@linabase/js 0.4.3 → 0.5.0

package/dist/index.cjs

@@ -696,6 +696,14 @@ var AuthClient = class {
   listeners = [];
   /** Promise that resolves when session restore from storage is complete. */
   _restorePromise = Promise.resolve();
+  /** API key for auth requests that shouldn't use the (possibly expired) access token. */
+  _apiKey = "";
+  /** Absolute base URL of the Linabase REST API, used to build browser-level
+   *  redirect targets (signInWithOAuth) that must be resolved against the
+   *  API origin, not the caller's page origin. Empty string means "resolve
+   *  relative to the current page" which is only safe in server-side or
+   *  test contexts. */
+  _baseUrl = "";
   currentSession = null;
   /**
    * Callback that the parent LinabaseClient can set to update the Authorization
@@ -706,17 +714,59 @@ var AuthClient = class {
     this.request = request;
   }
   /**
-   * Set (or clear) the current session. Use this to restore a persisted
-   * session on app launch (e.g., from AsyncStorage / SecureStore).
-   * Automatically refreshes the token if it has expired.
-   * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-   * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+   * Set (or clear) the current session.
+   *
+   * Three valid shapes:
+   *   - `null` — clear the session.
+   *   - Full `AuthSession` — restore a persisted session (e.g. from
+   *     AsyncStorage). Auto-refreshes if the token is already expired.
+   *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+   *     pattern. Used by OAuth / magic-link callbacks that only have
+   *     tokens in the URL hash and no user object. The SDK installs the
+   *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+   *     a promise that resolves once the user is populated (or rejects
+   *     if the token is invalid).
+   *
+   * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+   * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+   * lifecycle events.
    */
   setSession(session, _internal) {
+    if (session === null) {
+      this.currentSession = null;
+      if (this.onSessionChange) this.onSessionChange(null);
+      if (!_internal) this.emit("INITIAL_SESSION", null);
+      return;
+    }
+    if (!("user" in session) || !session.user) {
+      const tokens = {
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        token_type: session.token_type ?? "bearer",
+        expires_in: session.expires_in ?? 3600,
+        expires_at: session.expires_at ?? Math.floor(Date.now() / 1e3) + (session.expires_in ?? 3600),
+        user: null
+      };
+      this.currentSession = tokens;
+      if (this.onSessionChange) this.onSessionChange(tokens);
+      return (async () => {
+        const { data, error } = await this.getUser();
+        if (error || !data.user) {
+          this.currentSession = null;
+          if (this.onSessionChange) this.onSessionChange(null);
+          return { data: null, error: error ?? { message: "User lookup failed" } };
+        }
+        const full = { ...tokens, user: data.user };
+        this.currentSession = full;
+        if (this.onSessionChange) this.onSessionChange(full);
+        if (!_internal) this.emit("SIGNED_IN", full);
+        return { data: full, error: null };
+      })();
+    }
     this.currentSession = session;
     if (this.onSessionChange) this.onSessionChange(session);
     if (!_internal) {
-      if (session && session.expires_at <= Math.floor(Date.now() / 1e3)) {
+      if (session.expires_at <= Math.floor(Date.now() / 1e3)) {
         this.refreshSession().then(({ error }) => {
           if (error) {
             this.currentSession = null;
@@ -792,8 +842,10 @@ var AuthClient = class {
   // ─── OAuth ─────────────────────────────────────────────────
   signInWithOAuth(params) {
     const queryParams = new URLSearchParams({ provider: params.provider });
+    if (this._apiKey) queryParams.set("apikey", this._apiKey);
     if (params.redirectTo) queryParams.set("redirect_to", params.redirectTo);
-    const url = `/auth/v1/authorize?${queryParams}`;
+    const base = this._baseUrl.replace(/\/$/, "");
+    const url = `${base}/auth/v1/authorize?${queryParams}`;
     if (typeof window !== "undefined") {
       window.location.href = url;
     }
@@ -822,9 +874,25 @@ var AuthClient = class {
     }
     return { data: { session: null }, error: null };
   }
-  async getUser() {
+  /**
+   * Install an OAuth / magic-link session from the URL hash.
