@ankhorage/infra 1.0.2 → 1.0.4

package/dist/adapters/minikube/base/supabaseMigrations.d.ts

@@ -0,0 +1,2 @@
+export declare function getSupabaseMigrationCommandScript(): string;
+//# sourceMappingURL=supabaseMigrations.d.ts.map

package/dist/adapters/minikube/base/supabaseMigrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabaseMigrations.d.ts","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/supabaseMigrations.ts"],"names":[],"mappings":"AAAA,wBAAgB,iCAAiC,IAAI,MAAM,CAI1D"}

package/dist/adapters/minikube/base/supabaseMigrations.js

@@ -0,0 +1,6 @@
+export function getSupabaseMigrationCommandScript() {
+    return `echo "Applying pending Supabase migrations..."
+SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "\${SUPABASE_DB_URL}"
+echo "Supabase migrations applied."`;
+}
+//# sourceMappingURL=supabaseMigrations.js.map

package/dist/adapters/minikube/base/supabaseMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabaseMigrations.js","sourceRoot":"","sources":["../../../../src/adapters/minikube/base/supabaseMigrations.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iCAAiC;IAC/C,OAAO;;oCAE2B,CAAC;AACrC,CAAC","sourcesContent":["export function getSupabaseMigrationCommandScript(): string {\n  return `echo \"Applying pending Supabase migrations...\"\nSUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url \"\\${SUPABASE_DB_URL}\"\necho \"Supabase migrations applied.\"`;\n}\n"]}

package/dist/adapters/minikube/secrets/supabase-vault/index.js

@@ -93,7 +93,8 @@ ${SUPABASE_VAULT_MIGRATION_PATH}
 \`\`\`
 
 is applied by the Kubernetes-owned Supabase migration lifecycle during \`scripts/up.sh\`
-with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
+with command-scoped CLI telemetry disabled around
+\`supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
 
