feat: add multi-engine regex flavour support

scripts/generate-toolbox-manifest.mjs

@@ -1,4 +1,4 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { lstat, readFile, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { format } from "prettier";
@@ -8,6 +8,7 @@ const sourcePath = join(root, "src", "toolbox", "manifest.source.json");
 const outputPath = join(root, "public", "toolbox-app.json");
 const packagePath = join(root, "package.json");
 const applicationVersionPath = join(root, "src", "version.ts");
+const publicPath = join(root, "public");
 const checkOnly = process.argv.includes("--check");
 
 const source = JSON.parse(await readFile(sourcePath, "utf8"));
@@ -34,6 +35,25 @@ if (
   throw new Error("Manifest source identity is incomplete or inconsistent");
 }
 
+if (!Array.isArray(source.assets)) {
+  throw new Error("Manifest assets must be an array");
+}
+for (const asset of source.assets) {
+  if (
+    typeof asset !== "string" ||
+    !asset.startsWith("./") ||
+    asset.includes("\\") ||
+    asset.split("/").includes("..")
+  ) {
+    throw new Error(`Unsafe manifest asset path: ${JSON.stringify(asset)}`);
+  }
+  const candidate = join(publicPath, asset.slice(2));
+  const details = await lstat(candidate).catch(() => null);
+  if (!details?.isFile() || details.isSymbolicLink()) {
+    throw new Error(`Manifest asset is missing or unsafe: ${asset}`);
+  }
+}
+
 const serialized = await format(JSON.stringify(source), {
   filepath: outputPath,
 });