Bootstrap initial NAS administrator on empty database

deploy/bootstrap-admin.mjs

@@ -0,0 +1,29 @@
+// Run after migrations, before the container accepts requests. The conditional
+// insert is atomic: existing accounts (including disabled ones) are never replaced.
+import { execFileSync } from 'node:child_process';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+
+const id = randomUUID();
+const key = `dune-admin.${id}.${randomBytes(32).toString('hex')}`;
+const hash = createHash('sha256').update(key).digest('hex');
+const now = Date.now();
+const sql = `INSERT INTO admin_accounts (id, name, role, key_hash, enabled, session_generation, created_at, updated_at)
+SELECT '${id}', 'Initial owner', 'owner', '${hash}', 1, 0, ${now}, ${now}
+WHERE NOT EXISTS (SELECT 1 FROM admin_accounts)
+RETURNING id;`;
+const output = execFileSync(process.execPath, [
+  'node_modules/wrangler/bin/wrangler.js', 'd1', 'execute', 'DB',
+  '--local', '--config', 'tools/wrangler.local.json',
+  '--persist-to', process.env.DUNE_STATE_PATH || '/data',
+  '--command', sql, '--json',
+], { encoding: 'utf8' });
+const result = JSON.parse(output);
+if (!Array.isArray(result) || result.length !== 1 || result[0].success !== true ||
+    !Array.isArray(result[0].results)) {
+  throw new Error('Initial administrator provisioning did not return a valid result');
+}
+if (result[0].results.length === 1 && result[0].results[0].id === id) {
+  console.log(`Initial administrator access key (save privately; shown only on first provisioning): ${key}`);
+} else if (result[0].results.length !== 0) {
+  throw new Error('Initial administrator provisioning returned an unexpected account');
+}