@ankhorage/infra 1.0.2 → 1.0.3

package/dist/adapters/minikube/base/supabaseMigrations.d.ts

@@ -0,0 +1,2 @@
+export declare function getSupabaseMigrationCommandScript(): string;
+//# sourceMappingURL=supabaseMigrations.d.ts.map

package/dist/adapters/minikube/base/supabaseMigrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabaseMigrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/supabaseMigrations.ts"],"names":[],"mappings":"AAAA,wBAAgB,iCAAiC,IAAI,MAAM,CAI1D"}

package/dist/adapters/minikube/base/supabaseMigrations.js

@@ -0,0 +1,6 @@
+export function getSupabaseMigrationCommandScript() {
+    return `echo "Applying pending Supabase migrations..."
+SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "\${SUPABASE_DB_URL}"
+echo "Supabase migrations applied."`;
+}
+//# sourceMappingURL=supabaseMigrations.js.map

package/dist/adapters/minikube/base/supabaseMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabaseMigrations.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/supabaseMigrations.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iCAAiC;IAC/C,OAAO;;oCAE2B,CAAC;AACrC,CAAC","sourcesContent":["export function getSupabaseMigrationCommandScript(): string {\n  return `echo \"Applying pending Supabase migrations...\"\nSUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url \"\\${SUPABASE_DB_URL}\"\necho \"Supabase migrations applied.\"`;\n}\n"]}

package/dist/adapters/minikube/secrets/supabase-vault/index.js

@@ -93,7 +93,8 @@ ${SUPABASE_VAULT_MIGRATION_PATH}
 \`\`\`
 
 is applied by the Kubernetes-owned Supabase migration lifecycle during \`scripts/up.sh\`
-with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
+with command-scoped CLI telemetry disabled around
+\`supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
 