 ## Security boundary
 

package/dist/adapters/minikube/secrets/supabase-vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAKnC,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E,CAAC;AAEjF,MAAM,UAAU,yCAAyC,CAAC,IAGzD;IACC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,mCAAmC,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,0CAA0C;gBAChD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;aACzC;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,yBAAyB,oCAAoC,EAAE,CAAC;QAC7E,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,OAAO,GAAG,4BAA4B,CAAC,IAAI,EAAE;SAC1C,OAAO,CACN,uEAAuE,EACvE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCR,CACC;SACA,IAAI,EAAE,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA4B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO;IAE5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,kDAAkD,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;;;;;+BAKsB,oCAAoC;;;;;;EAMjE,6BAA6B;;;;;;;;;;;;;;;;;;;;;;oCAsBK,SAAS;CAC5C,CAAC;AACF,CAAC","sourcesContent":["import {\n  SUPABASE_VAULT_MIGRATION_SQL,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport const SUPABASE_VAULT_MIGRATION_PATH =\n  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';\n\nexport function generateSupabaseVaultSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  validateOAuthSecretReferences(args.manifest);\n\n  return {\n    files: [\n      {\n        path: SUPABASE_VAULT_MIGRATION_PATH,\n        content: getCurrentSupabaseVaultMigrationSql(),\n      },\n      {\n        path: 'infra/minikube/secrets/supabase-vault.md',\n        content: getRuntimeGuide(args.namespace),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [],\n    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],\n    warnings: [],\n  };\n}\n\nfunction getCurrentSupabaseVaultMigrationSql(): string {\n  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()\n    .replace(\n      'create extension if not exists supabase_vault with schema extensions;',\n      () => `create schema if not exists vault;\ndo $$\nbegin\n  create extension if not exists supabase_vault with schema vault;\nexception\n  when insufficient_privilege then\n    create table if not exists vault.secrets (\n      id uuid primary key default gen_random_uuid(),\n      secret text not null,\n      name text,\n      description text,\n      created_at timestamptz not null default now()\n    );\n\n    create or replace function vault.create_secret(\n      secret text,\n      name text default null,\n      description text default null\n    )\n    returns uuid\n    language plpgsql\n    security definer\n    set search_path = vault, public\n    as $vault$\n    declare\n      secret_id uuid;\n    begin\n      insert into vault.secrets (secret, name, description)\n      values (secret, name, description)\n      returning id into secret_id;\n\n      return secret_id;\n    end;\n    $vault$;\n\n    create or replace view vault.decrypted_secrets as\n      select id, secret as decrypted_secret\n      from vault.secrets;\nend\n$$;`,\n    )\n    .trim()}\\n`;\n}\n\nfunction validateOAuthSecretReferences(manifest: InfraManifestInput): void {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return;\n\n  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (enabledProviders.length === 0) {\n    throw new Error('OAuth is enabled but no OAuth provider is enabled.');\n  }\n\n  for (const provider of enabledProviders) {\n    if (!provider.credentialsRef?.trim()) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" is enabled but does not define credentialsRef.`,\n      );\n    }\n  }\n}\n\nfunction getRuntimeGuide(namespace: string): string {\n  return `# Supabase Vault secret store\n\nThis project selects the provider-neutral secret-store backend through:\n\n\\`\\`\\`text\ninfra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}\n\\`\\`\\`\n\nThe immutable migration at:\n\n\\`\\`\\`text\n${SUPABASE_VAULT_MIGRATION_PATH}\n\\`\\`\\`\n\nis applied by the Kubernetes-owned Supabase migration lifecycle during \\`scripts/up.sh\\`\nwith \\`supabase migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\n## Security boundary\n\n- Secret values are stored only through Supabase Vault.\n- Public manifests contain logical references such as \\`auth/oauth/google\\`, never values.\n- Project and environment scope are supplied by trusted server code.\n- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.\n- Bootstrap database access must come from trusted process environment or workload identity.\n- Do not expose service-role keys, provider secrets, or resolved payloads through\n  \\`NEXT_PUBLIC_*\\`, \\`EXPO_PUBLIC_*\\`, generated YAML, tracked JSON, or app bundles.\n\n## Trusted adapter composition\n\nUse \\`createInfraSecretStoreAdapter\\` from \\`@ankhorage/infra\\` in server-only code and pass\na trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection\nconfiguration does not belong in the manifest.\n\nGenerated Kubernetes namespace: \\`${namespace}\\`.