or(false));

src/core/ext/filters/http/client/http_client_filter.h

@@ -35,9 +35,12 @@ class HttpClientFilter : public ImplementChannelFilter<HttpClientFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<HttpClientFilter> Create(
+  static absl::StatusOr<std::unique_ptr<HttpClientFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  HttpClientFilter(HttpSchemeMetadata::ValueType scheme, Slice user_agent,
+                   bool test_only_use_put_requests);
+
   class Call {
    public:
     void OnClientInitialMetadata(ClientMetadata& md, HttpClientFilter* filter);
@@ -49,12 +52,9 @@ class HttpClientFilter : public ImplementChannelFilter<HttpClientFilter> {
   };
 
  private:
-  HttpClientFilter(HttpSchemeMetadata::ValueType scheme, Slice user_agent,
-                   bool test_only_use_put_requests);
-
   HttpSchemeMetadata::ValueType scheme_;
-  Slice user_agent_;
   bool test_only_use_put_requests_;
+  Slice user_agent_;
 };
 
 // A test-only channel arg to allow testing gRPC Core server behavior on PUT

src/core/ext/filters/http/client_authority_filter.cc

@@ -43,8 +43,8 @@ const NoInterceptor ClientAuthorityFilter::Call::OnClientToServerMessage;
 const NoInterceptor ClientAuthorityFilter::Call::OnServerToClientMessage;
 const NoInterceptor ClientAuthorityFilter::Call::OnFinalize;
 
-absl::StatusOr<ClientAuthorityFilter> ClientAuthorityFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
+absl::StatusOr<std::unique_ptr<ClientAuthorityFilter>>
+ClientAuthorityFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
   absl::optional<absl::string_view> default_authority =
       args.GetString(GRPC_ARG_DEFAULT_AUTHORITY);
   if (!default_authority.has_value()) {
@@ -52,7 +52,8 @@ absl::StatusOr<ClientAuthorityFilter> ClientAuthorityFilter::Create(
         "GRPC_ARG_DEFAULT_AUTHORITY string channel arg. not found. Note that "
         "direct channels must explicitly specify a value for this argument.");
   }
-  return ClientAuthorityFilter(Slice::FromCopiedString(*default_authority));
+  return std::make_unique<ClientAuthorityFilter>(
+      Slice::FromCopiedString(*default_authority));
 }
 
 void ClientAuthorityFilter::Call::OnClientInitialMetadata(

src/core/ext/filters/http/client_authority_filter.h

@@ -39,8 +39,11 @@ class ClientAuthorityFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientAuthorityFilter> Create(const ChannelArgs& args,
-                                                      ChannelFilter::Args);
+  static absl::StatusOr<std::unique_ptr<ClientAuthorityFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
+
+  explicit ClientAuthorityFilter(Slice default_authority)
+      : default_authority_(std::move(default_authority)) {}
 
   class Call {
    public:
@@ -54,8 +57,6 @@ class ClientAuthorityFilter final
   };
 
  private:
-  explicit ClientAuthorityFilter(Slice default_authority)
-      : default_authority_(std::move(default_authority)) {}
   Slice default_authority_;
 };
 

src/core/ext/filters/http/message_compress/compression_filter.cc

@@ -72,14 +72,14 @@ const grpc_channel_filter ServerCompressionFilter::kFilter =
                                kFilterExaminesInboundMessages |
                                kFilterExaminesOutboundMessages>("compression");
 
-absl::StatusOr<ClientCompressionFilter> ClientCompressionFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
-  return ClientCompressionFilter(args);
+absl::StatusOr<std::unique_ptr<ClientCompressionFilter>>
+ClientCompressionFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
+  return std::make_unique<ClientCompressionFilter>(args);
 }
 
-absl::StatusOr<ServerCompressionFilter> ServerCompressionFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
-  return ServerCompressionFilter(args);
+absl::StatusOr<std::unique_ptr<ServerCompressionFilter>>
+ServerCompressionFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
+  return std::make_unique<ServerCompressionFilter>(args);
 }
 
 ChannelCompression::ChannelCompression(const ChannelArgs& args)

src/core/ext/filters/http/message_compress/compression_filter.h

@@ -110,9 +110,12 @@ class ClientCompressionFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientCompressionFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ClientCompressionFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit ClientCompressionFilter(const ChannelArgs& args)
+      : compression_engine_(args) {}
+
   // Construct a promise for one call.
   class Call {
    public:
@@ -135,9 +138,6 @@ class ClientCompressionFilter final
   };
 
  private:
-  explicit ClientCompressionFilter(const ChannelArgs& args)
-      : compression_engine_(args) {}
-
   ChannelCompression compression_engine_;
 };
 
@@ -146,9 +146,12 @@ class ServerCompressionFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerCompressionFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServerCompressionFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit ServerCompressionFilter(const ChannelArgs& args)
+      : compression_engine_(args) {}
+
   // Construct a promise for one call.
   class Call {
    public:
@@ -171,9 +174,6 @@ class ServerCompressionFilter final
   };
 
  private:
-  explicit ServerCompressionFilter(const ChannelArgs& args)
-      : compression_engine_(args) {}
-
   ChannelCompression compression_engine_;
 };
 

src/core/ext/filters/http/server/http_server_filter.cc

@@ -152,9 +152,9 @@ void HttpServerFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
   FilterOutgoingMetadata(&md);
 }
 
-absl::StatusOr<HttpServerFilter> HttpServerFilter::Create(
+absl::StatusOr<std::unique_ptr<HttpServerFilter>> HttpServerFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
-  return HttpServerFilter(
+  return std::make_unique<HttpServerFilter>(
       args.GetBool(GRPC_ARG_SURFACE_USER_AGENT).value_or(true),
       args.GetBool(
               GRPC_ARG_DO_NOT_USE_UNLESS_YOU_HAVE_PERMISSION_FROM_GRPC_TEAM_ALLOW_BROKEN_PUT_REQUESTS)

src/core/ext/filters/http/server/http_server_filter.h

@@ -36,9 +36,13 @@ class HttpServerFilter : public ImplementChannelFilter<HttpServerFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<HttpServerFilter> Create(
+  static absl::StatusOr<std::unique_ptr<HttpServerFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  HttpServerFilter(bool surface_user_agent, bool allow_put_requests)
+      : surface_user_agent_(surface_user_agent),
+        allow_put_requests_(allow_put_requests) {}
+
   class Call {
    public:
     ServerMetadataHandle OnClientInitialMetadata(ClientMetadata& md,
@@ -51,10 +55,6 @@ class HttpServerFilter : public ImplementChannelFilter<HttpServerFilter> {
   };
 
  private:
-  HttpServerFilter(bool surface_user_agent, bool allow_put_requests)
-      : surface_user_agent_(surface_user_agent),
-        allow_put_requests_(allow_put_requests) {}
-
   bool surface_user_agent_;
   bool allow_put_requests_;
 };

src/core/ext/filters/load_reporting/server_load_reporting_filter.cc

@@ -76,10 +76,11 @@ const NoInterceptor ServerLoadReportingFilter::Call::OnServerInitialMetadata;
 const NoInterceptor ServerLoadReportingFilter::Call::OnClientToServerMessage;
 const NoInterceptor ServerLoadReportingFilter::Call::OnServerToClientMessage;
 
