feat: add is_local() function to detect Supabase CLI environment

pkgs/core/schemas/0030_utilities.sql

@@ -1,5 +1,22 @@
 -- Utility functions that don't depend on other entities
 
+-- Detects if running in local Supabase CLI environment
+-- by checking if JWT secret matches the known hardcoded local value.
+-- Returns true only for exact match; defaults to false (production-safe).
+create or replace function pgflow.is_local()
+returns boolean
+language sql
+stable
+parallel safe
+set search_path = ''
+as $$
+  select coalesce(
+    current_setting('app.settings.jwt_secret', true)
+      = 'super-secret-jwt-token-with-at-least-32-characters-long',
+    false
+  )
+$$;
+
 create or replace function pgflow.is_valid_slug(
   slug text
 )

pkgs/core/src/database-types.ts

@@ -483,6 +483,7 @@ export type Database = {
         }
       }
       get_run_with_states: { Args: { run_id: string }; Returns: Json }
+      is_local: { Args: never; Returns: boolean }
       is_valid_slug: { Args: { slug: string }; Returns: boolean }
       maybe_complete_run: { Args: { run_id: string }; Returns: undefined }
       poll_for_tasks: {

pkgs/core/supabase/migrations/20251204115929_pgflow_temp_is_local.sql

@@ -0,0 +1,8 @@
+-- Create "is_local" function
+CREATE FUNCTION "pgflow"."is_local" () RETURNS boolean LANGUAGE sql STABLE PARALLEL SAFE SET "search_path" = '' AS $$
+select coalesce(
+    current_setting('app.settings.jwt_secret', true)
+      = 'super-secret-jwt-token-with-at-least-32-characters-long',
+    false
+  )
+$$;

pkgs/core/supabase/migrations/atlas.sum

@@ -1,4 +1,4 @@
-h1:K23lj19qKEUldXvUo2XV8Dg1GIY994aZgpvg8XS0TRE=
+h1:RyA/4WAtZP28l0qVRPF/DF2ly/POIsQa6ZTCzP/f/NA=
 20250429164909_pgflow_initial.sql h1:I3n/tQIg5Q5nLg7RDoU3BzqHvFVjmumQxVNbXTPG15s=
 20250517072017_pgflow_fix_poll_for_tasks_to_use_separate_statement_for_polling.sql h1:wTuXuwMxVniCr3ONCpodpVWJcHktoQZIbqMZ3sUHKMY=
 20250609105135_pgflow_add_start_tasks_and_started_status.sql h1:ggGanW4Wyt8Kv6TWjnZ00/qVb3sm+/eFVDjGfT8qyPg=
@@ -16,3 +16,4 @@ h1:K23lj19qKEUldXvUo2XV8Dg1GIY994aZgpvg8XS0TRE=
 20251130012803_pgflow_temp_ensure_flow_compiled.sql h1:RvuDNy53B03P5mzs9JUoVYMA725V6aCVoPSp59Gh9ko=
 20251130164844_pgflow_temp_options_in_shape.sql h1:lbMDdu15QiBElTsvl7g0dI7flvyjngK9g68VDnCE0S0=
 20251201105311_pgflow_temp_advisory_lock_for_compilation.sql h1:OmRtiaPYjPuq9P87Px2PH06gdKhHZ0Ro6GfjjS0G+Rs=
+20251204115929_pgflow_temp_is_local.sql h1:pjOFO6k8FCmbxp6S7U3fPImsqW81WwdLwq/UZK74BG4=

pkgs/core/supabase/tests/is_local/basic.test.sql

@@ -0,0 +1,29 @@
+begin;
+select plan(3);
+select pgflow_tests.reset_db();
+
+-- TEST: Returns true when jwt_secret matches known local Supabase value
+-- The local Supabase CLI always uses this exact hardcoded JWT secret
+select set_config('app.settings.jwt_secret', 'super-secret-jwt-token-with-at-least-32-characters-long', true);
+select ok(
+  pgflow.is_local(),
+  'is_local() returns true when jwt_secret matches local Supabase value'
+);
+
+-- TEST: Returns false when jwt_secret is empty/missing (simulates hosted Supabase after Nov 2024)
+-- Note: set_config with NULL is ignored, so we use empty string to simulate missing value
+select set_config('app.settings.jwt_secret', '', true);
+select ok(
+  not pgflow.is_local(),
+  'is_local() returns false when jwt_secret is empty/missing'
+);
+
+-- TEST: Returns false when jwt_secret is a different value (self-hosted or custom)
+select set_config('app.settings.jwt_secret', 'some-other-custom-jwt-secret-value', true);
+select ok(
+  not pgflow.is_local(),
+  'is_local() returns false when jwt_secret is a different value'
+);
+
+select finish();
+rollback;