+   * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+   * in createClient. New consumers should just call `setSession()` directly.
+   */
+  async _ingestHashTokens(tokens) {
+    const result = this.setSession(tokens);
+    if (result instanceof Promise) await result;
+  }
+  /**
+   * Fetch the current user.
+   * @param jwt Optional access token to use instead of the stored session.
+   *   Useful for validating a JWT without installing it as the active session
+   *   (e.g. admin tooling, custom auth bridges).
+   */
+  async getUser(jwt) {
     try {
-      const res = await this.request("/auth/v1/user");
+      const options = jwt ? { headers: { Authorization: `Bearer ${jwt}` } } : {};
+      const res = await this.request("/auth/v1/user", options);
       const data = await res.json();
       if (!res.ok) return { data: { user: null }, error: data };
       return { data: { user: data }, error: null };
@@ -839,6 +907,8 @@ var AuthClient = class {
     try {
       const res = await this.request("/auth/v1/token?grant_type=refresh_token", {
         method: "POST",
+        // Force API key auth instead of (possibly expired) access token
+        headers: { "Authorization": `Bearer ${this._apiKey}` },
         body: JSON.stringify({ refresh_token: this.currentSession.refresh_token })
       });
       const data = await res.json();
@@ -1154,6 +1224,8 @@ function createClient(config) {
     });
   }
   const authClient = new AuthClient(request);
+  authClient._apiKey = apiKey;
+  authClient._baseUrl = baseUrl;
   const persistSession = config.auth?.persistSession !== false && !!config.auth?.storage;
   const sessionStorage = config.auth?.storage;
   const sessionKey = config.auth?.storageKey || "@linabase/session";
@@ -1178,10 +1250,41 @@ function createClient(config) {
       }
     });
   }
+  const detectSessionInUrl = config.auth?.detectSessionInUrl !== false;
+  if (detectSessionInUrl && typeof window !== "undefined" && window.location?.hash) {
+    const pending = authClient._restorePromise;
+    authClient._restorePromise = Promise.resolve(pending).then(async () => {
+      const hash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const params = new URLSearchParams(hash);
+      const access_token = params.get("access_token");
+      const refresh_token = params.get("refresh_token");
+      if (!access_token || !refresh_token) return;
+      const expires_in = Number(params.get("expires_in") || 3600);
+      const expires_at = Number(
+        params.get("expires_at") || Math.floor(Date.now() / 1e3) + expires_in
+      );
+      const ingest = authClient._ingestHashTokens({
+        access_token,
+        refresh_token,
+        token_type: params.get("token_type") || "bearer",
+        expires_in,
+        expires_at
+      });
+      try {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        window.history.replaceState(null, "", url.toString());
+      } catch {
+      }
+      await ingest;
+    });
+  }
   function buildClient(reqFn, branchSlug) {
     const rc = new RpcClient(reqFn);
     const ac = branchSlug ? new AuthClient(reqFn) : authClient;
     if (branchSlug) {
+      ac._apiKey = apiKey;
+      ac._baseUrl = baseUrl;
       ac.onSessionChange = (session) => {
         accessToken = session?.access_token || null;
       };
@@ -1230,6 +1333,20 @@ function createClient(config) {
       }
     };
   }
+  if (config.branch) {
+    let pinnedRequest2 = function(path, options = {}) {
+      return request(path, {
+        ...options,
+        headers: {
+          ...options.headers,
+          "X-Branch": pinned
+        }
+      });
+    };
+    var pinnedRequest = pinnedRequest2;
+    const pinned = config.branch;
+    return buildClient(pinnedRequest2, pinned);
+  }
   return buildClient(request);
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/index.d.cts

@@ -251,6 +251,20 @@ interface AuthSession {
     expires_at: number;
     user: AuthUser;
 }
+/**
+ * Token-only input accepted by `setSession` when a full AuthSession isn't
+ * available yet (OAuth / magic-link callbacks, custom auth bridges). The SDK
+ * fetches the user and fills in defaults for `token_type` / `expires_in` /
+ * `expires_at` when omitted.