\n`;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/adapters/minikube/secrets/supabase-vault/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,2BAA2B,CAAC;AAKnC,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E,CAAC;AAEjF,MAAM,UAAU,yCAAyC,CAAC,IAGzD;IACC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,mCAAmC,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,0CAA0C;gBAChD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;aACzC;SACF;QACD,SAAS,EAAE,EAAE;QACb,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,yBAAyB,oCAAoC,EAAE,CAAC;QAC7E,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,OAAO,GAAG,4BAA4B,CAAC,IAAI,EAAE;SAC1C,OAAO,CACN,uEAAuE,EACvE,GAAG,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuCR,CACC;SACA,IAAI,EAAE,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,6BAA6B,CAAC,QAA4B;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO;IAE5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,EAAE,kDAAkD,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,OAAO;;;;;+BAKsB,oCAAoC;;;;;;EAMjE,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;oCAuBK,SAAS;CAC5C,CAAC;AACF,CAAC","sourcesContent":["import {\n  SUPABASE_VAULT_MIGRATION_SQL,\n  SUPABASE_VAULT_SECRET_STORE_PROVIDER,\n} from '@ankhorage/supabase-vault';\n\nimport type { InfraManifestInput } from '../../../../types';\nimport type { MinikubeAdapterArtifacts } from '../../contracts';\n\nexport const SUPABASE_VAULT_MIGRATION_PATH =\n  'infra/minikube/supabase/migrations/202607120001_ankhorage_supabase_vault.sql';\n\nexport function generateSupabaseVaultSecretStoreArtifacts(args: {\n  readonly manifest: InfraManifestInput;\n  readonly namespace: string;\n}): MinikubeAdapterArtifacts {\n  validateOAuthSecretReferences(args.manifest);\n\n  return {\n    files: [\n      {\n        path: SUPABASE_VAULT_MIGRATION_PATH,\n        content: getCurrentSupabaseVaultMigrationSql(),\n      },\n      {\n        path: 'infra/minikube/secrets/supabase-vault.md',\n        content: getRuntimeGuide(args.namespace),\n      },\n    ],\n    resources: [],\n    providerLifecycle: [],\n    envEntries: [`SECRET_STORE_PROVIDER=${SUPABASE_VAULT_SECRET_STORE_PROVIDER}`],\n    warnings: [],\n  };\n}\n\nfunction getCurrentSupabaseVaultMigrationSql(): string {\n  return `${SUPABASE_VAULT_MIGRATION_SQL.trim()\n    .replace(\n      'create extension if not exists supabase_vault with schema extensions;',\n      () => `create schema if not exists vault;\ndo $$\nbegin\n  create extension if not exists supabase_vault with schema vault;\nexception\n  when insufficient_privilege then\n    create table if not exists vault.secrets (\n      id uuid primary key default gen_random_uuid(),\n      secret text not null,\n      name text,\n      description text,\n      created_at timestamptz not null default now()\n    );\n\n    create or replace function vault.create_secret(\n      secret text,\n      name text default null,\n      description text default null\n    )\n    returns uuid\n    language plpgsql\n    security definer\n    set search_path = vault, public\n    as $vault$\n    declare\n      secret_id uuid;\n    begin\n      insert into vault.secrets (secret, name, description)\n      values (secret, name, description)\n      returning id into secret_id;\n\n      return secret_id;\n    end;\n    $vault$;\n\n    create or replace view vault.decrypted_secrets as\n      select id, secret as decrypted_secret\n      from vault.secrets;\nend\n$$;`,\n    )\n    .trim()}\\n`;\n}\n\nfunction validateOAuthSecretReferences(manifest: InfraManifestInput): void {\n  const oauth = manifest.auth?.oauth;\n  if (!oauth?.enabled) return;\n\n  const enabledProviders = oauth.providers.filter((provider) => provider.enabled !== false);\n  if (enabledProviders.length === 0) {\n    throw new Error('OAuth is enabled but no OAuth provider is enabled.');\n  }\n\n  for (const provider of enabledProviders) {\n    if (!provider.credentialsRef?.trim()) {\n      throw new Error(\n        `OAuth provider \"${provider.id}\" is enabled but does not define credentialsRef.`,\n      );\n    }\n  }\n}\n\nfunction getRuntimeGuide(namespace: string): string {\n  return `# Supabase Vault secret store\n\nThis project selects the provider-neutral secret-store backend through:\n\n\\`\\`\\`text\ninfra.secretStore.provider = ${SUPABASE_VAULT_SECRET_STORE_PROVIDER}\n\\`\\`\\`\n\nThe immutable migration at:\n\n\\`\\`\\`text\n${SUPABASE_VAULT_MIGRATION_PATH}\n\\`\\`\\`\n\nis applied by the Kubernetes-owned Supabase migration lifecycle during \\`scripts/up.sh\\`\nwith command-scoped CLI telemetry disabled around\n\\`supabase --yes migration up --db-url \"$SUPABASE_DB_URL\"\\`.\n\n## Security boundary\n\n- Secret values are stored only through Supabase Vault.\n- Public manifests contain logical references such as \\`auth/oauth/google\\`, never values.\n- Project and environment scope are supplied by trusted server code.\n- The browser may receive secret metadata, but must never receive resolved values or Vault IDs.\n- Bootstrap database access must come from trusted process environment or workload identity.\n- Do not expose service-role keys, provider secrets, or resolved payloads through\n  \\`NEXT_PUBLIC_*\\`, \\`EXPO_PUBLIC_*\\`, generated YAML, tracked JSON, or app bundles.\n\n## Trusted adapter composition\n\nUse \\`createInfraSecretStoreAdapter\\` from \\`@ankhorage/infra\\` in server-only code and pass\na trusted Supabase Vault SQL client. The app manifest chooses the provider; privileged connection\nconfiguration does not belong in the manifest.\n\nGenerated Kubernetes namespace: \\`${namespace}\\`.\n`;\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ankhorage/infra",
   "type": "module",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Project-aware infrastructure generation library and executable Ankh provider for Ankhorage.",
   "homepage": "https://github.com/ankhorage/infra#readme",
   "bugs": {

