Validate portable workspace identifiers

internal/artifacts/catalog_test.go

@@ -114,6 +114,26 @@ func TestArtifactCatalogRejectsSelectedUnknownArtifact(t *testing.T) {
 	}
 }
 
+func TestArtifactCatalogRejectsUnsafeArtifactKeys(t *testing.T) {
+	unsafe := []string{"", "artifact/name", `artifact\name`, "artifact-name", "café"}
+	for _, key := range unsafe {
+		t.Run("configured", func(t *testing.T) {
+			catalog := NewArtifactCatalog()
+			err := catalog.RegisterConfiguredArtifacts(map[string]ConfiguredArtifactDefinition{key: {OutputPath: "artifacts/output.md"}}, nil)
+			if err == nil {
+				t.Fatalf("RegisterConfiguredArtifacts(%q) error = nil, want rejection", key)
+			}
+		})
+		t.Run("extraction", func(t *testing.T) {
+			catalog := NewArtifactCatalog()
+			err := catalog.RegisterExtractionArtifacts(map[string]ExtractionArtifactDefinition{key: {LaneID: "lane"}})
+			if err == nil {
+				t.Fatalf("RegisterExtractionArtifacts(%q) error = nil, want rejection", key)
+			}
+		})
+	}
+}
+
 func TestArtifactCatalogRejectsConfiguredSourceConflictAcrossRegistrations(t *testing.T) {
 	catalog := NewArtifactCatalog()
 	if err := catalog.RegisterConfiguredArtifacts(