Function isHeaderSafe

packages/cli/src/auth/store.ts:385–394

(s: string)

 * `Authorization` / `x-api-key` (RFC 7230 header injection).
 */
export function isHeaderSafe(s: string): boolean {
  // Reject U+0000-U+001F (C0 controls) and U+007F (DEL) — bytes that
  // aren't allowed in HTTP header values. Using charCodeAt avoids
  // embedding control characters in regex source (lint requirement).
  for (let i = 0; i < s.length; i++) {
    const c = s.charCodeAt(i);
    if (c < 0x20 || c === 0x7f) return false;
  }
  return true;
}

/**
 * Strict variant: returns the string when present and non-empty,