anthropic 1.31.0 → 1.42.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8aab10e21c0279e597f589729ae1c75eea479e40c20230c1dce25277e60e5c5e
-  data.tar.gz: d8fabdc1a69bf3f1306913776d8025363288328d0a2f293953e13736f8833bb2
+  metadata.gz: 5babf593055aa56b8e86a7cbf3b2485d7b6e0a73d6c44a89ecf3bfa467c7863a
+  data.tar.gz: 0a1f49bd358d4bd27ea403115b22da8180af21afbacac24489801074f6815db5
 SHA512:
-  metadata.gz: 7768d7acc3a779b8a599854bf04ca18ee8c2d66888fcfc9702d926d903d9866ec84f092d06ca5d9fc55dcf5aed3101056e76048ceaf0435ae6bfae067eeee392
-  data.tar.gz: fca1a27acd1ac6d990f4008e8575d8b9d8b193da7f0ca70563a3fb30328dfa059aad62a1c075f1f35c3cb0d5136d6860be55c955866912dca08e6cc7703f29d0
+  metadata.gz: 99b5b9414478942809c6b2a5b26441f236e2322fdca0d310b794ebdd0fec20dcea666330514bb5ec1bf580549a60909890eb09e890f054308ecb2a9b0cdcb028
+  data.tar.gz: 720e57337738ec199b4f6eaddd64584d368db6961ffcf91256a598d2ae2638e06ec5dd126b51d46d065b5abd2e25d45f4dcd1c41c098e98c2d84e76205766578

data/CHANGELOG.md

@@ -1,5 +1,162 @@
 # Changelog
 
+## 1.42.0 (2026-05-19)
+
+Full Changelog: [v1.41.0...v1.42.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.41.0...v1.42.0)
+
+### Features
+
+* **client:** Add support for self-hosted sandboxes in CMA with sandbox helpers ([27813ed](https://github.com/anthropics/anthropic-sdk-ruby/commit/27813ed45134e075b0d1f180d00407c54c34dbe1))
+
+## 1.41.0 (2026-05-13)
+
+Full Changelog: [v1.40.0...v1.41.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.40.0...v1.41.0)
+
+### Features
+
+* **api:** Add BetaManagedAgentsSearchResultBlock types ([1432542](https://github.com/anthropics/anthropic-sdk-ruby/commit/1432542b303269f23d35e5b6891518a32b5fa934))
+* **api:** Add support for cache diagnostics beta ([7ada493](https://github.com/anthropics/anthropic-sdk-ruby/commit/7ada4935e83b955b2f0b19e2940bc7dc3d336bc1))
+* **mcp:** add mcp helpers ([#934](https://github.com/anthropics/anthropic-sdk-ruby/issues/934)) ([de5b608](https://github.com/anthropics/anthropic-sdk-ruby/commit/de5b60875486a62534fb95ca13153819c601af92))
+
+
+### Bug Fixes
+
+* avoid gzip buffering during streaming on non-beta messages ([#936](https://github.com/anthropics/anthropic-sdk-ruby/issues/936)) ([8b7f779](https://github.com/anthropics/anthropic-sdk-ruby/commit/8b7f779bd9bdfc7693de679832531c32c215909a))
+* **client:** elide content type header on requests without body ([c58745a](https://github.com/anthropics/anthropic-sdk-ruby/commit/c58745aea5725531ba89aac2d64b3914232833c2))
+* handle syntax updates for ruby 4's PRISM parser ([#189](https://github.com/anthropics/anthropic-sdk-ruby/issues/189)) ([772dd65](https://github.com/anthropics/anthropic-sdk-ruby/commit/772dd65733bfd2869f846b6a9734776ed87ee7d6))
+
+
+### Chores
+
+* **api:** spec updates ([0e85c3f](https://github.com/anthropics/anthropic-sdk-ruby/commit/0e85c3f8064dd1951ef00c06ac9a709f7067eb70))
+
+## 1.40.0 (2026-05-11)
+
+Full Changelog: [v1.39.0...v1.40.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.39.0...v1.40.0)
+
+### Features
+
+* **aws:** Add AWS client for Claude Platform on AWS ([3c24797](https://github.com/anthropics/anthropic-sdk-ruby/commit/3c2479737666f61f1096b07c30412fffdfabe133))
+
+
+### Bug Fixes
+