package/src/adapters/minikube/README.md

@@ -25,7 +25,7 @@ when provided by caller.
 
 ## Runtime Scripts
 
-- `scripts/up.sh`: starts `minikube -p <slug>`, applies manifests, waits for Supabase, runs migrations with `supabase migration up --db-url "$SUPABASE_DB_URL"`, builds/loads the app image, and starts slug-owned port-forwards.
+- `scripts/up.sh`: starts `minikube -p <slug>`, applies manifests, waits for Supabase, runs migrations with CLI telemetry disabled for that command, builds/loads the app image, and starts slug-owned port-forwards.
 - `scripts/down.sh`: stops slug-owned port-forwards, then runs `minikube stop -p <slug>`. Persistent profile data remains.
 - `scripts/reset.sh`: requires `ANKH_RESET_CONFIRM=<slug>` and deletes/recreates namespaces `app` and `supabase`, including Supabase DB and Storage PVC data. It does not delete the Minikube profile.
 - `scripts/destroy.sh`: stops slug-owned port-forwards and runs `minikube delete -p <slug>`.
@@ -37,7 +37,14 @@ when provided by caller.
 
 Runtime ownership is Kubernetes. Migration authoring/history remains Supabase migration
 files. Migration execution targets the Kubernetes Postgres endpoint via
-`supabase migration up --db-url "$SUPABASE_DB_URL"`.
+`SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "$SUPABASE_DB_URL"`.
+The migration process does not require stdin. `--yes` remains defense in depth for future
+CLI prompts; it is not the hang fix. Command-scoped telemetry disable avoids the unbounded
+telemetry shutdown in Supabase CLI 2.106.0 when PostHog is blocked, without changing the
+user's persistent telemetry preference. Migration failures remain fatal under
+`set -Eeuo pipefail`, and the completion message is printed only after a zero exit status.
+The lifecycle adds no migration deadline and supports the affected CLI version; using a
+current Supabase CLI is still recommended.
 
 The generated manifests are based on the current official Supabase self-hosting Docker
 topology, service documentation, environment-variable contracts, and pinned official
@@ -48,7 +55,9 @@ official Supabase Kubernetes distribution.
 
 - Default app image: `ankh/<slug>:dev`.
 - By default `up.sh` triggers `build-app-image.sh` (`APP_BUILD_ENABLED=true`) before apply.
-- `build-app-image.sh` runs `bunx expo export --platform web`, then builds via `app-image/Dockerfile`.
+- `build-app-image.sh` runs `bunx expo export --platform web --clear`, then builds via
+  `app-image/Dockerfile`. Clearing the Expo/Metro cache ensures rotated `EXPO_PUBLIC_*`
+  values replace cached transforms before the browser bundle and Docker image are created.
 - `up.sh` syncs runtime image using `APP_IMAGE_SYNC_STRATEGY`:
   - `docker-load` (default): loads existing local Docker image into the app profile.
   - `minikube-build`: builds exported web artifacts directly into the profile image store.
@@ -74,6 +83,10 @@ For local Expo/Metro development, `up.sh` also mirrors only the browser-safe
 app root `.env.local`, preserving unrelated entries. Restart Expo after Infra Up so the
 client bundle sees the refreshed public Supabase values.
 
+Only browser-safe `EXPO_PUBLIC_SUPABASE_URL` and `EXPO_PUBLIC_SUPABASE_ANON_KEY` values are
+eligible for client bundling. Service-role and other privileged Supabase credentials remain
+outside the app public environment and must never be referenced through `EXPO_PUBLIC_*` names.
+
 ## Practical Selector Rule
 
 When building config UI or pickers, only show currently supported values from adapter-owned

