From #655

Text:

Currently, Librarian does not validate the IDs specified in the state file, but it is likely that
we will add constraints later. Those constraints are likely to be primarily around characters (e.g.
only printable characters, potentially only ASCII and prohibiting some characters that could cause
issues when used as a filename, e.g. /) - and an empty library ID is likely to be prohibited.

Comment from jba@:

Go has pretty good rules for this. See https://pkg.go.dev/golang.org/x/[email protected]/module#CheckPath.