-absl::StatusOr<ServerLoadReportingFilter> ServerLoadReportingFilter::Create(
-    const ChannelArgs& channel_args, ChannelFilter::Args) {
+absl::StatusOr<std::unique_ptr<ServerLoadReportingFilter>>
+ServerLoadReportingFilter::Create(const ChannelArgs& channel_args,
+                                  ChannelFilter::Args) {
   // Find and record the peer_identity.
-  ServerLoadReportingFilter filter;
+  auto filter = std::make_unique<ServerLoadReportingFilter>();
   const auto* auth_context = channel_args.GetObject<grpc_auth_context>();
   if (auth_context != nullptr &&
       grpc_auth_context_peer_is_authenticated(auth_context)) {
@@ -88,7 +89,7 @@ absl::StatusOr<ServerLoadReportingFilter> ServerLoadReportingFilter::Create(
     const grpc_auth_property* auth_property =
         grpc_auth_property_iterator_next(&auth_it);
     if (auth_property != nullptr) {
-      filter.peer_identity_ =
+      filter->peer_identity_ =
           std::string(auth_property->value, auth_property->value_length);
     }
   }

src/core/ext/filters/load_reporting/server_load_reporting_filter.h

@@ -39,7 +39,7 @@ class ServerLoadReportingFilter
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerLoadReportingFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServerLoadReportingFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args);
 
   // Getters.

src/core/ext/filters/logging/logging_filter.cc

@@ -342,21 +342,23 @@ class CallData {
 
 }  // namespace
 
-absl::StatusOr<ClientLoggingFilter> ClientLoggingFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args /*filter_args*/) {
+absl::StatusOr<std::unique_ptr<ClientLoggingFilter>>
+ClientLoggingFilter::Create(const ChannelArgs& args,
+                            ChannelFilter::Args /*filter_args*/) {
   absl::optional<absl::string_view> default_authority =
       args.GetString(GRPC_ARG_DEFAULT_AUTHORITY);
   if (default_authority.has_value()) {
-    return ClientLoggingFilter(std::string(default_authority.value()));
+    return std::make_unique<ClientLoggingFilter>(
+        std::string(default_authority.value()));
   }
   absl::optional<std::string> server_uri =
       args.GetOwnedString(GRPC_ARG_SERVER_URI);
   if (server_uri.has_value()) {
-    return ClientLoggingFilter(
+    return std::make_unique<ClientLoggingFilter>(
         CoreConfiguration::Get().resolver_registry().GetDefaultAuthority(
             *server_uri));
   }
-  return ClientLoggingFilter("");
+  return std::make_unique<ClientLoggingFilter>("");
 }
 
 // Construct a promise for one call.
@@ -445,9 +447,10 @@ const grpc_channel_filter ClientLoggingFilter::kFilter =
                                kFilterExaminesInboundMessages |
                                kFilterExaminesOutboundMessages>("logging");
 
-absl::StatusOr<ServerLoggingFilter> ServerLoggingFilter::Create(
-    const ChannelArgs& /*args*/, ChannelFilter::Args /*filter_args*/) {
-  return ServerLoggingFilter();
+absl::StatusOr<std::unique_ptr<ServerLoggingFilter>>
+ServerLoggingFilter::Create(const ChannelArgs& /*args*/,
+                            ChannelFilter::Args /*filter_args*/) {
+  return std::make_unique<ServerLoggingFilter>();
 }
 
 // Construct a promise for one call.

src/core/ext/filters/logging/logging_filter.h

@@ -39,24 +39,25 @@ class ClientLoggingFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientLoggingFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ClientLoggingFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args /*filter_args*/);
 
+  explicit ClientLoggingFilter(std::string default_authority)
+      : default_authority_(std::move(default_authority)) {}
+
   // Construct a promise for one call.
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       CallArgs call_args, NextPromiseFactory next_promise_factory) override;
 
  private:
-  explicit ClientLoggingFilter(std::string default_authority)
-      : default_authority_(std::move(default_authority)) {}
-  std::string default_authority_;
+  const std::string default_authority_;
 };
 
 class ServerLoggingFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerLoggingFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServerLoggingFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args /*filter_args*/);
 
   // Construct a promise for one call.

src/core/ext/filters/message_size/message_size_filter.cc

@@ -25,7 +25,6 @@
 
 #include "absl/strings/str_format.h"
 
-#include <grpc/grpc.h>
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/status.h>
 #include <grpc/support/log.h>
@@ -142,19 +141,20 @@ const grpc_channel_filter ClientMessageSizeFilter::kFilter =
     MakePromiseBasedFilter<ClientMessageSizeFilter, FilterEndpoint::kClient,
                            kFilterExaminesOutboundMessages |
                                kFilterExaminesInboundMessages>("message_size");
+
 const grpc_channel_filter ServerMessageSizeFilter::kFilter =
     MakePromiseBasedFilter<ServerMessageSizeFilter, FilterEndpoint::kServer,
                            kFilterExaminesOutboundMessages |
                                kFilterExaminesInboundMessages>("message_size");
 
-absl::StatusOr<ClientMessageSizeFilter> ClientMessageSizeFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
-  return ClientMessageSizeFilter(args);
+absl::StatusOr<std::unique_ptr<ClientMessageSizeFilter>>
+ClientMessageSizeFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
+  return std::make_unique<ClientMessageSizeFilter>(args);
 }
 
-absl::StatusOr<ServerMessageSizeFilter> ServerMessageSizeFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
-  return ServerMessageSizeFilter(args);
+absl::StatusOr<std::unique_ptr<ServerMessageSizeFilter>>
+ServerMessageSizeFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
+  return std::make_unique<ServerMessageSizeFilter>(args);
 }
 
 namespace {

src/core/ext/filters/message_size/message_size_filter.h

@@ -91,9 +91,12 @@ class ServerMessageSizeFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerMessageSizeFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServerMessageSizeFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit ServerMessageSizeFilter(const ChannelArgs& args)
+      : parsed_config_(MessageSizeParsedConfig::GetFromChannelArgs(args)) {}
+
   class Call {
    public:
     static const NoInterceptor OnClientInitialMetadata;
@@ -107,8 +110,6 @@ class ServerMessageSizeFilter final
   };
 
  private:
-  explicit ServerMessageSizeFilter(const ChannelArgs& args)
-      : parsed_config_(MessageSizeParsedConfig::GetFromChannelArgs(args)) {}
   const MessageSizeParsedConfig parsed_config_;
 };
 
@@ -117,9 +118,12 @@ class ClientMessageSizeFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientMessageSizeFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ClientMessageSizeFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit ClientMessageSizeFilter(const ChannelArgs& args)
+      : parsed_config_(MessageSizeParsedConfig::GetFromChannelArgs(args)) {}
+
   class Call {
    public:
     explicit Call(ClientMessageSizeFilter* filter);
@@ -136,8 +140,6 @@ class ClientMessageSizeFilter final
   };
 
  private:
-  explicit ClientMessageSizeFilter(const ChannelArgs& args)
-      : parsed_config_(MessageSizeParsedConfig::GetFromChannelArgs(args)) {}
   const size_t service_config_parser_index_{MessageSizeParser::ParserIndex()};
   const MessageSizeParsedConfig parsed_config_;
 };

src/core/ext/filters/rbac/rbac_filter.cc

@@ -82,14 +82,21 @@ RbacFilter::RbacFilter(size_t index,
       service_config_parser_index_(RbacServiceConfigParser::ParserIndex()),
       per_channel_evaluate_args_(std::move(per_channel_evaluate_args)) {}
 
