feat(hololake): render bounded release front door config

product-source/hololake-native-desktop/server/release-broadcast/README.md

@@ -23,6 +23,14 @@ preserve the full request URI. Its loopback tunnel port remains deliberately
 unassigned until the BS-GZ-006 route owner returns the live, non-conflicting
 topology.
 
+Once that port is returned and independently verified, `render-front-door.mjs
+--loopback-port PORT` renders the bounded Nginx location. It refuses an omitted
+port, preserves the full public request path by leaving `proxy_pass` without a
+URI suffix, accepts only GET and HEAD, forwards no request body, and strips
+authorization, cookies, and client forwarding headers. Rendering is not
+deployment; Nginx validation, transactional install, public certificate/readback,
+and a separate server receipt remain required.
+
 `operator.mjs` supplies the separate, root-operated verification and activation
 boundary. `verify` reconstructs a private candidate tree and accepts it only when
 the broadcast, pipeline receipt, package bytes, Developer ID receipt, Apple

product-source/hololake-native-desktop/server/release-broadcast/render-front-door.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+const PORT_PATTERN = /^(?:[1-9]\d{3,4})$/
+
+const fail = (code) => {
+  throw new Error(code)
+}
+
+export function renderFrontDoorSnippet(portValue) {
+  const text = String(portValue ?? '')
+  if (!PORT_PATTERN.test(text)) fail('HOLOLAKE_RELEASE_FRONT_DOOR_PORT_REQUIRED')
+  const port = Number(text)
+  if (!Number.isInteger(port) || port < 1024 || port > 65535) fail('HOLOLAKE_RELEASE_FRONT_DOOR_PORT_INVALID')
+  return `location = /hololake/releases {
+    return 308 /hololake/releases/;
+}
+
+location ^~ /hololake/releases/ {
+    limit_except GET HEAD { deny all; }
+    client_max_body_size 0;
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header Connection "";
+    proxy_set_header Authorization "";
+    proxy_set_header Cookie "";
+    proxy_set_header X-Forwarded-For "";
+    proxy_set_header X-Forwarded-Host "";
+    proxy_set_header X-Forwarded-Proto "";
+    proxy_pass_request_body off;
+    proxy_set_header Content-Length "";
+    proxy_connect_timeout 2s;
+    proxy_send_timeout 10s;
+    proxy_read_timeout 60s;
+}
+`
+}
+
+export function main(argv = process.argv.slice(2)) {
+  const portIndex = argv.indexOf('--loopback-port')
+  if (portIndex < 0 || portIndex + 1 >= argv.length || argv.length !== 2) {
+    fail('HOLOLAKE_RELEASE_FRONT_DOOR_USAGE:--loopback-port PORT')
+  }
+  process.stdout.write(renderFrontDoorSnippet(argv[portIndex + 1]))
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) {
+  try {
+    main()
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+    process.exitCode = 1
+  }
+}