+ */
+interface SetSessionTokens {
+    access_token: string;
+    refresh_token: string;
+    token_type?: string;
+    expires_in?: number;
+    expires_at?: number;
+    user?: null;
+}
 interface AuthUser {
     id: string;
     email: string | null;
@@ -268,6 +282,14 @@ declare class AuthClient {
     private listeners;
     /** Promise that resolves when session restore from storage is complete. */
     _restorePromise: Promise<void>;
+    /** API key for auth requests that shouldn't use the (possibly expired) access token. */
+    _apiKey: string;
+    /** Absolute base URL of the Linabase REST API, used to build browser-level
+     *  redirect targets (signInWithOAuth) that must be resolved against the
+     *  API origin, not the caller's page origin. Empty string means "resolve
+     *  relative to the current page" which is only safe in server-side or
+     *  test contexts. */
+    _baseUrl: string;
     private currentSession;
     /**
      * Callback that the parent LinabaseClient can set to update the Authorization
@@ -276,13 +298,27 @@ declare class AuthClient {
     onSessionChange: ((session: AuthSession | null) => void) | null;
     constructor(request: RequestFn$1);
     /**
-     * Set (or clear) the current session. Use this to restore a persisted
-     * session on app launch (e.g., from AsyncStorage / SecureStore).
-     * Automatically refreshes the token if it has expired.
-     * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-     * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+     * Set (or clear) the current session.
+     *
+     * Three valid shapes:
+     *   - `null` — clear the session.
+     *   - Full `AuthSession` — restore a persisted session (e.g. from
+     *     AsyncStorage). Auto-refreshes if the token is already expired.
+     *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+     *     pattern. Used by OAuth / magic-link callbacks that only have
+     *     tokens in the URL hash and no user object. The SDK installs the
+     *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+     *     a promise that resolves once the user is populated (or rejects
+     *     if the token is invalid).
+     *
+     * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+     * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+     * lifecycle events.
      */
-    setSession(session: AuthSession | null, _internal?: boolean): void;
+    setSession(session: AuthSession | SetSessionTokens | null, _internal?: boolean): void | Promise<{
+        data: AuthSession | null;
+        error: any;
+    }>;
     signUp(params: {
         email: string;
         password: string;
@@ -329,7 +365,19 @@ declare class AuthClient {
         };
         error: any;
     }>;
-    getUser(): Promise<{
+    /**
+     * Install an OAuth / magic-link session from the URL hash.
+     * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+     * in createClient. New consumers should just call `setSession()` directly.
+     */
+    _ingestHashTokens(tokens: SetSessionTokens): Promise<void>;
+    /**
+     * Fetch the current user.
+     * @param jwt Optional access token to use instead of the stored session.
+     *   Useful for validating a JWT without installing it as the active session
+     *   (e.g. admin tooling, custom auth bridges).
+     */
+    getUser(jwt?: string): Promise<{
         data: {
             user: AuthUser | null;
         };
@@ -470,11 +518,31 @@ interface LinabaseConfig {
     url: string;
     anonKey?: string;
     serviceRoleKey?: string;
+    /**
+     * Optional: target a specific DB branch for the entire lifetime of the client.
+     * When set, every request carries an `X-Branch: {slug}` header so the REST API
+     * routes it to the branch schemas. Equivalent to calling `.branch(slug)` on
+     * the returned client, except it applies to the root client directly.
+     *
+     * Leave unset (the default) to use the main project schemas.
+     */
+    branch?: string;
     /** Persistent storage for auth sessions (e.g., AsyncStorage for React Native). */
     auth?: {
         storage?: SessionStorage;
         storageKey?: string;
         persistSession?: boolean;
+        /**
+         * Auto-consume OAuth / magic-link tokens from the URL hash on startup.
+         * When the server redirects the user back with
+         * `#access_token=…&refresh_token=…`, the SDK reads the fragment, calls
+         * setSession, and clears the hash from the URL so the tokens aren't
+         * visible in the address bar or bookmarked by mistake.