-absl::StatusOr<RbacFilter> RbacFilter::Create(const ChannelArgs& args,
-                                              ChannelFilter::Args filter_args) {
+absl::StatusOr<std::unique_ptr<RbacFilter>> RbacFilter::Create(
+    const ChannelArgs& args, ChannelFilter::Args filter_args) {
   auto* auth_context = args.GetObject<grpc_auth_context>();
   if (auth_context == nullptr) {
     return GRPC_ERROR_CREATE("No auth context found");
   }
-  return RbacFilter(filter_args.instance_id(),
-                    EvaluateArgs::PerChannelArgs(auth_context, args));
+  auto* transport = args.GetObject<Transport>();
+  if (transport == nullptr) {
+    // This should never happen since the transport is always set on the server
+    // side.
+    return GRPC_ERROR_CREATE("No transport configured");
+  }
+  return std::make_unique<RbacFilter>(
+      filter_args.instance_id(),
+      EvaluateArgs::PerChannelArgs(auth_context, args));
 }
 
 void RbacFilterRegister(CoreConfiguration::Builder* builder) {

src/core/ext/filters/rbac/rbac_filter.h

@@ -42,8 +42,11 @@ class RbacFilter : public ImplementChannelFilter<RbacFilter> {
   // and enforces the RBAC policy.
   static const grpc_channel_filter kFilterVtable;
 
-  static absl::StatusOr<RbacFilter> Create(const ChannelArgs& args,
-                                           ChannelFilter::Args filter_args);
+  static absl::StatusOr<std::unique_ptr<RbacFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args filter_args);
+
+  RbacFilter(size_t index,
+             EvaluateArgs::PerChannelArgs per_channel_evaluate_args);
 
   class Call {
    public:
@@ -57,9 +60,6 @@ class RbacFilter : public ImplementChannelFilter<RbacFilter> {
   };
 
  private:
-  RbacFilter(size_t index,
-             EvaluateArgs::PerChannelArgs per_channel_evaluate_args);
-
   // The index of this filter instance among instances of the same filter.
   size_t index_;
   // Assigned index for service config data from the parser.

src/core/ext/filters/server_config_selector/server_config_selector_filter.cc

@@ -49,19 +49,22 @@ namespace grpc_core {
 namespace {
 
 class ServerConfigSelectorFilter final
-    : public ImplementChannelFilter<ServerConfigSelectorFilter> {
+    : public ImplementChannelFilter<ServerConfigSelectorFilter>,
+      public InternallyRefCounted<ServerConfigSelectorFilter> {
  public:
-  ~ServerConfigSelectorFilter() override;
+  explicit ServerConfigSelectorFilter(
+      RefCountedPtr<ServerConfigSelectorProvider>
+          server_config_selector_provider);
 
   ServerConfigSelectorFilter(const ServerConfigSelectorFilter&) = delete;
   ServerConfigSelectorFilter& operator=(const ServerConfigSelectorFilter&) =
       delete;
-  ServerConfigSelectorFilter(ServerConfigSelectorFilter&&) = default;
-  ServerConfigSelectorFilter& operator=(ServerConfigSelectorFilter&&) = default;
 
-  static absl::StatusOr<ServerConfigSelectorFilter> Create(
+  static absl::StatusOr<OrphanablePtr<ServerConfigSelectorFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args);
 
+  void Orphan() override;
+
   class Call {
    public:
     absl::Status OnClientInitialMetadata(ClientMetadata& md,
@@ -74,70 +77,66 @@ class ServerConfigSelectorFilter final
   };
 
   absl::StatusOr<RefCountedPtr<ServerConfigSelector>> config_selector() {
-    MutexLock lock(&state_->mu);
-    return state_->config_selector.value();
+    MutexLock lock(&mu_);
+    return config_selector_.value();
   }
 
  private:
-  struct State {
-    Mutex mu;
-    absl::optional<absl::StatusOr<RefCountedPtr<ServerConfigSelector>>>
-        config_selector ABSL_GUARDED_BY(mu);
-  };
   class ServerConfigSelectorWatcher
       : public ServerConfigSelectorProvider::ServerConfigSelectorWatcher {
    public:
-    explicit ServerConfigSelectorWatcher(std::shared_ptr<State> state)
-        : state_(state) {}
+    explicit ServerConfigSelectorWatcher(
+        RefCountedPtr<ServerConfigSelectorFilter> filter)
+        : filter_(filter) {}
     void OnServerConfigSelectorUpdate(
         absl::StatusOr<RefCountedPtr<ServerConfigSelector>> update) override {
-      MutexLock lock(&state_->mu);
-      state_->config_selector = std::move(update);
+      MutexLock lock(&filter_->mu_);
+      filter_->config_selector_ = std::move(update);
     }
 
    private:
-    std::shared_ptr<State> state_;
+    RefCountedPtr<ServerConfigSelectorFilter> filter_;
   };
 
-  explicit ServerConfigSelectorFilter(
-      RefCountedPtr<ServerConfigSelectorProvider>
-          server_config_selector_provider);
-
   RefCountedPtr<ServerConfigSelectorProvider> server_config_selector_provider_;
-  std::shared_ptr<State> state_;
+  Mutex mu_;
+  absl::optional<absl::StatusOr<RefCountedPtr<ServerConfigSelector>>>
+      config_selector_ ABSL_GUARDED_BY(mu_);
 };
 
-absl::StatusOr<ServerConfigSelectorFilter> ServerConfigSelectorFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
+absl::StatusOr<OrphanablePtr<ServerConfigSelectorFilter>>
+ServerConfigSelectorFilter::Create(const ChannelArgs& args,
+                                   ChannelFilter::Args) {
   ServerConfigSelectorProvider* server_config_selector_provider =
       args.GetObject<ServerConfigSelectorProvider>();
   if (server_config_selector_provider == nullptr) {
     return absl::UnknownError("No ServerConfigSelectorProvider object found");
   }
-  return ServerConfigSelectorFilter(server_config_selector_provider->Ref());
+  return MakeOrphanable<ServerConfigSelectorFilter>(
+      server_config_selector_provider->Ref());
 }
 
 ServerConfigSelectorFilter::ServerConfigSelectorFilter(
     RefCountedPtr<ServerConfigSelectorProvider> server_config_selector_provider)
     : server_config_selector_provider_(
-          std::move(server_config_selector_provider)),
-      state_(std::make_shared<State>()) {
+          std::move(server_config_selector_provider)) {
   GPR_ASSERT(server_config_selector_provider_ != nullptr);
   auto server_config_selector_watcher =
-      std::make_unique<ServerConfigSelectorWatcher>(state_);
+      std::make_unique<ServerConfigSelectorWatcher>(Ref());
   auto config_selector = server_config_selector_provider_->Watch(
       std::move(server_config_selector_watcher));
-  MutexLock lock(&state_->mu);
+  MutexLock lock(&mu_);
   // It's possible for the watcher to have already updated config_selector_
-  if (!state_->config_selector.has_value()) {
-    state_->config_selector = std::move(config_selector);
+  if (!config_selector_.has_value()) {
+    config_selector_ = std::move(config_selector);
   }
 }
 