+* **aws,bedrock:** materialize streamed request body before SigV4 signing ([#927](https://github.com/anthropics/anthropic-sdk-ruby/issues/927)) ([5b6d9d4](https://github.com/anthropics/anthropic-sdk-ruby/commit/5b6d9d4bfcb2a9e3fcc14a5683f6e25a205791a2))
+
+## 1.39.0 (2026-05-06)
+
+Full Changelog: [v1.38.0...v1.39.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.38.0...v1.39.0)
+
+### Features
+
+* **api:** add support for Managed Agents multiagents and outcomes, webhooks, vault validation ([21230ec](https://github.com/anthropics/anthropic-sdk-ruby/commit/21230ecd2fd7dac66600f984c7e34383cf122d7a))
+* **client:** add aws sso config resolution ([#887](https://github.com/anthropics/anthropic-sdk-ruby/issues/887)) ([4a0476a](https://github.com/anthropics/anthropic-sdk-ruby/commit/4a0476ada4e1549965971fce3272a7a9dee8faaa))
+
+
+### Bug Fixes
+
+* **api:** Adjust webhook configuration ([e587f17](https://github.com/anthropics/anthropic-sdk-ruby/commit/e587f17eae68e656586f73a9a880e4f9ab8b94fe))
+
+## 1.38.0 (2026-05-05)
+
+Full Changelog: [v1.37.0...v1.38.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.37.0...v1.38.0)
+
+### Features
+
+* **client:** allow targeting a workspace for OIDC federation token exchange ([85f4668](https://github.com/anthropics/anthropic-sdk-ruby/commit/85f46687b798714bed259e6b78e07bc4df114046))
+
+## 1.37.0 (2026-05-04)
+
+Full Changelog: [v1.36.0...v1.37.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.36.0...v1.37.0)
+
+### Features
+
+* **api:** improve Managed Agents APIs ([34caf5b](https://github.com/anthropics/anthropic-sdk-ruby/commit/34caf5b0994bc818a7ee835832624853cc0a2abe))
+* **client:** add Workload Identity Federation, interactive OAuth, and auth profiles ([4d394a4](https://github.com/anthropics/anthropic-sdk-ruby/commit/4d394a419f6219cf46ca459083510c89f44041a7))
+* support setting headers via env ([08e8b38](https://github.com/anthropics/anthropic-sdk-ruby/commit/08e8b382e8795ebb008daea6769550374952b301))
+
+## 1.36.0 (2026-04-23)
+
+Full Changelog: [v1.35.0...v1.36.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.35.0...v1.36.0)
+
+### Features
+
+* **api:** CMA Memory public beta ([9fafd1a](https://github.com/anthropics/anthropic-sdk-ruby/commit/9fafd1abe16d0398c6e59be0717a9ef9cb014347))
+
+
+### Bug Fixes
+
+* **api:** fix errors in api spec ([074fa8d](https://github.com/anthropics/anthropic-sdk-ruby/commit/074fa8dac4cdebc8eababcac95ca4fe9dc7970d3))
+* **api:** restore missing features ([4496fac](https://github.com/anthropics/anthropic-sdk-ruby/commit/4496facb8130e48340a2c4107d3aaf412b5cf4eb))
+* avoid gzip buffering during streaming ([307c594](https://github.com/anthropics/anthropic-sdk-ruby/commit/307c5944e27dd3eab5aa3c6f6e7ed02ca5b7cece))
+
+
+### Chores
+
+* **internal:** more robust bootstrap script ([e8f157e](https://github.com/anthropics/anthropic-sdk-ruby/commit/e8f157e44e664c036c0b81584eee8919d55eb6db))
+* **tests:** bump steady to v0.22.1 ([7f079ce](https://github.com/anthropics/anthropic-sdk-ruby/commit/7f079cee1a662245ce67c12b1b7790832dd931ad))
+
+## 1.35.0 (2026-04-16)
+
+Full Changelog: [v1.34.0...v1.35.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.34.0...v1.35.0)
+
+### Features
+
+* **api:** add claude-opus-4-7, token budgets and user_profiles ([026649a](https://github.com/anthropics/anthropic-sdk-ruby/commit/026649ae9a26108258ef8de6532eb02e429e87d9))
+
+
+### Chores
+
