[A-EDev]

Summary

Each meta value in a roster entry must now be base64url and nothing else, and an entry can't carry an empty meta object, as flow-sync #103 specifies.

• The check compares every byte, with no pattern, so a trailing newline can't slip past an end anchor.
• meta stays opaque past that: it isn't decoded at parse, so non-canonical trailing bits and a length that can't be decoded both stay valid, and such a name is only left out when shown.
• apply_entry runs the same shape check as parse_entry. A LAN welcome's entries arrive without parse_entry, so one that broke the rule would have been saved at join and then failed to read back.
• The replacement vectors now go through parse_entry, so a parser that decoded meta would fail them.
• a_signed_name_that_can_not_be_read_is_left_out used a value the rule now refuses; it uses one of an undecodable length instead.
• Vectors from flow-sync a050bfc, byte for byte. The fixtures README is that commit's whole file, which also brings its pairing line up to date.

The 16 KiB limit in UTF-8 bytes in that PR is the server's, so nothing changes here for it.

Follows flow-sync #103.

Related issue

None.

Change type

• Feature

Validation

Run on macOS arm64.

• pnpm test: not run, no frontend file changed
• pnpm build: not run, no frontend file changed
• cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check: exit 0
• cargo clippy --all-targets --all-features in src-tauri: exit 0, no warnings from this change; one existing warning in roster.rs on a function it doesn't touch
• cargo test --no-fail-fast --all-targets --all-features in src-tauri: 1286 passed, 0 failed, 9 ignored
• I smoke-tested the affected desktop behavior. Nothing ran in a real window.

Before the change, the roster negatives failed. Checked by breaking the code on purpose, one change at a time, with sync2_roster:

Change	Tests that failed
Padding is allowed	2
Any byte is allowed	2
Only the first byte is checked	2
Trailing whitespace isn't checked	2
- is refused	6
_ is refused	6
An empty value is allowed	2
An empty object is allowed	2
meta is decoded strictly at parse	1
apply_entry skips the shape check	1

Risk and compatibility

• No format or database change. Both apps already write unpadded base64url.

• apply_entry now also refuses any other shape fault in an entry that skipped the parser, on the LAN welcome path.

• A group that already holds an entry breaking this rule stops at that entry. Only a hand-made entry can do that.

• Not run against Android or a server under this rule.

• Overlaps other open PRs on roster.json, the fixtures README and the changelog, so whichever lands later takes the fixtures again.

• No new secrets, private data, telemetry, or broad Tauri permissions were introduced.

• User-facing documentation was updated where needed. (spec/protocol.md in flow-sync chore(deps): bump the compatible-updates group across 1 directory with 20 updates #103)

• Dependency and lockfile changes are intentional and limited to this PR. (none)

• Breaking changes and upgrade steps are clearly documented. (none for honest clients)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.