-ServerConfigSelectorFilter::~ServerConfigSelectorFilter() {
+void ServerConfigSelectorFilter::Orphan() {
   if (server_config_selector_provider_ != nullptr) {
     server_config_selector_provider_->CancelWatch();
   }
+  Unref();
 }
 
 absl::Status ServerConfigSelectorFilter::Call::OnClientInitialMetadata(

src/core/ext/filters/stateful_session/stateful_session_filter.cc

@@ -72,9 +72,10 @@ const grpc_channel_filter StatefulSessionFilter::kFilter =
                            kFilterExaminesServerInitialMetadata>(
         "stateful_session_filter");
 
-absl::StatusOr<StatefulSessionFilter> StatefulSessionFilter::Create(
-    const ChannelArgs&, ChannelFilter::Args filter_args) {
-  return StatefulSessionFilter(filter_args);
+absl::StatusOr<std::unique_ptr<StatefulSessionFilter>>
+StatefulSessionFilter::Create(const ChannelArgs&,
+                              ChannelFilter::Args filter_args) {
+  return std::make_unique<StatefulSessionFilter>(filter_args);
 }
 
 StatefulSessionFilter::StatefulSessionFilter(ChannelFilter::Args filter_args)

src/core/ext/filters/stateful_session/stateful_session_filter.h

@@ -74,9 +74,11 @@ class StatefulSessionFilter
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<StatefulSessionFilter> Create(
+  static absl::StatusOr<std::unique_ptr<StatefulSessionFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
 
+  explicit StatefulSessionFilter(ChannelFilter::Args filter_args);
+
   class Call {
    public:
     void OnClientInitialMetadata(ClientMetadata& md,
@@ -97,7 +99,6 @@ class StatefulSessionFilter
   };
 
  private:
-  explicit StatefulSessionFilter(ChannelFilter::Args filter_args);
   // The relative index of instances of the same filter.
   const size_t index_;
   // Index of the service config parser.

src/core/ext/gcp/metadata_query.cc

@@ -28,6 +28,7 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/log.h>

src/core/ext/xds/xds_server_config_fetcher.cc

@@ -38,6 +38,7 @@
 #include "absl/types/optional.h"
 #include "absl/types/variant.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>

src/core/lib/channel/promise_based_filter.cc

@@ -106,7 +106,7 @@ BaseCallData::BaseCallData(
               ? arena_->New<ReceiveMessage>(this, make_recv_interceptor())
               : nullptr),
       event_engine_(
-          static_cast<ChannelFilter*>(elem->channel_data)
+          ChannelFilterFromElem(elem)
               ->hack_until_per_channel_stack_event_engines_land_get_event_engine()) {
 }
 
@@ -1572,7 +1572,7 @@ void ClientCallData::Cancel(grpc_error_handle error, Flusher* flusher) {
 // metadata and return some trailing metadata.
 void ClientCallData::StartPromise(Flusher* flusher) {
   GPR_ASSERT(send_initial_state_ == SendInitialState::kQueued);
-  ChannelFilter* filter = static_cast<ChannelFilter*>(elem()->channel_data);
+  ChannelFilter* filter = promise_filter_detail::ChannelFilterFromElem(elem());
 
   // Construct the promise.
   PollContext ctx(this, flusher);
@@ -2369,7 +2369,7 @@ void ServerCallData::RecvInitialMetadataReady(grpc_error_handle error) {
   // Start the promise.
   ScopedContext context(this);
   // Construct the promise.
-  ChannelFilter* filter = static_cast<ChannelFilter*>(elem()->channel_data);
+  ChannelFilter* filter = promise_filter_detail::ChannelFilterFromElem(elem());
   FakeActivity(this).Run([this, filter] {
     promise_ = filter->MakeCallPromise(
         CallArgs{WrapMetadata(recv_initial_metadata_),

src/core/lib/channel/promise_based_filter.h

@@ -1841,6 +1841,15 @@ struct BaseCallDataMethods {
   }
 };
 
+// The type of object returned by a filter's Create method.
+template <typename T>
+using CreatedType = typename decltype(T::Create(ChannelArgs(), {}))::value_type;
+
+template <typename GrpcChannelOrCallElement>
+inline ChannelFilter* ChannelFilterFromElem(GrpcChannelOrCallElement* elem) {
+  return *static_cast<ChannelFilter**>(elem->channel_data);
+}
+
 template <typename CallData, uint8_t kFlags>
 struct CallDataFilterWithFlagsMethods {
   static absl::Status InitCallElem(grpc_call_element* elem,
@@ -1865,32 +1874,25 @@ struct ChannelFilterMethods {
   static ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       grpc_channel_element* elem, CallArgs call_args,
       NextPromiseFactory next_promise_factory) {
-    return static_cast<ChannelFilter*>(elem->channel_data)
-        ->MakeCallPromise(std::move(call_args),
-                          std::move(next_promise_factory));
+    return ChannelFilterFromElem(elem)->MakeCallPromise(
+        std::move(call_args), std::move(next_promise_factory));
   }
 
   static void StartTransportOp(grpc_channel_element* elem,
                                grpc_transport_op* op) {
-    if (!static_cast<ChannelFilter*>(elem->channel_data)
-             ->StartTransportOp(op)) {
+    if (!ChannelFilterFromElem(elem)->StartTransportOp(op)) {
       grpc_channel_next_op(elem, op);
     }
   }
 
   static void PostInitChannelElem(grpc_channel_stack*,
                                   grpc_channel_element* elem) {
-    static_cast<ChannelFilter*>(elem->channel_data)->PostInit();
-  }
-
-  static void DestroyChannelElem(grpc_channel_element* elem) {
-    static_cast<ChannelFilter*>(elem->channel_data)->~ChannelFilter();
+    ChannelFilterFromElem(elem)->PostInit();
   }
 
   static void GetChannelInfo(grpc_channel_element* elem,
                              const grpc_channel_info* info) {
-    if (!static_cast<ChannelFilter*>(elem->channel_data)
-             ->GetChannelInfo(info)) {
+    if (!ChannelFilterFromElem(elem)->GetChannelInfo(info)) {
       grpc_channel_next_get_info(elem, info);
     }
   }
@@ -1904,15 +1906,16 @@ struct ChannelFilterWithFlagsMethods {
     auto status = F::Create(args->channel_args,
                             ChannelFilter::Args(args->channel_stack, elem));
     if (!status.ok()) {
-      static_assert(
-          sizeof(promise_filter_detail::InvalidChannelFilter) <= sizeof(F),
-          "InvalidChannelFilter must fit in F");
-      new (elem->channel_data) promise_filter_detail::InvalidChannelFilter();
+      new (elem->channel_data) F*(nullptr);
       return absl_status_to_grpc_error(status.status());
     }
-    new (elem->channel_data) F(std::move(*status));
+    new (elem->channel_data) F*(status->release());
     return absl::OkStatus();
   }
+
+  static void DestroyChannelElem(grpc_channel_element* elem) {
+    CreatedType<F> channel_elem(DownCast<F*>(ChannelFilterFromElem(elem)));
+  }
 };
 