 ## Security boundary
 

package/dist/adapters/minikube/secrets/supabase-vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAKnC,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E,CAAC;AAEjF,MAAM,UAAU,yCAAyC,CAAC,IAGzD;IACC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,mCAAmC,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,0CAA0C;gBAChD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;aACzC;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,yBAAyB,oCAAoC,EAAE,CAAC;QAC7E,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,OAAO,GAAG,4BAA4B,CAAC,IAAI,EAAE;SAC1C,OAAO,CACN,uEAAuE,EACvE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCR,CACC;SACA,IAAI,EAAE,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA4B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO;IAE5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,kDAAkD,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;;;;;+BAKsB,oCAAoC;;;;;;EAMjE,6BAA6B;;;;;;;;;;;;;;;;;;;;;;oCAsBK,SAAS;CAC5C,CAAC;AACF,CAAC","sourcesContent":["import {\n  SUPABASE_VAULT_MIGRATION_SQL,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport const SUPABASE_VAULT_MIGRATION_PATH =\n  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';\n\nexport function generateSupabaseVaultSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  validateOAuthSecretReferences(args.manifest);\n\n  return {\n    files: [\n      {\n        path: SUPABASE_VAULT_MIGRATION_PATH,\n        content: getCurrentSupabaseVaultMigrationSql(),\n      },\n      {\n        path: 'infra/minikube/secrets/supabase-vault.md',\n        content: getRuntimeGuide(args.namespace),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [],\n    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],\n    warnings: [],\n  };\n}\n\nfunction getCurrentSupabaseVaultMigrationSql(): string {\n  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()\n    .replace(\n      'create extension if not exists supabase_vault with schema extensions;',\n      () => `create schema if not exists vault;\ndo $$\nbegin\n  create extension if not exists supabase_vault with schema vault;\nexception\n  when insufficient_privilege then\n    create table if not exists vault.secrets (\n      id uuid primary key default gen_random_uuid(),\n      secret text not null,\n      name text,\n      description text,\n      created_at timestamptz not null default now()\n    );\n\n    create or replace function vault.create_secret(\n      secret text,\n      name text default null,\n      description text default null\n    )\n    returns uuid\n    language plpgsql\n    security definer\n    set search_path = vault, public\n    as $vault$\n    declare\n      secret_id uuid;\n    begin\n      insert into vault.secrets (secret, name, description)\n      values (secret, name, description)\n      returning id into secret_id;\n\n      return secret_id;\n    end;\n    $vault$;\n\n    create or replace view vault.decrypted_secrets as\n      select id, secret as decrypted_secret\n      from vault.secrets;\nend\n$$;`,\n    )\n    .trim()}\\n`;\n}\n\nfunction validateOAuthSecretReferences(manifest: InfraManifestInput): void {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return;\n\n  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (enabledProviders.length === 0) {\n    throw new Error('OAuth is enabled but no OAuth provider is enabled.');\n  }\n\n  for (const provider of enabledProviders) {\n    if (!provider.credentialsRef?.trim()) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" is enabled but does not define credentialsRef.`,\n      );\n    }\n  }\n}\n\nfunction getRuntimeGuide(namespace: string): string {\n  return `# Supabase Vault secret store\n\nThis project selects the provider-neutral secret-store backend through:\n\n\\`\\`\\`text\ninfra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}\n\\`\\`\\`\n\nThe immutable migration at:\n\n\\`\\`\\`text\n${SUPABASE_VAULT_MIGRATION_PATH}\n\\`\\`\\`\n\nis applied by the Kubernetes-owned Supabase migration lifecycle during \\`scripts/up.sh\\`\nwith \\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\n## Security boundary\n\n- Secret values are stored only through Supabase Vault.\n- Public manifests contain logical references such as \\`auth/oauth/google\\`, never values.\n- Project and environment scope are supplied by trusted server code.\n- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.\n- Bootstrap database access must come from trusted process environment or workload identity.\n- Do not expose service-role keys, provider secrets, or resolved payloads through\n  \\`NEXT_PUBLIC_*\\`, \\`EXPO_PUBLIC_*\\`, generated YAML, tracked JSON, or app bundles.\n\n## Trusted adapter composition\n\nUse \\`createInfraSecretStoreAdapter\\` from \\`@ankhorage/infra\\` in server-only code and pass\na trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection\nconfiguration does not belong in the manifest.\n\nGenerated Kubernetes namespace: \\`${namespace}\\`.\n`;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAKnC,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E,CAAC;AAEjF,MAAM,UAAU,yCAAyC,CAAC,IAGzD;IACC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,mCAAmC,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,0CAA0C;gBAChD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;aACzC;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,yBAAyB,oCAAoC,EAAE,CAAC;QAC7E,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,OAAO,GAAG,4BAA4B,CAAC,IAAI,EAAE;SAC1C,OAAO,CACN,uEAAuE,EACvE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCR,CACC;SACA,IAAI,EAAE,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA4B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO;IAE5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,kDAAkD,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;;;;;+BAKsB,oCAAoC;;;;;;EAMjE,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;oCAuBK,SAAS;CAC5C,CAAC;AACF,CAAC","sourcesContent":["import {\n  SUPABASE_VAULT_MIGRATION_SQL,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport const SUPABASE_VAULT_MIGRATION_PATH =\n  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';\n\nexport function generateSupabaseVaultSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  validateOAuthSecretReferences(args.manifest);\n\n  return {\n    files: [\n      {\n        path: SUPABASE_VAULT_MIGRATION_PATH,\n        content: getCurrentSupabaseVaultMigrationSql(),\n      },\n      {\n        path: 'infra/minikube/secrets/supabase-vault.md',\n        content: getRuntimeGuide(args.namespace),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [],\n    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],\n    warnings: [],\n  };\n}\n\nfunction getCurrentSupabaseVaultMigrationSql(): string {\n  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()\n    .replace(\n      'create extension if not exists supabase_vault with schema extensions;',\n      () => `create schema if not exists vault;\ndo $$\nbegin\n  create extension if not exists supabase_vault with schema vault;\nexception\n  when insufficient_privilege then\n    create table if not exists vault.secrets (\n      id uuid primary key default gen_random_uuid(),\n      secret text not null,\n      name text,\n      description text,\n      created_at timestamptz not null default now()\n    );\n\n    create or replace function vault.create_secret(\n      secret text,\n      name text default null,\n      description text default null\n    )\n    returns uuid\n    language plpgsql\n    security definer\n    set search_path = vault, public\n    as $vault$\n    declare\n      secret_id uuid;\n    begin\n      insert into vault.secrets (secret, name, description)\n      values (secret, name, description)\n      returning id into secret_id;\n\n      return secret_id;\n    end;\n    $vault$;\n\n    create or replace view vault.decrypted_secrets as\n      select id, secret as decrypted_secret\n      from vault.secrets;\nend\n$$;`,\n    )\n    .trim()}\\n`;\n}\n\nfunction validateOAuthSecretReferences(manifest: InfraManifestInput): void {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return;\n\n  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (enabledProviders.length === 0) {\n    throw new Error('OAuth is enabled but no OAuth provider is enabled.');\n  }\n\n  for (const provider of enabledProviders) {\n    if (!provider.credentialsRef?.trim()) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" is enabled but does not define credentialsRef.`,\n      );\n    }\n  }\n}\n\nfunction getRuntimeGuide(namespace: string): string {\n  return `# Supabase Vault secret store\n\nThis project selects the provider-neutral secret-store backend through:\n\n\\`\\`\\`text\ninfra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}\n\\`\\`\\`\n\nThe immutable migration at:\n\n\\`\\`\\`text\n${SUPABASE_VAULT_MIGRATION_PATH}\n\\`\\`\\`\n\nis applied by the Kubernetes-owned Supabase migration lifecycle during \\`scripts/up.sh\\`\nwith command-scoped CLI telemetry disabled around\n\\`supabase --yes migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\n## Security boundary\n\n- Secret values are stored only through Supabase Vault.\n- Public manifests contain logical references such as \\`auth/oauth/google\\`, never values.\n- Project and environment scope are supplied by trusted server code.\n- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.\n- Bootstrap database access must come from trusted process environment or workload identity.\n- Do not expose service-role keys, provider secrets, or resolved payloads through\n  \\`NEXT_PUBLIC_*\\`, \\`EXPO_PUBLIC_*\\`, generated YAML, tracked JSON, or app bundles.\n\n## Trusted adapter composition\n\nUse \\`createInfraSecretStoreAdapter\\` from \\`@ankhorage/infra\\` in server-only code and pass\na trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection\nconfiguration does not belong in the manifest.\n\nGenerated Kubernetes namespace: \\`${namespace}\\`.\n`;\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {

