Add portable Windows desktop downloads and release uploads

tests/deploy-vercel.test.ts

@@ -188,3 +188,43 @@ test("failed builds and rejected authentication never report success", async ()
     /Vercel 401/,
   );
 });
+
+test("large desktop releases upload as binary before deployment and failures stop release", async () => {
+  const binary = Buffer.alloc(10 * 1024 * 1024 + 1, 7);
+  const payload = deploymentPayload([
+    {
+      file: "public/desktop/MineGeo.exe",
+      data: binary.toString("base64"),
+      encoding: "base64",
+    },
+  ]);
+  const requests: { url: string; init: RequestInit }[] = [];
+  await deploy(payload, {
+    token: "test",
+    log: () => {},
+    request: async (url, init = {}) => {
+      requests.push({ url: String(url), init });
+      return new Response(
+        JSON.stringify(
+          String(url).includes("/v2/files")
+            ? {}
+            : { id: "release", readyState: "READY", url: "example.invalid" },
+        ),
+      );
+    },
+  });
+  assert.ok(requests[0].url.includes("/v2/files"));
+  assert.deepEqual(requests[0].init.body, binary);
+  const file = JSON.parse(requests[1].init.body as string).files[0];
+  assert.equal(file.size, binary.length);
+  assert.match(file.sha, /^[a-f0-9]{40}$/);
+  assert.equal(file.data, undefined);
+  await assert.rejects(
+    deploy(payload, {
+      token: "test",
+      log: () => {},
+      request: async () => new Response("", { status: 403 }),
+    }),
+    /file upload failed/,
+  );
+});

tests/desktop.test.ts

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+const { isInternal, isExternal } = require("../desktop/navigation.cjs");
+
+test("desktop navigation confines remote content to the production origin", () => {
+  assert.equal(isInternal("https://minegeo.vercel.app/play?map=1"), true);
+  for (const url of [
+    "http://minegeo.vercel.app",
+    "https://minegeo.vercel.app.evil.test",
+    "https://minegeo.vercel.app@evil.test",
+    "file:///C:/Windows",
+    "javascript:alert(1)",
+    "not a URL",
+  ]) {
+    assert.equal(isInternal(url), false, url);
+  }
+});
+
+test("desktop only opens credential-free HTTPS links in external apps", () => {
+  assert.equal(isExternal("https://discord.com/invite/example"), true);
+  for (const url of [
+    "file:///C:/Windows",
+    "javascript:alert(1)",
+    "ms-settings:windowsupdate",
+    "http://example.com",
+    "https://user:password@example.com",
+    "not a URL",
+  ]) {
+    assert.equal(isExternal(url), false, url);
+  }
+});