+         *
+         * Defaults to true in browsers (disable only if you want to handle the
+         * hash yourself). No-op in Node / SSR since there's no window.
+         */
+        detectSessionInUrl?: boolean;
     };
 }
 interface LinabaseClient {

package/dist/index.d.ts

@@ -251,6 +251,20 @@ interface AuthSession {
     expires_at: number;
     user: AuthUser;
 }
+/**
+ * Token-only input accepted by `setSession` when a full AuthSession isn't
+ * available yet (OAuth / magic-link callbacks, custom auth bridges). The SDK
+ * fetches the user and fills in defaults for `token_type` / `expires_in` /
+ * `expires_at` when omitted.
+ */
+interface SetSessionTokens {
+    access_token: string;
+    refresh_token: string;
+    token_type?: string;
+    expires_in?: number;
+    expires_at?: number;
+    user?: null;
+}
 interface AuthUser {
     id: string;
     email: string | null;
@@ -268,6 +282,14 @@ declare class AuthClient {
     private listeners;
     /** Promise that resolves when session restore from storage is complete. */
     _restorePromise: Promise<void>;
+    /** API key for auth requests that shouldn't use the (possibly expired) access token. */
+    _apiKey: string;
+    /** Absolute base URL of the Linabase REST API, used to build browser-level
+     *  redirect targets (signInWithOAuth) that must be resolved against the
+     *  API origin, not the caller's page origin. Empty string means "resolve
+     *  relative to the current page" which is only safe in server-side or
+     *  test contexts. */
+    _baseUrl: string;
     private currentSession;
     /**
      * Callback that the parent LinabaseClient can set to update the Authorization
@@ -276,13 +298,27 @@ declare class AuthClient {
     onSessionChange: ((session: AuthSession | null) => void) | null;
     constructor(request: RequestFn$1);
     /**
-     * Set (or clear) the current session. Use this to restore a persisted
-     * session on app launch (e.g., from AsyncStorage / SecureStore).
-     * Automatically refreshes the token if it has expired.
-     * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-     * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+     * Set (or clear) the current session.
+     *
+     * Three valid shapes:
+     *   - `null` — clear the session.
+     *   - Full `AuthSession` — restore a persisted session (e.g. from
+     *     AsyncStorage). Auto-refreshes if the token is already expired.
+     *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+     *     pattern. Used by OAuth / magic-link callbacks that only have
+     *     tokens in the URL hash and no user object. The SDK installs the
+     *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+     *     a promise that resolves once the user is populated (or rejects
+     *     if the token is invalid).
+     *
+     * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+     * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+     * lifecycle events.
      */
-    setSession(session: AuthSession | null, _internal?: boolean): void;
+    setSession(session: AuthSession | SetSessionTokens | null, _internal?: boolean): void | Promise<{
+        data: AuthSession | null;
+        error: any;
+    }>;
     signUp(params: {
         email: string;
         password: string;
@@ -329,7 +365,19 @@ declare class AuthClient {
         };
         error: any;
     }>;
-    getUser(): Promise<{
+    /**
+     * Install an OAuth / magic-link session from the URL hash.
+     * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+     * in createClient. New consumers should just call `setSession()` directly.
+     */
+    _ingestHashTokens(tokens: SetSessionTokens): Promise<void>;
+    /**
+     * Fetch the current user.
+     * @param jwt Optional access token to use instead of the stored session.
+     *   Useful for validating a JWT without installing it as the active session
+     *   (e.g. admin tooling, custom auth bridges).
+     */
+    getUser(jwt?: string): Promise<{
         data: {
             user: AuthUser | null;
         };
@@ -470,11 +518,31 @@ interface LinabaseConfig {
     url: string;
     anonKey?: string;
     serviceRoleKey?: string;
+    /**
+     * Optional: target a specific DB branch for the entire lifetime of the client.
+     * When set, every request carries an `X-Branch: {slug}` header so the REST API
+     * routes it to the branch schemas. Equivalent to calling `.branch(slug)` on
+     * the returned client, except it applies to the root client directly.
