feat!: drop GlobalOptions.session in favor of URLSessionTransport(session:)

[grdsdev]

What

Removes SupabaseClientOptions.GlobalOptions.session. The URLSession HTTP goes through is now configured on the transport only:

// Before
global: .init(session: mySession)

// After
global: .init(http: .init(transport: URLSessionTransport(session: mySession)))

• Sources/Supabase/Types.swift: property and init parameter removed, docs updated.
• Sources/Supabase/SupabaseClient.swift: the resolved transport is http.transport ?? URLSessionTransport(); the copy of the global session into RealtimeClientOptions.session is gone.
• Realtime's WebSocket session is configured only on RealtimeClientOptions.session. It no longer inherits a global one.
• V3_MIGRATION.md: new section "SupabaseClientOptions.GlobalOptions.session is removed"; the earlier "GlobalOptions.session stays" note under the transport section is deleted.
• README and the OpenTelemetryDemo example use the transport form.

Why

After #1325, GlobalOptions had two knobs for HTTP. session backed the default transport only while http.transport was nil, so a caller who set both silently lost the session for HTTP. It was also copied into Realtime for the WebSocket, which never goes through ClientTransport. One knob now configures HTTP, and Realtime's socket session is set where it lives.

Stacked on #1325 (base branch guilhermesouza/sdk-1786-expose-one-public-transport-protocol-and-middleware-chain). Retarget to main once that merges.

Test plan

• SupabaseClientTests: the two realtime-session propagation tests are replaced by one that checks a Realtime-specific session is preserved and that the HTTP transport's session does not leak into Realtime. Seven other test call sites move from GlobalOptions(session:) to the transport form with no behavior change.

Verification

swift test --no-parallel
━ Test run with 1418 tests in 141 suites passed after 13.272 seconds with 1 known issue.

./scripts/format.sh        # no changes
./scripts/spell-check.sh   # Files checked: 394, Issues found: 0
./scripts/test-docs.sh     # exit 0, 0 warnings

Fixes SDK-1820

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 911925a8-b480-432a-9849-d98edae714dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Capability matrix drift detected

The following capabilities are marked implemented in the matrix but could not be found in swift:

• client.session_management.persist_session → expected symbol: AuthLocalStorage.defaultLocalStorage
• functions.invocation.streaming_response → expected symbol: FunctionsClient._invokeWithStreamedResponse

The following capabilities are marked implemented in swift but have no registered symbols to verify:

• auth.passkey.register_passkey (no symbols list — cannot confirm implementation exists)
• auth.passkey.sign_in_with_passkey (no symbols list — cannot confirm implementation exists)
• client.observability.trace_propagation (no symbols list — cannot confirm implementation exists)
• database.using_modifiers.request_cancellation (no symbols list — cannot confirm implementation exists)
• functions.invocation.request_cancellation (no symbols list — cannot confirm implementation exists)
• storage.file_buckets.url_cache_nonce (no symbols list — cannot confirm implementation exists)
• storage.file_buckets.request_cancellation (no symbols list — cannot confirm implementation exists)

These may have been renamed, removed, or never registered. Please update the capability matrix.
See: https://github.com/supabase/sdk/blob/main/packages/capability-matrix/docs/capability-matrix.md