package/src/adapters/minikube/README.md

@@ -25,7 +25,7 @@ when provided by caller.
 
 ## Runtime Scripts
 
-- `scripts/up.sh`: starts `minikube -p <slug>`, applies manifests, waits for Supabase, runs migrations with `supabase migration up --db-url "$SUPABASE_DB_URL"`, builds/loads the app image, and starts slug-owned port-forwards.
+- `scripts/up.sh`: starts `minikube -p <slug>`, applies manifests, waits for Supabase, runs migrations with CLI telemetry disabled for that command, builds/loads the app image, and starts slug-owned port-forwards.
 - `scripts/down.sh`: stops slug-owned port-forwards, then runs `minikube stop -p <slug>`. Persistent profile data remains.
 - `scripts/reset.sh`: requires `ANKH_RESET_CONFIRM=<slug>` and deletes/recreates namespaces `app` and `supabase`, including Supabase DB and Storage PVC data. It does not delete the Minikube profile.
 - `scripts/destroy.sh`: stops slug-owned port-forwards and runs `minikube delete -p <slug>`.
@@ -37,7 +37,14 @@ when provided by caller.
 
 Runtime ownership is Kubernetes. Migration authoring/history remains Supabase migration
 files. Migration execution targets the Kubernetes Postgres endpoint via
-`supabase migration up --db-url "$SUPABASE_DB_URL"`.
+`SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "$SUPABASE_DB_URL"`.
+The migration process does not require stdin. `--yes` remains defense in depth for future
+CLI prompts; it is not the hang fix. Command-scoped telemetry disable avoids the unbounded
+telemetry shutdown in Supabase CLI 2.106.0 when PostHog is blocked, without changing the
+user's persistent telemetry preference. Migration failures remain fatal under
+`set -Eeuo pipefail`, and the completion message is printed only after a zero exit status.
+The lifecycle adds no migration deadline and supports the affected CLI version; using a
+current Supabase CLI is still recommended.
 
