[A-EDev]

Summary

Follows flow-sync #103, spec/protocol.md: every meta value must match ^[A-Za-z0-9_-]+$ in full, and an entry with an empty meta object is refused. wellFormed in Roster.kt checks both with Regex.matches, a full match, so a trailing newline doesn't pass.

Past that, meta stays opaque until its device opens it. It isn't decoded at parse, so a value with trailing bits or a length that can't decode is valid, as the new replacements cases say. deviceNames already leaves out a name it can't read.

Vectors: roster.json comes byte for byte from flow-sync #103 (a050bfc), with its README row.

Related issue

None. Follows flow-sync #103, which should land first.

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

All Gradle commands ran with --offline -Dorg.gradle.jvmargs="-Xmx4096m -XX:MaxMetaspaceSize=1024m -Dfile.encoding=UTF-8 -Djava.net.preferIPv6Addresses=true".

• :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*': 301 tests, 0 failed.

• ktlintCheck: exit 0.

• Before the change, RosterTest.invalid_entries_are_rejected_for_the_named_reason failed on the new vectors (meta-not-base64url).

• Each of these made a test fail when tried: any non-empty value, a partial match, ^...$ as a partial match, an empty value allowed, an empty object allowed, and strict decoding at parse.

• ./gradlew :app:assembleGithubDebug: not run locally, CI builds it.

• ./gradlew :app:testGithubDebugUnitTest: full suite not run locally, CI runs it.

• I ran any additional flavor-specific build or test tasks affected by this change.

• I manually tested the affected behavior on an Android device or emulator: not done.

Test device and Android version: none.

Risk and compatibility

The app already writes unpadded base64url, so nothing it writes changes. No nightly note: nothing an honest group sees changes. roster.json and the vector README also change in the other open PR that follows flow-sync #101 and in #1831.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources. (None added.)
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented. (None.)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.