feat: add hybrid jwt verification (supabase#4721)

* feat: adding hybrid jwt verification

Allows verify new JWTs as well legacy

* stamp: detect algorithm before verify JWT

It helps to reduce latency for Legacy token verifications, since it
avoid unnecessary requests.

* feat: passing down JWKs as internal env

- It reduces functions bootime, since there's no need to fetch JWK on
fly

* stamp: using URL object instead of string concatenation

* stamp: codegen

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

fix: save profile to global path (supabase#4697)

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

feat: pass pgrst config to studio container (supabase#4920)

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

fix(function): support multiline import type statements in import sca…

…nning (supabase#4872)

* fix(function): support multiline import type statements in import scanning

The regex pattern `.*?` does not match newlines, causing multiline
`import type { X }` statements to be skipped during bind-mount file
scanning. This results in type-only imports not being mounted in
the Docker container, causing runtime errors like:

  worker boot error: Module not found "file:///.../types/MyType.ts"

Changed `.*?` to `[\s\S]*?` to match any character including newlines,
consistent with the `{[^{}]+}` pattern used for braced imports.

This fix enables proper handling of Deno 2.x style multiline type imports:

```typescript
import type {
  MyType,
  OtherType,
} from './types.ts'
```

Includes test case to prevent regression.

* test(function): add non-braced default type import to fixture

Cover `import type Foo from '...'` pattern in the multiline import
type test. This form also routes through the `[\s\S]*?` branch and
was previously untested.

* fix(function): use (?:type\s+)? for multiline import type matching

Narrow the regex fix for multiline import type statements per PR review feedback. Instead of widening .*? to [\s\S]*? (which affects all import patterns), add (?:type\s+)? to consume the type keyword so braced imports route into the {[^{}]+} branch that already handles newlines.

---------

Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>

chore: sync API types from infrastructure (supabase#4918)

* chore: sync API types from infrastructure

* fix: remove stale `pico` project size enum reference from API-sync update (supabase#4925)

* Initial plan

* fix: remove stale pico project size enum reference

Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>

---------

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: avallete <8771783+avallete@users.noreply.github.com>

chore: sync API types from infrastructure (supabase#4890)

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

fix(updater): network restrictions not enabled (supabase#4887)

## Summary

Mitigates workflow failures caused by `400` responses from network restrictions endpoints when projects are not entitled to manage restrictions and local config has `db.network_restrictions.enabled = false` or not set.

The fix ensures we only read/update network restrictions when local config explicitly enables the feature, while preserving strict failure behavior when it is enabled.

fix(pull): attempt to fix unkown authority error for db pull (supabas…

…e#4886)

* fix(pull): attempt to fix unkown authority error for db pull

* fix(pull): allow to disable CA verify opt-in via env variable

* fix: mute gosec on explicit  skip

chore: sync API types from infrastructure (supabase#4878)

Co-authored-by: supabase-cli-releaser[bot] <246109035+supabase-cli-releaser[bot]@users.noreply.github.com>

fix(auth): pass GOTRUE_JWT_VALID_METHODS env var for GoTrue compat (s…

…upabase#4874)

fix(auth): pass GOTRUE_JWT_VALID_METHODS env var for GoTrue compatibility