package/src/adapters/minikube/base/appImageBuild.test.ts

@@ -0,0 +1,263 @@
+import { spawn } from 'node:child_process';
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { expect, test } from 'bun:test';
+
+import { generateInfrastructure } from '../../../index';
+import { createAppManifest } from '../../../testSupport';
+
+const APP_SLUG = 'cache-rotation';
+const PUBLIC_URL = 'http://127.0.0.1:65431';
+const PUBLIC_KEY_A = 'fixture-public-anon-key-a';
+const PUBLIC_KEY_B = 'fixture-public-anon-key-b';
+const PRIVATE_SERVICE_ROLE_KEY = 'fixture-private-service-role-key';
+
+test('re-exports rotated public environment values before building the app image', async () => {
+  const workspaceRoot = await mkdtemp(path.join(tmpdir(), 'ankh-infra-app-image-'));
+
+  try {
+    const appRoot = path.join(workspaceRoot, 'apps', APP_SLUG);
+    const infraRoot = path.join(appRoot, 'infra', 'minikube');
+    const scriptsRoot = path.join(infraRoot, 'scripts');
+    const fakeBin = path.join(workspaceRoot, 'bin');
+    const buildScriptPath = path.join(scriptsRoot, 'build-app-image.sh');
+    const dockerfilePath = path.join(infraRoot, 'app-image', 'Dockerfile');
+    const metroCachePath = path.join(workspaceRoot, 'fake-metro-cache');
+    const bunxArgsPath = path.join(workspaceRoot, 'bunx-args');
+    const dockerArgsPath = path.join(workspaceRoot, 'docker-args');
+    const exportDir = path.join(appRoot, '.ankh', 'web-export');
+    const bundlePath = path.join(exportDir, '_expo', 'static', 'js', 'web', 'index-fixture.js');
+    const generated = generateInfrastructure(
+      {
+        deployment: { target: 'minikube', monitoring: false },
+        auth: { scope: 'global', provider: 'supabase' },
+        plugins: [],
+      },
+      { appManifest: createAppManifest(APP_SLUG) },
+    );
+    const buildScript = getGeneratedFile(
+      generated.files,
+      'infra/minikube/scripts/build-app-image.sh',
+    );
+
+    await mkdir(path.dirname(dockerfilePath), { recursive: true });
+    await mkdir(fakeBin, { recursive: true });
+    await mkdir(scriptsRoot, { recursive: true });
+    await writeFile(path.join(appRoot, 'package.json'), '{}\n', 'utf8');
+    await writeFile(dockerfilePath, 'FROM scratch\n', 'utf8');
+    await writeFile(buildScriptPath, buildScript, 'utf8');
+    await chmod(buildScriptPath, 0o755);
+    await writeFakeBunx(path.join(fakeBin, 'bunx'));
+    await writeFakeDocker(path.join(fakeBin, 'docker'));
+
+    await writePublicEnvironment(appRoot, infraRoot, PUBLIC_KEY_A);
+    await runBuildScript({
+      appRoot,
+      buildScriptPath,
+      bunxArgsPath,
+      dockerArgsPath,
+      fakeBin,
+      metroCachePath,
+    });
+
+    const firstBundle = await readFile(bundlePath, 'utf8');
+    expect(firstBundle).toContain(PUBLIC_KEY_A);
+    expect(firstBundle).not.toContain(PRIVATE_SERVICE_ROLE_KEY);
+
+    await writePublicEnvironment(appRoot, infraRoot, PUBLIC_KEY_B);
+    await runBuildScript({
+      appRoot,
+      buildScriptPath,
+      bunxArgsPath,
+      dockerArgsPath,
+      fakeBin,
+      metroCachePath,
+    });
+
+    const secondBundle = await readFile(bundlePath, 'utf8');
+    expect(secondBundle).toContain(PUBLIC_KEY_B);
+    expect(secondBundle).not.toContain(PUBLIC_KEY_A);
+    expect(secondBundle).not.toContain(PRIVATE_SERVICE_ROLE_KEY);
+    expect((await readFile(bunxArgsPath, 'utf8')).trim().split('\n')).toEqual([
+      'expo',
+      'export',
+      '--platform',
+      'web',
+      '--clear',
+      '--output-dir',
+      '.ankh/web-export',
+    ]);
+
+    const dockerArgs = (await readFile(dockerArgsPath, 'utf8')).trim().split('\n');
+    expect(dockerArgs.at(-1)).toBe(exportDir);
+    expect(dockerArgs).toContain(dockerfilePath);
+  } finally {
+    await rm(workspaceRoot, { recursive: true, force: true });
+  }
+});
+
+async function writePublicEnvironment(
+  appRoot: string,
+  infraRoot: string,
+  publicKey: string,
+): Promise<void> {
+  await writeFile(
+    path.join(appRoot, '.env.local'),