 The generated manifests are based on the current official Supabase self-hosting Docker
 topology, service documentation, environment-variable contracts, and pinned official

package/src/adapters/minikube/base/index.test.ts

@@ -69,10 +69,22 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
     const readme = getFile(result.files, 'infra/minikube/README.md');
 
-    expect(upScript).toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
+    const migrationFunction = upScript.slice(
+      upScript.indexOf('run_supabase_migrations()'),
+      upScript.indexOf('reconcile_supabase_profile()'),
+    );
+
+    expect(migrationFunction).toContain(
+      'SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "${SUPABASE_DB_URL}"',
+    );
+    expect(migrationFunction).not.toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
+    expect(migrationFunction).toContain('echo "Applying pending Supabase migrations..."');
+    expect(migrationFunction).toContain('echo "Supabase migrations applied."');
     expect(upScript).toContain('export SUPABASE_DB_URL PGSSLMODE=disable');
     expect(upScript).not.toContain('migration up --local');
     expect(upScript).toContain('cd "${ROOT_DIR}"');
+    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
+    expect(migrationFunction).toContain('if [[ -d "${ROOT_DIR}/supabase/migrations" ]]; then');
     expect(upScript).toContain('set_required_env_default POSTGRES_PASSWORD "$(random_hex 32)"');
     expect(upScript).not.toContain('set_env_default POSTGRES_PASSWORD "$(random_base64');
     expect(upScript).toContain(
@@ -82,6 +94,30 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     expect(readme).toContain('Migration authoring/history remains Supabase');
   });
 
+  test('preserves Supabase-disabled migration behavior', () => {
+    const result = generateInfrastructure(
+      {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      {
+        appManifest: createAppManifest('frontend-only'),
+      },
+    );
+    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+    const migrationFunction = upScript.slice(
+      upScript.indexOf('run_supabase_migrations()'),
+      upScript.indexOf('reconcile_supabase_profile()'),
+    );
+
+    expect(upScript).toContain('SUPABASE_RUNTIME_ENABLED="false"');
+    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
+    expect(migrationFunction).toContain('return 0');
+  });
+
   test('lists and generates Supabase Kubernetes bootstrap and gateway contract files', () => {
     const result = generateInfrastructure(createSupabaseManifest(), {
       appManifest: createAppManifest('scanner'),

package/src/adapters/minikube/base/index.ts

@@ -3,6 +3,7 @@ import type { InfraManifestInput } from '../../../types';
 import type { ResolvedProfileModel } from '../auth/supabase/profile';
 import { resolveSupabaseProfileModel } from '../auth/supabase/profile';
 import type { MinikubeProviderLifecycle } from '../contracts';
+import { getSupabaseMigrationCommandScript } from './supabaseMigrations';
 
 export const APP_NAMESPACE = 'app';
 const SUPABASE_NAMESPACE = 'supabase';
@@ -379,7 +380,7 @@ host-level Supabase Compose runtime.
 
 ## Lifecycle Semantics
 
-- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`, starts slug-owned port-forwards, and deploys the app runtime.
+- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with CLI telemetry disabled for that command, starts slug-owned port-forwards, and deploys the app runtime.
 - \`down.sh\`: stops slug-owned port-forwards, then stops \`minikube -p ${appSlug}\`. Persistent data remains in the profile.
 - \`reset.sh\`: requires \`ANKH_RESET_CONFIRM=${appSlug}\`; ${resetDescription}. It does not delete the Minikube profile.
 - \`destroy.sh\`: deletes only \`minikube -p ${appSlug}\`.
@@ -392,7 +393,13 @@ ${resourceLines}
 
 Supabase runtime ownership is Kubernetes. Migration authoring/history remains Supabase
 migration files. Migration execution targets the Kubernetes Postgres endpoint through
-\`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
+\`SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
+The migration process does not require stdin. \`--yes\` remains defense in depth for future
+CLI prompts; it is not the hang fix. Command-scoped telemetry disable avoids the unbounded
+telemetry shutdown in Supabase CLI 2.106.0 when PostHog is blocked, without changing the
+user's persistent telemetry preference. Migration failures stop \`up.sh\`, and the completion
+message is printed only after a zero exit status. No migration deadline is added; using a
+current Supabase CLI remains recommended.
 