+* **ci:** remove release-doctor workflow ([0947aca](https://github.com/anthropics/anthropic-sdk-ruby/commit/0947acaf0af66d9918f6a6faea03ab8f129932af))
+
+## 1.34.0 (2026-04-14)
+
+Full Changelog: [v1.33.1...v1.34.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.33.1...v1.34.0)
+
+### Features
+
+* **api:** mark Sonnet and Opus 4 as deprecated ([287e6c4](https://github.com/anthropics/anthropic-sdk-ruby/commit/287e6c471b24ef580260224675dddd08218dcd68))
+* **bedrock:** use auth header for mantle client ([#894](https://github.com/anthropics/anthropic-sdk-ruby/issues/894)) ([2ac3bba](https://github.com/anthropics/anthropic-sdk-ruby/commit/2ac3bbaa1a20f7af1069aa1ff4bcc2b3ef7123c6))
+
+## 1.33.1 (2026-04-13)
+
+Full Changelog: [v1.33.0...v1.33.1](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.33.0...v1.33.1)
+
+### Bug Fixes
+
+* **streaming:** add missing events ([cf312ed](https://github.com/anthropics/anthropic-sdk-ruby/commit/cf312edbafca255394ba7d446827fcd28cbbdb77))
+
+
+### Documentation
+
+* update examples ([05d1ab6](https://github.com/anthropics/anthropic-sdk-ruby/commit/05d1ab635b860db6eaa4179f3be98fb052800acd))
+
+## 1.33.0 (2026-04-10)
+
+Full Changelog: [v1.32.0...v1.33.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.32.0...v1.33.0)
+
+### Features
+
+* vertex eu region ([#897](https://github.com/anthropics/anthropic-sdk-ruby/issues/897)) ([11191ce](https://github.com/anthropics/anthropic-sdk-ruby/commit/11191ced086daff14ee7b352ac075db8a2c565cc))
+
+
+### Documentation
+
+* improve examples ([8405e94](https://github.com/anthropics/anthropic-sdk-ruby/commit/8405e9439ed806224f03b196e772d5046a6bd379))
+
+## 1.32.0 (2026-04-09)
+
+Full Changelog: [v1.31.0...v1.32.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.31.0...v1.32.0)
+
+### Features
+
+* **api:** Add beta advisor tool ([f749344](https://github.com/anthropics/anthropic-sdk-ruby/commit/f749344e0f74c02b3e58d6fcd403313615bc98a3))
+
+
+### Bug Fixes
+
+* multipart encoding for file arrays ([e6aae8b](https://github.com/anthropics/anthropic-sdk-ruby/commit/e6aae8b5e223e0dd2f72590c0c654a4fa629dcb1))
+
 ## 1.31.0 (2026-04-08)
 
 Full Changelog: [v1.30.0...v1.31.0](https://github.com/anthropics/anthropic-sdk-ruby/compare/v1.30.0...v1.31.0)

data/README.md

@@ -15,7 +15,7 @@ Add to your application's Gemfile:
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "anthropic", "~> 1.31.0"
+gem "anthropic", "~> 1.42.0"
 ```
 
 <!-- x-release-please-end -->

data/lib/anthropic/client.rb

@@ -1,6 +1,32 @@
 # frozen_string_literal: true
 
 module Anthropic
+  @warned_explicit_shadow = false
+  @warned_env_shadow = false
+
+  class << self
+    def warn_explicit_static_shadows_credentials(param)
+      return if @warned_explicit_shadow
+      @warned_explicit_shadow = true
+
+      warn(
+        "[anthropic-ruby] `#{param}:` was passed alongside `credentials:`; the static credential " \
+        "takes precedence and the credentials provider is silently disabled. " \
+        "Pass only one."
+      )
+    end
+
+    def warn_env_static_shadows_auto_discovery(env_var)
+      return if @warned_env_shadow
+      @warned_env_shadow = true
+
+      warn(
+        "[anthropic-ruby] #{env_var} is set and takes precedence over the SDK's profile / federation " \
+        "auto-discovery; unset #{env_var} to use the auto-discovered credential."