+    `EXPO_PUBLIC_SUPABASE_URL=${PUBLIC_URL}\nEXPO_PUBLIC_SUPABASE_ANON_KEY=${publicKey}\n`,
+    'utf8',
+  );
+  await writeFile(
+    path.join(infraRoot, '.env'),
+    `ANKH_APP_SLUG=${APP_SLUG}
+APP_BUILD_ENABLED=true
+APP_WEB_EXPORT_DIR=.ankh/web-export
+APP_IMAGE=ankh/${APP_SLUG}:test
+EXPO_PUBLIC_SUPABASE_URL=${PUBLIC_URL}
+EXPO_PUBLIC_SUPABASE_ANON_KEY=${publicKey}
+SUPABASE_SERVICE_ROLE_KEY=${PRIVATE_SERVICE_ROLE_KEY}
+`,
+    'utf8',
+  );
+}
+
+async function writeFakeBunx(filePath: string): Promise<void> {
+  await writeFile(
+    filePath,
+    `#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\\n' "$@" > "\${FAKE_BUNX_ARGS_PATH:?}"
+
+if [[ "\${1:-}" != "expo" || "\${2:-}" != "export" ]]; then
+  echo "Expected expo export invocation." >&2
+  exit 64
+fi
+shift 2
+
+clear_cache=false
+output_dir=""
+platform=""
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --platform)
+      platform="\${2:-}"
+      shift 2
+      ;;
+    --clear)
+      clear_cache=true
+      shift
+      ;;
+    --output-dir)
+      output_dir="\${2:-}"
+      shift 2
+      ;;
+    *)
+      echo "Unexpected expo export argument: $1" >&2
+      exit 64
+      ;;
+  esac
+done
+
+if [[ "\${platform}" != "web" || -z "\${output_dir}" ]]; then
+  echo "Expected web platform and output directory." >&2
+  exit 64
+fi
+
+if [[ "\${clear_cache}" == "true" ]]; then
+  : > "\${FAKE_METRO_CACHE_PATH:?}"
+fi
+if [[ ! -s "\${FAKE_METRO_CACHE_PATH:?}" ]]; then
+  printf '%s' "\${EXPO_PUBLIC_SUPABASE_ANON_KEY:?}" > "\${FAKE_METRO_CACHE_PATH}"
+fi
+
+cached_public_key="$(<"\${FAKE_METRO_CACHE_PATH}")"
+bundle_dir="\${output_dir}/_expo/static/js/web"
+mkdir -p "\${bundle_dir}"
+printf '<script src="/_expo/static/js/web/index-fixture.js"></script>\\n' > "\${output_dir}/index.html"
+printf 'const supabaseUrl = "%s";\\nconst supabaseAnonKey = "%s";\\n' \
+  "\${EXPO_PUBLIC_SUPABASE_URL:?}" \
+  "\${cached_public_key}" \
+  > "\${bundle_dir}/index-fixture.js"
+`,
+    'utf8',
+  );
+  await chmod(filePath, 0o755);
+}
+
+async function writeFakeDocker(filePath: string): Promise<void> {
+  await writeFile(
+    filePath,
+    `#!/usr/bin/env bash
+set -euo pipefail
+
+printf '%s\\n' "$@" > "\${FAKE_DOCKER_ARGS_PATH:?}"
+context=""
+for argument in "$@"; do
+  context="\${argument}"
+done
+
+if [[ ! -f "\${context}/index.html" ]]; then
+  echo "Docker context does not contain the fresh web export." >&2
+  exit 65
+fi
+`,
+    'utf8',
+  );
+  await chmod(filePath, 0o755);
+}
+
+async function runBuildScript(args: {
+  appRoot: string;
+  buildScriptPath: string;
+  bunxArgsPath: string;
+  dockerArgsPath: string;
+  fakeBin: string;
+  metroCachePath: string;
+}): Promise<void> {
+  const child = spawn('bash', [args.buildScriptPath], {
+    cwd: args.appRoot,
+    env: {
+      ...process.env,
+      FAKE_BUNX_ARGS_PATH: args.bunxArgsPath,
+      FAKE_DOCKER_ARGS_PATH: args.dockerArgsPath,
+      FAKE_METRO_CACHE_PATH: args.metroCachePath,
+      PATH: `${args.fakeBin}:${process.env.PATH ?? ''}`,
+    },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const exitCodePromise = new Promise<number | null>((resolve, reject) => {
+    child.once('error', reject);
+    child.once('close', resolve);
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    readStream(child.stdout),
+    readStream(child.stderr),
+    exitCodePromise,
+  ]);
+
+  if (exitCode !== 0) {
+    throw new Error(
+      `Generated build script exited with ${String(exitCode)}. stdout=${stdout} stderr=${stderr}`,
+    );
+  }
+}
+
+async function readStream(stream: NodeJS.ReadableStream): Promise<string> {
+  let output = '';
+  stream.setEncoding('utf8');
+  for await (const chunk of stream) {
+    output += String(chunk);
+  }
+  return output;
+}
+
+function getGeneratedFile(
+  files: readonly { path: string; content: string }[],
+  filePath: string,
+): string {
+  const file = files.find((candidate) => candidate.path === filePath);
+  if (!file) throw new Error(`Missing generated file: ${filePath}`);
+  return file.content;
+}