 }  // namespace promise_filter_detail
@@ -1958,7 +1961,8 @@ MakePromiseBasedFilter(const char* name) {
       // post_init_channel_elem
       promise_filter_detail::ChannelFilterMethods::PostInitChannelElem,
       // destroy_channel_elem
-      promise_filter_detail::ChannelFilterMethods::DestroyChannelElem,
+      promise_filter_detail::ChannelFilterWithFlagsMethods<
+          F, kFlags>::DestroyChannelElem,
       // get_channel_info
       promise_filter_detail::ChannelFilterMethods::GetChannelInfo,
       // name
@@ -2004,7 +2008,8 @@ MakePromiseBasedFilter(const char* name) {
       // post_init_channel_elem
       promise_filter_detail::ChannelFilterMethods::PostInitChannelElem,
       // destroy_channel_elem
-      promise_filter_detail::ChannelFilterMethods::DestroyChannelElem,
+      promise_filter_detail::ChannelFilterWithFlagsMethods<
+          F, kFlags>::DestroyChannelElem,
       // get_channel_info
       promise_filter_detail::ChannelFilterMethods::GetChannelInfo,
       // name
@@ -2046,7 +2051,8 @@ MakePromiseBasedFilter(const char* name) {
       // post_init_channel_elem
       promise_filter_detail::ChannelFilterMethods::PostInitChannelElem,
       // destroy_channel_elem
-      promise_filter_detail::ChannelFilterMethods::DestroyChannelElem,
+      promise_filter_detail::ChannelFilterWithFlagsMethods<
+          F, kFlags>::DestroyChannelElem,
       // get_channel_info
       promise_filter_detail::ChannelFilterMethods::GetChannelInfo,
       // name

src/core/lib/channel/server_call_tracer_filter.cc

@@ -17,6 +17,7 @@
 #include "src/core/lib/channel/server_call_tracer_filter.h"
 
 #include <functional>
+#include <memory>
 #include <utility>
 
 #include "absl/status/status.h"
@@ -49,7 +50,7 @@ class ServerCallTracerFilter
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerCallTracerFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServerCallTracerFilter>> Create(
       const ChannelArgs& /*args*/, ChannelFilter::Args /*filter_args*/);
 
   class Call {
@@ -98,9 +99,10 @@ const grpc_channel_filter ServerCallTracerFilter::kFilter =
                            kFilterExaminesServerInitialMetadata>(
         "server_call_tracer");
 
-absl::StatusOr<ServerCallTracerFilter> ServerCallTracerFilter::Create(
-    const ChannelArgs& /*args*/, ChannelFilter::Args /*filter_args*/) {
-  return ServerCallTracerFilter();
+absl::StatusOr<std::unique_ptr<ServerCallTracerFilter>>
+ServerCallTracerFilter::Create(const ChannelArgs& /*args*/,
+                               ChannelFilter::Args /*filter_args*/) {
+  return std::make_unique<ServerCallTracerFilter>();
 }
 
 }  // namespace

src/core/lib/http/httpcli_security_connector.cc

@@ -25,6 +25,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/impl/channel_arg_names.h>

src/core/lib/security/authorization/grpc_server_authz_filter.cc

@@ -51,14 +51,14 @@ GrpcServerAuthzFilter::GrpcServerAuthzFilter(
       per_channel_evaluate_args_(auth_context_.get(), args),
       provider_(std::move(provider)) {}
 
-absl::StatusOr<GrpcServerAuthzFilter> GrpcServerAuthzFilter::Create(
-    const ChannelArgs& args, ChannelFilter::Args) {
+absl::StatusOr<std::unique_ptr<GrpcServerAuthzFilter>>
+GrpcServerAuthzFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
   auto* auth_context = args.GetObject<grpc_auth_context>();
   auto* provider = args.GetObject<grpc_authorization_policy_provider>();
   if (provider == nullptr) {
     return absl::InvalidArgumentError("Failed to get authorization provider.");
   }
-  return GrpcServerAuthzFilter(
+  return std::make_unique<GrpcServerAuthzFilter>(
       auth_context != nullptr ? auth_context->Ref() : nullptr, args,
       provider->Ref());
 }

src/core/lib/security/authorization/grpc_server_authz_filter.h

@@ -37,8 +37,12 @@ class GrpcServerAuthzFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<GrpcServerAuthzFilter> Create(const ChannelArgs& args,
-                                                      ChannelFilter::Args);
+  static absl::StatusOr<std::unique_ptr<GrpcServerAuthzFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
+
+  GrpcServerAuthzFilter(
+      RefCountedPtr<grpc_auth_context> auth_context, const ChannelArgs& args,
+      RefCountedPtr<grpc_authorization_policy_provider> provider);
 
   class Call {
    public:
@@ -52,10 +56,6 @@ class GrpcServerAuthzFilter final
   };
 
  private:
-  GrpcServerAuthzFilter(
-      RefCountedPtr<grpc_auth_context> auth_context, const ChannelArgs& args,
-      RefCountedPtr<grpc_authorization_policy_provider> provider);
-
   bool IsAuthorized(ClientMetadata& initial_metadata);
 
   RefCountedPtr<grpc_auth_context> auth_context_;

src/core/lib/security/certificate_provider/certificate_provider_factory.h

@@ -23,6 +23,7 @@
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 

src/core/lib/security/context/security_context.cc

@@ -22,6 +22,7 @@
 
 #include <algorithm>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>

src/core/lib/security/context/security_context.h

@@ -26,6 +26,7 @@
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>

src/core/lib/security/credentials/alts/alts_credentials.h

@@ -19,6 +19,7 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_ALTS_ALTS_CREDENTIALS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_ALTS_ALTS_CREDENTIALS_H
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/alts/grpc_alts_credentials_options.h

@@ -19,6 +19,7 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_ALTS_GRPC_ALTS_CREDENTIALS_OPTIONS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_ALTS_GRPC_ALTS_CREDENTIALS_OPTIONS_H
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 

src/core/lib/security/credentials/call_creds_util.h

@@ -19,6 +19,7 @@
 
 #include <string>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 

src/core/lib/security/credentials/channel_creds_registry_init.cc

@@ -23,6 +23,7 @@
 
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/json.h>

src/core/lib/security/credentials/composite/composite_credentials.h

@@ -26,6 +26,7 @@
 
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/credentials.h

@@ -26,6 +26,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/external/aws_external_account_credentials.cc

@@ -28,6 +28,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>

src/core/lib/security/credentials/external/external_account_credentials.cc

@@ -35,6 +35,7 @@
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>

src/core/lib/security/credentials/external/url_external_account_credentials.cc

@@ -27,6 +27,7 @@
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>

src/core/lib/security/credentials/fake/fake_credentials.h

@@ -23,6 +23,7 @@
 
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/google_default/google_default_credentials.cc

@@ -28,7 +28,8 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
-#include <grpc/grpc_security.h>  // IWYU pragma: keep
+#include <grpc/credentials.h>
+#include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/slice.h>

src/core/lib/security/credentials/google_default/google_default_credentials.h

@@ -20,6 +20,7 @@
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_GOOGLE_DEFAULT_GOOGLE_DEFAULT_CREDENTIALS_H
 #include <utility>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/iam/iam_credentials.h