+      )
+    end
+  end
+
   class Client < Anthropic::Internal::Transport::BaseClient
     # Default max number of retries to attempt after a failed retryable request.
     DEFAULT_MAX_RETRIES = 2
@@ -33,6 +59,15 @@ module Anthropic
     # @return [String, nil]
     attr_reader :auth_token
 
+    # @return [String, nil]
+    attr_reader :webhook_key
+
+    # @return [Object, nil]
+    attr_reader :credentials
+
+    # @return [Anthropic::Credentials::TokenCache, nil]
+    attr_reader :token_cache
+
     # @return [Anthropic::Resources::Completions]
     attr_reader :completions
 
@@ -49,23 +84,19 @@ module Anthropic
     #
     # @return [Hash{String=>String}]
     private def auth_headers
-      {**api_key_auth, **bearer_auth}
-    end
-
-    # @api private
-    #
-    # @return [Hash{String=>String}]
-    private def api_key_auth
-      {"x-api-key" => @api_key}
-    end
+      headers = {}
 
-    # @api private
-    #
-    # @return [Hash{String=>String}]
-    private def bearer_auth
-      return {} if @auth_token.nil?
+      if @api_key
+        headers["x-api-key"] = @api_key
+      elsif @auth_token
+        headers["authorization"] = "Bearer #{@auth_token}"
+      elsif @token_cache
+        token = @token_cache.get_token
+        headers["authorization"] = "Bearer #{token}"
+        headers["anthropic-beta"] = Anthropic::Credentials::OAUTH_API_BETA_HEADER
+      end
 
-      {"authorization" => "Bearer #{@auth_token}"}
+      headers
     end
 
     # Calculate the timeout for non-streaming requests based on token count
@@ -91,12 +122,51 @@ module Anthropic
 
     # Creates and returns a new client for interacting with the API.
     #
-    # @param api_key [String, nil] Defaults to `ENV["ANTHROPIC_API_KEY"]`
+    # Credential precedence, matching the credential-resolution spec and
+    # the Workload Identity Federation user guide:
+    #
+    # 1. Explicit constructor arguments — +api_key:+, +auth_token:+,
+    #    +credentials:+, +config:+. If the caller passed any of these,
+    #    the SDK uses it and does *not* read credential env vars.
+    # 2. +ANTHROPIC_API_KEY+ / +ANTHROPIC_AUTH_TOKEN+ env vars. Only
+    #    consulted when no explicit credential argument was passed.
+    # 3. +ANTHROPIC_PROFILE+ — explicit profile selection.
+    # 4. Direct env-var federation (+ANTHROPIC_IDENTITY_TOKEN[_FILE]+ +
+    #    +ANTHROPIC_FEDERATION_RULE_ID+ + +ANTHROPIC_ORGANIZATION_ID+).
+    # 5. Fallback active profile from disk (+active_config+ pointer or
+    #    the literal +default+).
+    #
+    # A static env credential (step 2) *shadows* steps 3–5, silently
+    # disabling profile / federation auto-discovery.
     #
-    # @param auth_token [String, nil] Defaults to `ENV["ANTHROPIC_AUTH_TOKEN"]`
+    # Passing an explicit +api_key:+ or +auth_token:+ *argument*
+    # alongside an explicit +credentials:+ is supported: the
+    # static credential takes precedence at the request-header level and
+    # the credentials provider is silently disabled.
+    #
+    # @param api_key [String, nil] Defaults to +ENV["ANTHROPIC_API_KEY"]+ when
+    #   no explicit credential argument is passed.
+    #
+    # @param auth_token [String, nil] Defaults to +ENV["ANTHROPIC_AUTH_TOKEN"]+ when
+    #   no explicit credential argument is passed.
+    #
+    # @param credentials [#call, nil] Credential provider — any callable returning
+    #   +AccessToken.new(token:, expires_at:)+. The provider is wrapped in a
+    #   +TokenCache+ for thread-safe caching and proactive refresh (120s advisory /
+    #   30s mandatory before expiry). Common providers: +WorkloadIdentity+,
+    #   +CredentialsFile+, +StaticToken+, or a custom lambda.
+    #
+    # @param config [Hash, nil] In-memory configuration hash with the same shape
+    #   as +configs/<profile>.json+. Must include an +authentication+ object with
+    #   a +type+ field (+oidc_federation+ or +user_oauth+). Mutually exclusive
+    #   with +credentials:+. For +user_oauth+, must also include
+    #   +authentication.credentials_path+.
