Function is_credential_hook 

pub fn is_credential_hook(hook_name: &str) -> bool

Whether a hook carries raw credentials.

Only identity.resolve and token.delegate do: they are the only two hooks whose Python payload models a raw token at all (IdentityPayload.raw_token, DelegationPayload.bearer_token). The Python Extensions model has no raw-credential slot, so no other hook has anywhere to receive one.