 Supabase manifests are generated from the current official Supabase self-hosting Docker
 topology, service documentation, environment-variable contracts, and pinned official images.
@@ -2266,6 +2273,7 @@ function getUpScript(args: {
     oauthProviders,
     secretStoreProvider,
   });
+  const supabaseMigrationCommand = getSupabaseMigrationCommandScript();
 
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -2621,7 +2629,7 @@ run_supabase_migrations() {
     require_command supabase
     (
       cd "\${ROOT_DIR}"
-      supabase migration up --db-url "\${SUPABASE_DB_URL}"
+${indentShellBlock(supabaseMigrationCommand, 6)}
     )
   fi
 }

package/src/adapters/minikube/base/supabaseMigrations.test.ts

@@ -0,0 +1,168 @@
+import { type ChildProcess, spawn } from 'node:child_process';
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { describe, expect, test } from 'bun:test';
+
+import { getSupabaseMigrationCommandScript } from './supabaseMigrations';
+
+const FAKE_DB_URL = 'postgres://fake-user:fake-password@127.0.0.1:5432/fake-database';
+
+describe('generated Supabase migration command', () => {
+  test('disables CLI telemetry for closed-stdin migrations and reports progress', async () => {
+    const result = await runGeneratedMigrationCommand(0);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.timedOut).toBe(false);
+    expect(result.stdout).toContain('Applying pending Supabase migrations...');
+    expect(result.stdout).toContain('Supabase migrations applied.');
+    expect(result.stderr).toContain('fake Supabase migration output');
+    expect(result.args).toEqual(['--yes', 'migration', 'up', '--db-url', FAKE_DB_URL]);
+    expect(result.telemetryDisabled).toBe('1');
+    expect(result.stdout).not.toContain(FAKE_DB_URL);
+    expect(result.stderr).not.toContain(FAKE_DB_URL);
+  });
+
+  test('propagates migration failures without reporting completion', async () => {
+    const result = await runGeneratedMigrationCommand(23);
+
+    expect(result.exitCode).toBe(23);
+    expect(result.timedOut).toBe(false);
+    expect(result.stdout).toContain('Applying pending Supabase migrations...');
+    expect(result.stdout).not.toContain('Supabase migrations applied.');
+    expect(result.stderr).toContain('fake Supabase migration output');
+    expect(result.telemetryDisabled).toBe('1');
+    expect(result.stdout).not.toContain(FAKE_DB_URL);
+    expect(result.stderr).not.toContain(FAKE_DB_URL);
+  });
+});
+
+async function runGeneratedMigrationCommand(fakeExitCode: number): Promise<{
+  args: string[];
+  exitCode: number | null;
+  stderr: string;
+  stdout: string;
+  telemetryDisabled: string;
+  timedOut: boolean;
+}> {
+  const root = await mkdtemp(path.join(tmpdir(), 'ankh-infra-supabase-migrations-'));
+
+  try {
+    const fakeBin = path.join(root, 'bin');
+    const fakeSupabase = path.join(fakeBin, 'supabase');
+    const argsFile = path.join(root, 'supabase-args');
+    const telemetryFile = path.join(root, 'supabase-telemetry-disabled');
+    const scriptFile = path.join(root, 'run-migrations.sh');
+    await mkdir(fakeBin, { recursive: true });
+    await writeFile(
+      fakeSupabase,
+      `#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\\n' "$@" > "\${ARGS_FILE:?}"
+printf '%s\\n' "\${SUPABASE_TELEMETRY_DISABLED:-}" > "\${TELEMETRY_FILE:?}"
+
+echo "fake Supabase migration output" >&2
+
+# Supabase CLI 2.106.0 reached this kind of unbounded telemetry shutdown after
+# database work when PostHog was blocked. The generated lifecycle must suppress
+# telemetry for this automation-only command so neither the wrapper nor its Go
+# child can remain waiting after migration completion or failure.
+if [[ "\${SUPABASE_TELEMETRY_DISABLED:-}" != "1" ]]; then
+  while true; do
+    sleep 1
+  done
+fi
+
+exit "\${FAKE_SUPABASE_EXIT_CODE:-0}"
+`,
+      'utf8',
+    );
+    await chmod(fakeSupabase, 0o755);
+    await writeFile(
+      scriptFile,
+      `#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SUPABASE_DB_URL="${FAKE_DB_URL}"
+export SUPABASE_DB_URL
+
+${getSupabaseMigrationCommandScript()}
+`,
+      'utf8',
+    );
+    await chmod(scriptFile, 0o755);
+
+    const child = spawn('bash', [scriptFile], {
+      cwd: root,
+      env: {
+        ...process.env,
+        ARGS_FILE: argsFile,
+        FAKE_SUPABASE_EXIT_CODE: String(fakeExitCode),
+        PATH: `${fakeBin}:${process.env.PATH ?? ''}`,
+        TELEMETRY_FILE: telemetryFile,
+      },
+      detached: process.platform !== 'win32',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    const { exitCode, timedOut } = await waitForChild(child, 2_000);
+
+    return {
+      args: (await readFile(argsFile, 'utf8')).trim().split('\n'),
+      exitCode,
+      stderr,
+      stdout,
+      telemetryDisabled: (await readFile(telemetryFile, 'utf8')).trim(),
+      timedOut,
+    };
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+async function waitForChild(
+  child: ChildProcess,
+  timeoutMs: number,
+): Promise<{ exitCode: number | null; timedOut: boolean }> {
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    terminateChildTree(child);
+  }, timeoutMs);
+
+  try {
+    const exitCode = await new Promise<number | null>((resolve, reject) => {
+      child.once('error', reject);
+      child.once('close', resolve);
+    });
+    return { exitCode, timedOut };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function terminateChildTree(child: ChildProcess): void {
+  if (child.pid === undefined) return;
+
+  if (process.platform !== 'win32') {
+    try {
+      process.kill(-child.pid, 'SIGKILL');
+      return;
+    } catch {
+      // The process may already have exited between the timeout and cleanup.
+    }
+  }
+
+  child.kill('SIGKILL');
+}