+    #
+    # @param webhook_key [String, nil] Defaults to `ENV["ANTHROPIC_WEBHOOK_SIGNING_KEY"]`
     #
     # @param base_url [String, nil] Override the default base URL for the API, e.g.,
-    # `"https://api.example.com/v2/"`. Defaults to `ENV["ANTHROPIC_BASE_URL"]`
+    #   +"https://api.example.com/v2/"+. Defaults to +ENV["ANTHROPIC_BASE_URL"]+,
+    #   then to the profile's +base_url+ if present, then to +https://api.anthropic.com+.
     #
     # @param max_retries [Integer] Max number of retries to attempt after a failed retryable request.
     #
@@ -106,22 +176,88 @@ module Anthropic
     #
     # @param max_retry_delay [Float]
     def initialize(
-      api_key: ENV["ANTHROPIC_API_KEY"],
-      auth_token: ENV["ANTHROPIC_AUTH_TOKEN"],
-      base_url: ENV["ANTHROPIC_BASE_URL"],
+      api_key: nil,
+      auth_token: nil,
+      webhook_key: ENV["ANTHROPIC_WEBHOOK_SIGNING_KEY"],
+      credentials: nil,
+      config: nil,
+      base_url: nil,
       max_retries: self.class::DEFAULT_MAX_RETRIES,
       timeout: self.class::DEFAULT_TIMEOUT_IN_SECONDS,
       initial_retry_delay: self.class::DEFAULT_INITIAL_RETRY_DELAY,
       max_retry_delay: self.class::DEFAULT_MAX_RETRY_DELAY
     )
+      if config && credentials
+        raise ArgumentError, "Pass at most one of `credentials:` or `config:`."
+      end
+
+      has_explicit_credential = api_key || auth_token || credentials || config
+
+      unless has_explicit_credential
+        api_key = ENV["ANTHROPIC_API_KEY"]
+        auth_token = ENV["ANTHROPIC_AUTH_TOKEN"]
+      end
+
+      @api_key = api_key&.to_s
+      @auth_token = auth_token&.to_s
+      @credentials = nil
+      @token_cache = nil
+
+      base_url_is_explicit = base_url && !base_url.empty?
+      base_url ||= ENV["ANTHROPIC_BASE_URL"]
+
+      credential_headers = {}
+
+      if config
+        in_memory = Anthropic::Credentials::InMemoryConfig.new(config)
+        @credentials = in_memory
+        credential_headers = in_memory.extra_headers
+        if !base_url_is_explicit && in_memory.resolved_base_url
+          base_url = in_memory.resolved_base_url
+        end
+      else
+        @credentials = credentials
+      end
+
+      if @credentials.nil? && @api_key.nil? && @auth_token.nil?
+        default_base_url = base_url || "https://api.anthropic.com"
+        result = Anthropic::Credentials.default_credentials(base_url: default_base_url)
+        if result
+          @credentials = result.provider
+          credential_headers = result.extra_headers
+          base_url = result.base_url if !base_url_is_explicit && result.base_url
+        end
+      end
+
+      warn_explicit_shadow(api_key: api_key, auth_token: auth_token, credentials: credentials || config)
+      warn_env_shadow(api_key: api_key, auth_token: auth_token)
+
+      if @credentials
+        @token_cache = Anthropic::Credentials::TokenCache.new(@credentials)
+      end
+
       base_url ||= "https://api.anthropic.com"
 
+      if @credentials.respond_to?(:bind_base_url)
+        @credentials.bind_base_url(base_url)
+      end
+
       headers = {
         "anthropic-version" => "2023-06-01"
       }
-
-      @api_key = api_key&.to_s
-      @auth_token = auth_token&.to_s
+      custom_headers_env = ENV["ANTHROPIC_CUSTOM_HEADERS"]
+      unless custom_headers_env.nil?
+        parsed = {}
+        custom_headers_env.split("\n").each do |line|
+          colon = line.index(":")
+          unless colon.nil?
+            parsed[line[0...colon].strip] = line[(colon + 1)..].strip
+          end
+        end
+        headers = parsed.merge(headers)
+      end
+      headers = headers.merge(credential_headers)
+      @webhook_key = webhook_key&.to_s
 
       super(
         base_url: base_url,
@@ -137,5 +273,38 @@ module Anthropic
       @models = Anthropic::Resources::Models.new(client: self)
       @beta = Anthropic::Resources::Beta.new(client: self)
     end
+
+    # @api private
+    #
+    # @param status [Integer]
+    # @param headers [Hash{String=>String}]
+    #
+    # @return [Boolean]
+    def retry_request?(status, headers:)
+      if status == 401 && @token_cache
+        @token_cache.invalidate
+        return true
+      end
+      super
+    end
+
+    private
+
+    def warn_explicit_shadow(api_key:, auth_token:, credentials:)
+      return if credentials.nil?