package/src/adapters/minikube/base/index.test.ts

@@ -69,10 +69,22 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
     const readme = getFile(result.files, 'infra/minikube/README.md');
 
-    expect(upScript).toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
+    const migrationFunction = upScript.slice(
+      upScript.indexOf('run_supabase_migrations()'),
+      upScript.indexOf('reconcile_supabase_profile()'),
+    );
+
+    expect(migrationFunction).toContain(
+      'SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "${SUPABASE_DB_URL}"',
+    );
+    expect(migrationFunction).not.toContain('supabase migration up --db-url "${SUPABASE_DB_URL}"');
+    expect(migrationFunction).toContain('echo "Applying pending Supabase migrations..."');
+    expect(migrationFunction).toContain('echo "Supabase migrations applied."');
     expect(upScript).toContain('export SUPABASE_DB_URL PGSSLMODE=disable');
     expect(upScript).not.toContain('migration up --local');
     expect(upScript).toContain('cd "${ROOT_DIR}"');
+    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
+    expect(migrationFunction).toContain('if [[ -d "${ROOT_DIR}/supabase/migrations" ]]; then');
     expect(upScript).toContain('set_required_env_default POSTGRES_PASSWORD "$(random_hex 32)"');
     expect(upScript).not.toContain('set_env_default POSTGRES_PASSWORD "$(random_base64');
     expect(upScript).toContain(
@@ -82,6 +94,30 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
     expect(readme).toContain('Migration authoring/history remains Supabase');
   });
 
+  test('preserves Supabase-disabled migration behavior', () => {
+    const result = generateInfrastructure(
+      {
+        deployment: {
+          target: 'minikube',
+          monitoring: false,
+        },
+        plugins: [],
+      },
+      {
+        appManifest: createAppManifest('frontend-only'),
+      },
+    );
+    const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+    const migrationFunction = upScript.slice(
+      upScript.indexOf('run_supabase_migrations()'),
+      upScript.indexOf('reconcile_supabase_profile()'),
+    );
+
+    expect(upScript).toContain('SUPABASE_RUNTIME_ENABLED="false"');
+    expect(migrationFunction).toContain('if [[ "${SUPABASE_RUNTIME_ENABLED}" != "true" ]]; then');
+    expect(migrationFunction).toContain('return 0');
+  });
+
   test('lists and generates Supabase Kubernetes bootstrap and gateway contract files', () => {
     const result = generateInfrastructure(createSupabaseManifest(), {
       appManifest: createAppManifest('scanner'),
@@ -338,6 +374,8 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
       appManifest: createAppManifest('books'),
     });
     const upScript = getFile(result.files, 'infra/minikube/scripts/up.sh');
+    const buildScript = getFile(result.files, 'infra/minikube/scripts/build-app-image.sh');
+    const readme = getFile(result.files, 'infra/minikube/README.md');
 
     expect(upScript).toContain('sync_app_public_supabase_env()');
     expect(upScript).toContain('local app_env_file="${APP_SOURCE_DIR}/.env.local"');
@@ -352,6 +390,12 @@ describe('generateMinikubeBaseArtifacts app-owned cluster model', () => {
       upScript.indexOf('if [[ "${APP_BUILD_ENABLED}" == "true" ]]'),
     );
     expect(upScript).not.toContain('SUPABASE_SERVICE_ROLE_KEY" "${SUPABASE_SERVICE_ROLE_KEY}"');
+    expect(buildScript).toContain(
+      'bunx expo export --platform web --clear --output-dir "${APP_WEB_EXPORT_DIR}"',
+    );
+    expect(readme).toContain(
+      '`build-app-image.sh` clears the Expo/Metro bundler cache before every web export.',
+    );
   });
 
