Consolidate path safety, temp downloads, and cleanup validation helpers

internal/config/validate.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"fmt"
 	"net/url"
 	"path/filepath"
@@ -9,6 +10,7 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/artifactmodel"
+	"gitea.maximumdirect.net/eric/narratio/internal/pathsafe"
 )
 
 // Validate checks resolved configuration for required fields and parseable durations.
@@ -152,10 +154,17 @@ func validatePublish(cfg *PublishConfig, scriptorium *ScriptoriumConfig) error {
 			dest = derivedDest
 			cfg.Outputs[i].Dest = derivedDest
 		}
-		if err := validateRelativeSafePath(prefix+".dest", dest); err != nil {
-			return err
+		normalizedDest, err := pathsafe.NormalizeRelativeDestination(dest)
+		if err != nil {
+			switch {
+			case errors.Is(err, pathsafe.ErrRelativePathAbsolute):
+				return fmt.Errorf("%s.dest must be a relative path", prefix)
+			case errors.Is(err, pathsafe.ErrRelativePathEscape):
+				return fmt.Errorf("%s.dest must not contain path traversal", prefix)
+			default:
+				return fmt.Errorf("%s.dest must be non-empty", prefix)
+			}
 		}
-		normalizedDest := filepath.ToSlash(filepath.Clean(dest))
 		if _, ok := seenDest[normalizedDest]; ok {
 			return fmt.Errorf("%s.dest %q duplicates another publish output destination", prefix, dest)
 		}