+
+      Anthropic.warn_explicit_static_shadows_credentials("api_key") if api_key
+      Anthropic.warn_explicit_static_shadows_credentials("auth_token") if auth_token
+    end
+
+    def warn_env_shadow(api_key:, auth_token:)
+      return unless Anthropic::Credentials.auto_discoverable_credentials?
+
+      if api_key && ENV["ANTHROPIC_API_KEY"]
+        Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_API_KEY")
+      end
+      return unless auth_token && ENV["ANTHROPIC_AUTH_TOKEN"]
+      Anthropic.warn_env_static_shadows_auto_discovery("ANTHROPIC_AUTH_TOKEN")
+    end
   end
 end

data/lib/anthropic/credentials/access_token.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Anthropic
+  module Credentials
+    # An Anthropic API access token with optional expiry.
+    #
+    # This is a frozen value object representing an access token and its
+    # expiration time. The +expires_at+ is a Unix timestamp in seconds;
+    # +nil+ means no expiry information (the token will be treated as
+    # never-expires by {TokenCache}).
+    class AccessToken
+      # @return [String] the access token string
+      attr_reader :token
+
+      # @return [Integer, nil] Unix timestamp in seconds when the token expires,
+      #   or +nil+ if the token never expires
+      attr_reader :expires_at
+
+      # @param token [String] the access token string
+      # @param expires_at [Integer, nil] Unix timestamp in seconds, or +nil+ for no expiry
+      def initialize(token:, expires_at: nil)
+        @token = token
+        @expires_at = expires_at
+        freeze
+      end
+
+      # @return [Integer] hash code for the token
+      def hash
+        [token, expires_at].hash
+      end
+
+      def ==(other)
+        return false unless other.is_a?(AccessToken)
+        token == other.token && expires_at == other.expires_at
+      end
+
+      alias_method :eql?, :==
+    end
+  end
+end

data/lib/anthropic/credentials/config.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "uri"
+
+module Anthropic
+  module Config
+    class << self
+      def config_file_path(profile)
+        validate_profile_name!(profile)
+        Anthropic::Credentials.config_file_path(profile)
+      end
+
+      def credentials_file_path(profile)
+        validate_profile_name!(profile)
+        Anthropic::Credentials.config_dir.join("credentials", "#{profile}.json")
+      end
+
+      def active_profile
+        profile = Anthropic::Credentials.active_profile
+        validate_profile_name!(profile)
+        profile
+      end
+
+      def active_profile_config?
+        config_file_path(active_profile).file?
+      rescue Anthropic::Errors::ConfigurationError
+        false
+      end
+
+      def validate_profile_name!(profile, source: "profile name")
+        if profile.nil? || profile.empty?
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} must not be empty"
+        end
+        if profile != profile.strip
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} '#{profile}' has leading/trailing whitespace"
+        end
+        if profile.start_with?(".")
+          raise Anthropic::Errors::ConfigurationError,
+                "#{source} '#{profile}' must not start with a dot"
+        end
+
+        ["/", "\\", File::SEPARATOR].each do |sep|
+          next if sep.empty?
+          if profile.include?(sep)
+            raise Anthropic::Errors::ConfigurationError,
+                  "#{source} '#{profile}' must not contain path separators"
+          end
+        end
+
+        return unless profile.include?("\x00")
+        raise Anthropic::Errors::ConfigurationError, "#{source} '#{profile}' must not contain null bytes"
+      end
+
+      def require_https!(url, field:)
+        begin
+          uri = URI.parse(url.to_s)
+        rescue URI::InvalidURIError
+          raise Anthropic::Errors::ConfigurationError,
+                "#{field} is not a valid URL (got '#{url}')"
+        end
+
+        return if uri.scheme == "https"
+        return if uri.scheme == "http" && %w[localhost 127.0.0.1 ::1].include?(uri.hostname)
+
+        raise Anthropic::Errors::ConfigurationError,
+              "#{field} must use https (got '#{url}'); the token-exchange endpoint " \
+              "carries secret material and cannot be used over cleartext HTTP."
+      end
+    end
+  end
+end