@@ -24,6 +24,7 @@
 #include "absl/status/statusor.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 

src/core/lib/security/credentials/insecure/insecure_credentials.h

@@ -19,6 +19,7 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_INSECURE_INSECURE_CREDENTIALS_H
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/jwt/json_token.cc

@@ -33,6 +33,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/escaping.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>

src/core/lib/security/credentials/jwt/jwt_credentials.cc

@@ -27,6 +27,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
 
+#include <grpc/credentials.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
 #include <grpc/support/log.h>

src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -29,6 +29,7 @@
 #include "absl/time/time.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 #include <grpc/support/sync.h>

src/core/lib/security/credentials/local/local_credentials.h

@@ -19,6 +19,7 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_LOCAL_LOCAL_CREDENTIALS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_LOCAL_LOCAL_CREDENTIALS_H
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -33,6 +33,7 @@
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>

src/core/lib/security/credentials/oauth2/oauth2_credentials.h

@@ -26,6 +26,7 @@
 #include "absl/status/statusor.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>
 #include <grpc/support/sync.h>

src/core/lib/security/credentials/plugin/plugin_credentials.h

@@ -28,6 +28,7 @@
 #include "absl/container/inlined_vector.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/ssl/ssl_credentials.h

@@ -20,6 +20,7 @@
 
 #include <stddef.h>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.cc

@@ -18,6 +18,7 @@
 
 #include "absl/status/status.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/log.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/tls/grpc_tls_certificate_provider.cc

@@ -25,6 +25,7 @@
 
 #include "absl/status/status.h"
 
+#include <grpc/credentials.h>
 #include <grpc/slice.h>
 #include <grpc/support/log.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/tls/grpc_tls_certificate_verifier.h

@@ -23,6 +23,7 @@
 #include "absl/base/thread_annotations.h"
 #include "absl/status/status.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/status.h>
 #include <grpc/support/log.h>

src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -25,6 +25,7 @@
 
 #include "absl/container/inlined_vector.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"

src/core/lib/security/credentials/tls/tls_credentials.h

@@ -19,6 +19,7 @@
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_CREDENTIALS_H
 #define GRPC_SRC_CORE_LIB_SECURITY_CREDENTIALS_TLS_TLS_CREDENTIALS_H
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/credentials/xds/xds_credentials.h

@@ -28,6 +28,7 @@
 
 #include "absl/status/status.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/alts/alts_security_connector.h

@@ -18,6 +18,7 @@
 
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_ALTS_ALTS_SECURITY_CONNECTOR_H
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/fake/fake_security_connector.h

@@ -18,6 +18,7 @@
 
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_FAKE_FAKE_SECURITY_CONNECTOR_H
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/insecure/insecure_security_connector.h

@@ -24,6 +24,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/local/local_security_connector.h

@@ -18,6 +18,7 @@
 
 #ifndef GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_LOCAL_SECURITY_CONNECTOR_H
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOCAL_LOCAL_SECURITY_CONNECTOR_H
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/security_connector.h

@@ -24,6 +24,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/security_connector/ssl/ssl_security_connector.h

@@ -20,6 +20,7 @@
 #define GRPC_SRC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_SSL_SSL_SECURITY_CONNECTOR_H
 #include <stddef.h>
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>

src/core/lib/security/security_connector/ssl_utils.cc

@@ -29,6 +29,7 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/str_split.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_crl_provider.h>
 #include <grpc/impl/channel_arg_names.h>

src/core/lib/security/security_connector/tls/tls_security_connector.h

@@ -27,6 +27,7 @@
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/port_platform.h>

src/core/lib/security/transport/auth_filters.h

@@ -21,6 +21,7 @@
 
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/port_platform.h>
@@ -42,18 +43,18 @@ class ClientAuthFilter final : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientAuthFilter> Create(const ChannelArgs& args,
-                                                 ChannelFilter::Args);
+  ClientAuthFilter(
+      RefCountedPtr<grpc_channel_security_connector> security_connector,
+      RefCountedPtr<grpc_auth_context> auth_context);
+
+  static absl::StatusOr<std::unique_ptr<ClientAuthFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
 
   // Construct a promise for one call.
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       CallArgs call_args, NextPromiseFactory next_promise_factory) override;
 
  private:
-  ClientAuthFilter(
-      RefCountedPtr<grpc_channel_security_connector> security_connector,
-      RefCountedPtr<grpc_auth_context> auth_context);
-
   ArenaPromise<absl::StatusOr<CallArgs>> GetCallCredsMetadata(
       CallArgs call_args);
 
@@ -63,9 +64,6 @@ class ClientAuthFilter final : public ChannelFilter {
 
 class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
  private:
-  ServerAuthFilter(RefCountedPtr<grpc_server_credentials> server_credentials,
-                   RefCountedPtr<grpc_auth_context> auth_context);
-
   class RunApplicationCode {
    public:
     RunApplicationCode(ServerAuthFilter* filter, ClientMetadata& metadata);
@@ -98,8 +96,11 @@ class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServerAuthFilter> Create(const ChannelArgs& args,
-                                                 ChannelFilter::Args);
+  ServerAuthFilter(RefCountedPtr<grpc_server_credentials> server_credentials,
+                   RefCountedPtr<grpc_auth_context> auth_context);
+
+  static absl::StatusOr<std::unique_ptr<ServerAuthFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args);
 
   class Call {
    public:

src/core/lib/security/transport/client_auth_filter.cc

@@ -26,6 +26,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/grpc_security_constants.h>
 #include <grpc/support/alloc.h>
@@ -203,7 +204,7 @@ ArenaPromise<ServerMetadataHandle> ClientAuthFilter::MakeCallPromise(
       next_promise_factory);
 }
 
-absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
+absl::StatusOr<std::unique_ptr<ClientAuthFilter>> ClientAuthFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   auto* sc = args.GetObject<grpc_security_connector>();
   if (sc == nullptr) {
@@ -215,8 +216,9 @@ absl::StatusOr<ClientAuthFilter> ClientAuthFilter::Create(
     return absl::InvalidArgumentError(
         "Auth context missing from client auth filter args");
   }
-  return ClientAuthFilter(sc->RefAsSubclass<grpc_channel_security_connector>(),
-                          auth_context->Ref());
+  return std::make_unique<ClientAuthFilter>(
+      sc->RefAsSubclass<grpc_channel_security_connector>(),
+      auth_context->Ref());
 }
 
 const grpc_channel_filter ClientAuthFilter::kFilter =

src/core/lib/security/transport/server_auth_filter.cc

@@ -26,6 +26,7 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/status.h>
@@ -212,12 +213,13 @@ ServerAuthFilter::ServerAuthFilter(
     RefCountedPtr<grpc_auth_context> auth_context)
     : server_credentials_(server_credentials), auth_context_(auth_context) {}
 
-absl::StatusOr<ServerAuthFilter> ServerAuthFilter::Create(
+absl::StatusOr<std::unique_ptr<ServerAuthFilter>> ServerAuthFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
   auto auth_context = args.GetObjectRef<grpc_auth_context>();
   GPR_ASSERT(auth_context != nullptr);
   auto creds = args.GetObjectRef<grpc_server_credentials>();
-  return ServerAuthFilter(std::move(creds), std::move(auth_context));
+  return std::make_unique<ServerAuthFilter>(std::move(creds),
+                                            std::move(auth_context));
 }
 
