feat: add secure local development detection for flow compilation

[jumski]

Added Local Development Detection for Flow Compilation

This PR adds a robust mechanism for detecting local development environments to ensure safe flow compilation behavior. Key changes:

• Implemented cryptographic detection of local Supabase environments using known JWT keys
• Moved environment detection responsibility from Worker to ControlPlane for improved security
• Added shared localDetection.ts module with constants for known local Supabase keys
• Modified the /ensure-compiled endpoint to automatically detect environment and set compilation mode
• Simplified Worker API by removing the need to specify compilation mode
• Added comprehensive tests for local environment detection
• Updated documentation with detailed explanation of the detection mechanism

The detection is cryptographically safe - production Supabase instances cannot accidentally match the known local keys. This approach follows a "default-to-production" safety model where any environment not positively identified as local will be treated as production.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 170589a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[jumski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: add advisory locks to prevent concurrent flow compilation race conditions #477
• refactor: remove ensure-compiled endpoint and related code from control plane #476
• refactor: simplify environment detection for flow compilation mode #475
• feat: add flow compilation verification at worker startup #474
• feat: add secure local development detection for flow compilation #473 👈 (View in Graphite)
• refactor: use Supabase service role key for worker authentication #472
• feat: include options in FlowShape for proper flow creation #471
• feat: add ensure-compiled endpoint to control plane server #467
• feat: add ensure_flow_compiled function with dev/prod mode support #466
• feat: add flow compilation utilities for creating flows from JSON shapes #465
• feat: add SQL functions to compare and retrieve flow shapes #464
• Setup Worker Startup Compilation Phase 1 #463
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge:queue - adds this PR to the back of the merge queue
• hotfix:queue - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 170589a

Command	Status	Duration	Result
nx affected -t verify-exports --base=origin/mai...	✅ Succeeded	3s	View ↗
nx affected -t build --configuration=production...	✅ Succeeded	24s	View ↗
nx affected -t lint typecheck test --parallel -...	✅ Succeeded	3m 49s	View ↗
nx run edge-worker:e2e	✅ Succeeded	2m 51s	View ↗
nx run cli:e2e	✅ Succeeded	6s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-11-30 19:10:22 UTC

[github-actions]

🔍 Preview Deployment: Website

✅ Deployment successful!

🔗 Preview URL: https://pr-473.pgflow.pages.dev

📝 Details:

• Branch: 11-30-add_local_supabase_detection_to_controlplane_for_auto_mode_detection
• Commit: f266df32220416ab1eb86e4d3d19f4872e48fbca
• View Logs

_Last updated: _