package/src/adapters/minikube/base/supabaseMigrations.ts

@@ -0,0 +1,5 @@
+export function getSupabaseMigrationCommandScript(): string {
+  return `echo "Applying pending Supabase migrations..."
+SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "\${SUPABASE_DB_URL}"
+echo "Supabase migrations applied."`;
+}

package/src/adapters/minikube/secrets/supabase-vault/index.ts

@@ -115,7 +115,8 @@ ${SUPABASE_VAULT_MIGRATION_PATH}
 \`\`\`
 
 is applied by the Kubernetes-owned Supabase migration lifecycle during \`scripts/up.sh\`
-with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
+with command-scoped CLI telemetry disabled around
+\`supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
 
 ## Security boundary
 

package/src/index.test.ts

@@ -85,7 +85,10 @@ describe('generateInfrastructure', () => {
     expect(upScript).not.toContain('SUPABASE_RUNTIME_ENABLED="${SUPABASE_RUNTIME_ENABLED');
     expect(upScript).toContain('minikube start -p "${PROFILE}"');
     expect(upScript).toContain('kubectl --context "${PROFILE}" apply -k "${K8S_DIR}"');
-    expect(upScript).toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
+    expect(upScript).toContain(
+      'SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "${SUPABASE_DB_URL}"',
+    );
+    expect(upScript).not.toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
     expect(upScript).toContain('create secret generic supabase-runtime-secrets');
     expect(upScript).toContain('create secret generic supabase-public-runtime');
     expect(upScript).toContain('rollout status deployment/app-runtime --timeout=180s');