 }  // namespace grpc_core

src/core/lib/surface/channel_init.h

@@ -285,6 +285,11 @@ class ChannelInit {
       grpc_channel_stack_type type, const ChannelArgs& args) const;
 
  private:
+  // The type of object returned by a filter's Create method.
+  template <typename T>
+  using CreatedType =
+      typename decltype(T::Create(ChannelArgs(), {}))::value_type;
+
   struct Filter {
     Filter(const grpc_channel_filter* filter, const ChannelFilterVtable* vtable,
            std::vector<InclusionPredicate> predicates, bool skip_v3,
@@ -328,17 +333,17 @@ class ChannelInit {
 template <typename T>
 const ChannelInit::ChannelFilterVtable
     ChannelInit::VtableForType<T, absl::void_t<typename T::Call>>::kVtable = {
-        sizeof(T), alignof(T),
+        sizeof(CreatedType<T>), alignof(CreatedType<T>),
         [](void* data, const ChannelArgs& args) -> absl::Status {
           // TODO(ctiller): fill in ChannelFilter::Args (2nd arg)
-          absl::StatusOr<T> r = T::Create(args, {});
+          absl::StatusOr<CreatedType<T>> r = T::Create(args, {});
           if (!r.ok()) return r.status();
-          new (data) T(std::move(*r));
+          new (data) CreatedType<T>(std::move(*r));
           return absl::OkStatus();
         },
-        [](void* data) { static_cast<T*>(data)->~T(); },
+        [](void* data) { Destruct(static_cast<CreatedType<T>*>(data)); },
         [](void* data, CallFilters::StackBuilder& builder) {
-          builder.Add(static_cast<T*>(data));
+          builder.Add(static_cast<CreatedType<T>*>(data)->get());
         }};
 
 }  // namespace grpc_core

src/core/lib/surface/lame_client.cc

@@ -59,17 +59,15 @@ const grpc_channel_filter LameClientFilter::kFilter =
     MakePromiseBasedFilter<LameClientFilter, FilterEndpoint::kClient,
                            kFilterIsLast>("lame-client");
 
-absl::StatusOr<LameClientFilter> LameClientFilter::Create(
+absl::StatusOr<std::unique_ptr<LameClientFilter>> LameClientFilter::Create(
     const ChannelArgs& args, ChannelFilter::Args) {
-  return LameClientFilter(
+  return std::make_unique<LameClientFilter>(
       *args.GetPointer<absl::Status>(GRPC_ARG_LAME_FILTER_ERROR));
 }
 
 LameClientFilter::LameClientFilter(absl::Status error)
-    : error_(std::move(error)), state_(std::make_unique<State>()) {}
-
-LameClientFilter::State::State()
-    : state_tracker("lame_client", GRPC_CHANNEL_SHUTDOWN) {}
+    : error_(std::move(error)),
+      state_tracker_("lame_client", GRPC_CHANNEL_SHUTDOWN) {}
 
 ArenaPromise<ServerMetadataHandle> LameClientFilter::MakeCallPromise(
     CallArgs args, NextPromiseFactory) {
@@ -92,13 +90,13 @@ bool LameClientFilter::GetChannelInfo(const grpc_channel_info*) { return true; }
 
 bool LameClientFilter::StartTransportOp(grpc_transport_op* op) {
   {
-    MutexLock lock(&state_->mu);
+    MutexLock lock(&mu_);
     if (op->start_connectivity_watch != nullptr) {
-      state_->state_tracker.AddWatcher(op->start_connectivity_watch_state,
-                                       std::move(op->start_connectivity_watch));
+      state_tracker_.AddWatcher(op->start_connectivity_watch_state,
+                                std::move(op->start_connectivity_watch));
     }
     if (op->stop_connectivity_watch != nullptr) {
-      state_->state_tracker.RemoveWatcher(op->stop_connectivity_watch);
+      state_tracker_.RemoveWatcher(op->stop_connectivity_watch);
     }
   }
   if (op->send_ping.on_initiate != nullptr) {

src/core/lib/surface/lame_client.h

@@ -47,7 +47,9 @@ class LameClientFilter : public ChannelFilter {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<LameClientFilter> Create(
+  explicit LameClientFilter(absl::Status error);
+
+  static absl::StatusOr<std::unique_ptr<LameClientFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args filter_args);
   ArenaPromise<ServerMetadataHandle> MakeCallPromise(
       CallArgs call_args, NextPromiseFactory next_promise_factory) override;
@@ -55,15 +57,9 @@ class LameClientFilter : public ChannelFilter {
   bool GetChannelInfo(const grpc_channel_info*) override;
 
  private:
-  explicit LameClientFilter(absl::Status error);
-
   absl::Status error_;
-  struct State {
-    State();
-    Mutex mu;
-    ConnectivityStateTracker state_tracker ABSL_GUARDED_BY(mu);
-  };
-  std::unique_ptr<State> state_;
+  Mutex mu_;
+  ConnectivityStateTracker state_tracker_ ABSL_GUARDED_BY(mu_);
 };
 
 extern const grpc_arg_pointer_vtable kLameFilterErrorArgVtable;

src/core/load_balancing/grpclb/client_load_reporting_filter.cc

@@ -16,8 +16,6 @@
 //
 //
 
-#include <grpc/support/port_platform.h>
-
 #include "src/core/load_balancing/grpclb/client_load_reporting_filter.h"
 
 #include <functional>
@@ -27,7 +25,8 @@
 
 #include "absl/types/optional.h"
 
-#include "src/core/load_balancing/grpclb/grpclb_client_stats.h"
+#include <grpc/support/port_platform.h>
+
 #include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/promise/context.h"
@@ -36,48 +35,47 @@
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/transport/metadata_batch.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/load_balancing/grpclb/grpclb_client_stats.h"
 
 namespace grpc_core {
+
+const NoInterceptor ClientLoadReportingFilter::Call::OnServerToClientMessage;
+const NoInterceptor ClientLoadReportingFilter::Call::OnClientToServerMessage;
+const NoInterceptor ClientLoadReportingFilter::Call::OnFinalize;
+
 const grpc_channel_filter ClientLoadReportingFilter::kFilter =
     MakePromiseBasedFilter<ClientLoadReportingFilter, FilterEndpoint::kClient,
                            kFilterExaminesServerInitialMetadata>(
         "client_load_reporting");
 
-absl::StatusOr<ClientLoadReportingFilter> ClientLoadReportingFilter::Create(
-    const ChannelArgs&, ChannelFilter::Args) {
-  return ClientLoadReportingFilter();
+absl::StatusOr<std::unique_ptr<ClientLoadReportingFilter>>
+ClientLoadReportingFilter::Create(const ChannelArgs&, ChannelFilter::Args) {
+  return std::make_unique<ClientLoadReportingFilter>();
 }
 