   test('starts Supabase schema owners before app migrations and profile reconciliation', () => {

package/src/adapters/minikube/base/index.ts

@@ -3,6 +3,7 @@ import type { InfraManifestInput } from '../../../types';
 import type { ResolvedProfileModel } from '../auth/supabase/profile';
 import { resolveSupabaseProfileModel } from '../auth/supabase/profile';
 import type { MinikubeProviderLifecycle } from '../contracts';
+import { getSupabaseMigrationCommandScript } from './supabaseMigrations';
 
 export const APP_NAMESPACE = 'app';
 const SUPABASE_NAMESPACE = 'supabase';
@@ -379,7 +380,7 @@ host-level Supabase Compose runtime.
 
 ## Lifecycle Semantics
 
-- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with \`supabase migration up --db-url "$SUPABASE_DB_URL"\`, starts slug-owned port-forwards, and deploys the app runtime.
+- \`up.sh\`: starts \`minikube -p ${appSlug}\`, deploys provider namespaces, runs migrations with CLI telemetry disabled for that command, starts slug-owned port-forwards, and deploys the app runtime.
 - \`down.sh\`: stops slug-owned port-forwards, then stops \`minikube -p ${appSlug}\`. Persistent data remains in the profile.
 - \`reset.sh\`: requires \`ANKH_RESET_CONFIRM=${appSlug}\`; ${resetDescription}. It does not delete the Minikube profile.
 - \`destroy.sh\`: deletes only \`minikube -p ${appSlug}\`.
@@ -392,7 +393,13 @@ ${resourceLines}
 
 Supabase runtime ownership is Kubernetes. Migration authoring/history remains Supabase
 migration files. Migration execution targets the Kubernetes Postgres endpoint through
-\`supabase migration up --db-url "$SUPABASE_DB_URL"\`.
+\`SUPABASE_TELEMETRY_DISABLED=1 supabase --yes migration up --db-url "$SUPABASE_DB_URL"\`.
+The migration process does not require stdin. \`--yes\` remains defense in depth for future
+CLI prompts; it is not the hang fix. Command-scoped telemetry disable avoids the unbounded
+telemetry shutdown in Supabase CLI 2.106.0 when PostHog is blocked, without changing the
+user's persistent telemetry preference. Migration failures stop \`up.sh\`, and the completion
+message is printed only after a zero exit status. No migration deadline is added; using a
+current Supabase CLI remains recommended.
 
 Supabase manifests are generated from the current official Supabase self-hosting Docker
 topology, service documentation, environment-variable contracts, and pinned official images.
@@ -417,6 +424,13 @@ Pinned images:
 - Studio: \`http://127.0.0.1:${supabaseHostPorts.studio}\`
 - DB migration endpoint: \`127.0.0.1:${supabaseHostPorts.db}\`
 
+## App Image Export
+
+\`build-app-image.sh\` clears the Expo/Metro bundler cache before every web export. Expo
+inlines \`EXPO_PUBLIC_*\` values into the browser bundle, so cache invalidation ensures a
+rotated browser-safe Supabase URL or anon key replaces the previous value before the Docker
+image is built. Privileged Supabase credentials are not written to the app's public env file.
+
 ## Runtime Conventions
 
 - Monitoring requested: \`${monitoringEnabled ? 'true' : 'false'}\`
@@ -2266,6 +2280,7 @@ function getUpScript(args: {
     oauthProviders,
     secretStoreProvider,
   });
+  const supabaseMigrationCommand = getSupabaseMigrationCommandScript();
 
   return `#!/usr/bin/env bash
 set -Eeuo pipefail
@@ -2621,7 +2636,7 @@ run_supabase_migrations() {
     require_command supabase
     (
       cd "\${ROOT_DIR}"
-      supabase migration up --db-url "\${SUPABASE_DB_URL}"
+${indentShellBlock(supabaseMigrationCommand, 6)}
     )
   fi
 }
@@ -2922,7 +2937,7 @@ fi
 
 (
   cd "\${APP_SOURCE_DIR}"
-  bunx expo export --platform web --output-dir "\${APP_WEB_EXPORT_DIR}"
+  bunx expo export --platform web --clear --output-dir "\${APP_WEB_EXPORT_DIR}"
 )
 
 if [[ "\${APP_WEB_EXPORT_DIR}" = /* ]]; then