-ArenaPromise<ServerMetadataHandle> ClientLoadReportingFilter::MakeCallPromise(
-    CallArgs call_args, NextPromiseFactory next_promise_factory) {
-  // Stats object to update.
-  RefCountedPtr<GrpcLbClientStats> client_stats;
-
+void ClientLoadReportingFilter::Call::OnClientInitialMetadata(
+    ClientMetadata& client_initial_metadata) {
   // Handle client initial metadata.
   // Grab client stats object from metadata.
   auto client_stats_md =
-      call_args.client_initial_metadata->Take(GrpcLbClientStatsMetadata());
+      client_initial_metadata.Take(GrpcLbClientStatsMetadata());
   if (client_stats_md.has_value()) {
-    client_stats.reset(*client_stats_md);
+    client_stats_.reset(*client_stats_md);
   }
-
-  auto* saw_initial_metadata = GetContext<Arena>()->New<bool>(false);
-  call_args.server_initial_metadata->InterceptAndMap(
-      [saw_initial_metadata](ServerMetadataHandle md) {
-        *saw_initial_metadata = true;
-        return md;
-      });
-
-  return Map(next_promise_factory(std::move(call_args)),
-             [saw_initial_metadata, client_stats = std::move(client_stats)](
-                 ServerMetadataHandle trailing_metadata) {
-               if (client_stats != nullptr) {
-                 client_stats->AddCallFinished(
-                     trailing_metadata->get(GrpcStreamNetworkState()) ==
-                         GrpcStreamNetworkState::kNotSentOnWire,
-                     *saw_initial_metadata);
-               }
-               return trailing_metadata;
-             });
 }
+
+void ClientLoadReportingFilter::Call::OnServerInitialMetadata(ServerMetadata&) {
+  saw_initial_metadata_ = true;
+}
+
+void ClientLoadReportingFilter::Call::OnServerTrailingMetadata(
+    ServerMetadata& server_trailing_metadata) {
+  if (client_stats_ != nullptr) {
+    client_stats_->AddCallFinished(
+        server_trailing_metadata.get(GrpcStreamNetworkState()) ==
+            GrpcStreamNetworkState::kNotSentOnWire,
+        saw_initial_metadata_);
+  }
+}
+
 }  // namespace grpc_core

src/core/load_balancing/grpclb/client_load_reporting_filter.h

@@ -19,10 +19,10 @@
 #ifndef GRPC_SRC_CORE_LOAD_BALANCING_GRPCLB_CLIENT_LOAD_REPORTING_FILTER_H
 #define GRPC_SRC_CORE_LOAD_BALANCING_GRPCLB_CLIENT_LOAD_REPORTING_FILTER_H
 
-#include <grpc/support/port_platform.h>
-
 #include "absl/status/statusor.h"
 
+#include <grpc/support/port_platform.h>
+
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/lib/channel/promise_based_filter.h"
@@ -31,16 +31,27 @@
 
 namespace grpc_core {
 
-class ClientLoadReportingFilter final : public ChannelFilter {
+class ClientLoadReportingFilter final
+    : public ImplementChannelFilter<ClientLoadReportingFilter> {
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ClientLoadReportingFilter> Create(
-      const ChannelArgs& args, ChannelFilter::Args filter_args);
+  class Call {
+   public:
+    void OnClientInitialMetadata(ClientMetadata& client_initial_metadata);
+    void OnServerInitialMetadata(ServerMetadata& server_initial_metadata);
+    void OnServerTrailingMetadata(ServerMetadata& server_trailing_metadata);
+    static const NoInterceptor OnServerToClientMessage;
+    static const NoInterceptor OnClientToServerMessage;
+    static const NoInterceptor OnFinalize;
 
-  // Construct a promise for one call.
-  ArenaPromise<ServerMetadataHandle> MakeCallPromise(
-      CallArgs call_args, NextPromiseFactory next_promise_factory) override;
+   private:
+    RefCountedPtr<GrpcLbClientStats> client_stats_;
+    bool saw_initial_metadata_ = false;
+  };
+
+  static absl::StatusOr<std::unique_ptr<ClientLoadReportingFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args filter_args);
 };
 
 }  // namespace grpc_core

src/core/resolver/xds/xds_resolver.cc

@@ -317,9 +317,10 @@ class XdsResolver final : public Resolver {
    public:
     const static grpc_channel_filter kFilter;
 
-    static absl::StatusOr<ClusterSelectionFilter> Create(
-        const ChannelArgs& /* unused */, ChannelFilter::Args filter_args) {
-      return ClusterSelectionFilter(filter_args);
+    static absl::StatusOr<std::unique_ptr<ClusterSelectionFilter>> Create(
+        const ChannelArgs& /* unused */,
+        ChannelFilter::Args /* filter_args */) {
+      return std::make_unique<ClusterSelectionFilter>();
     }
 
     // Construct a promise for one call.
@@ -332,12 +333,6 @@ class XdsResolver final : public Resolver {
       static const NoInterceptor OnServerToClientMessage;
       static const NoInterceptor OnFinalize;
     };
-
-   private:
-    explicit ClusterSelectionFilter(ChannelFilter::Args filter_args)
-        : filter_args_(filter_args) {}
-
-    ChannelFilter::Args filter_args_;
   };
 
   RefCountedPtr<ClusterRef> GetOrCreateClusterRef(

src/core/service_config/service_config_channel_arg_filter.cc

@@ -17,8 +17,6 @@
 // This filter reads GRPC_ARG_SERVICE_CONFIG and populates ServiceConfigCallData
 // in the call context per call for direct channels.
 
-#include <grpc/support/port_platform.h>
-
 #include <functional>
 #include <memory>
 #include <string>
@@ -30,6 +28,7 @@
 
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/log.h>
+#include <grpc/support/port_platform.h>
 
 #include "src/core/ext/filters/message_size/message_size_filter.h"
 #include "src/core/lib/channel/channel_args.h"
@@ -42,13 +41,13 @@
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/resource_quota/arena.h"
+#include "src/core/lib/surface/channel_stack_type.h"
+#include "src/core/lib/transport/metadata_batch.h"
+#include "src/core/lib/transport/transport.h"
 #include "src/core/service_config/service_config.h"
 #include "src/core/service_config/service_config_call_data.h"
 #include "src/core/service_config/service_config_impl.h"
 #include "src/core/service_config/service_config_parser.h"
-#include "src/core/lib/surface/channel_stack_type.h"
-#include "src/core/lib/transport/metadata_batch.h"
-#include "src/core/lib/transport/transport.h"
 
 namespace grpc_core {
 
@@ -59,9 +58,9 @@ class ServiceConfigChannelArgFilter final
  public:
   static const grpc_channel_filter kFilter;
 
-  static absl::StatusOr<ServiceConfigChannelArgFilter> Create(
+  static absl::StatusOr<std::unique_ptr<ServiceConfigChannelArgFilter>> Create(
       const ChannelArgs& args, ChannelFilter::Args) {
-    return ServiceConfigChannelArgFilter(args);
+    return std::make_unique<ServiceConfigChannelArgFilter>(args);
   }
 
   explicit ServiceConfigChannelArgFilter(const ChannelArgs& args) {

src/core/tsi/alts/handshaker/alts_tsi_handshaker.cc

@@ -24,6 +24,7 @@
 
 #include "upb/mem/arena.hpp"
 
+#include <grpc/credentials.h>
 #include <grpc/grpc_security.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log.h>