+     *
+     * Leave unset (the default) to use the main project schemas.
+     */
+    branch?: string;
     /** Persistent storage for auth sessions (e.g., AsyncStorage for React Native). */
     auth?: {
         storage?: SessionStorage;
         storageKey?: string;
         persistSession?: boolean;
+        /**
+         * Auto-consume OAuth / magic-link tokens from the URL hash on startup.
+         * When the server redirects the user back with
+         * `#access_token=…&refresh_token=…`, the SDK reads the fragment, calls
+         * setSession, and clears the hash from the URL so the tokens aren't
+         * visible in the address bar or bookmarked by mistake.
+         *
+         * Defaults to true in browsers (disable only if you want to handle the
+         * hash yourself). No-op in Node / SSR since there's no window.
+         */
+        detectSessionInUrl?: boolean;
     };
 }
 interface LinabaseClient {

package/dist/index.js

@@ -664,6 +664,14 @@ var AuthClient = class {
   listeners = [];
   /** Promise that resolves when session restore from storage is complete. */
   _restorePromise = Promise.resolve();
+  /** API key for auth requests that shouldn't use the (possibly expired) access token. */
+  _apiKey = "";
+  /** Absolute base URL of the Linabase REST API, used to build browser-level
+   *  redirect targets (signInWithOAuth) that must be resolved against the
+   *  API origin, not the caller's page origin. Empty string means "resolve
+   *  relative to the current page" which is only safe in server-side or
+   *  test contexts. */
+  _baseUrl = "";
   currentSession = null;
   /**
    * Callback that the parent LinabaseClient can set to update the Authorization
@@ -674,17 +682,59 @@ var AuthClient = class {
     this.request = request;
   }
   /**
-   * Set (or clear) the current session. Use this to restore a persisted
-   * session on app launch (e.g., from AsyncStorage / SecureStore).
-   * Automatically refreshes the token if it has expired.
-   * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-   * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+   * Set (or clear) the current session.
+   *
+   * Three valid shapes:
+   *   - `null` — clear the session.
+   *   - Full `AuthSession` — restore a persisted session (e.g. from
+   *     AsyncStorage). Auto-refreshes if the token is already expired.
+   *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+   *     pattern. Used by OAuth / magic-link callbacks that only have
+   *     tokens in the URL hash and no user object. The SDK installs the
+   *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+   *     a promise that resolves once the user is populated (or rejects
+   *     if the token is invalid).
+   *
+   * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+   * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+   * lifecycle events.
    */
   setSession(session, _internal) {
+    if (session === null) {
+      this.currentSession = null;
+      if (this.onSessionChange) this.onSessionChange(null);
+      if (!_internal) this.emit("INITIAL_SESSION", null);
+      return;
+    }
+    if (!("user" in session) || !session.user) {
+      const tokens = {
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        token_type: session.token_type ?? "bearer",
+        expires_in: session.expires_in ?? 3600,
+        expires_at: session.expires_at ?? Math.floor(Date.now() / 1e3) + (session.expires_in ?? 3600),
+        user: null
+      };
+      this.currentSession = tokens;
+      if (this.onSessionChange) this.onSessionChange(tokens);
+      return (async () => {
+        const { data, error } = await this.getUser();
+        if (error || !data.user) {
+          this.currentSession = null;
+          if (this.onSessionChange) this.onSessionChange(null);
+          return { data: null, error: error ?? { message: "User lookup failed" } };
+        }
+        const full = { ...tokens, user: data.user };
+        this.currentSession = full;
+        if (this.onSessionChange) this.onSessionChange(full);
+        if (!_internal) this.emit("SIGNED_IN", full);
+        return { data: full, error: null };
+      })();
+    }
     this.currentSession = session;
     if (this.onSessionChange) this.onSessionChange(session);
     if (!_internal) {
-      if (session && session.expires_at <= Math.floor(Date.now() / 1e3)) {
+      if (session.expires_at <= Math.floor(Date.now() / 1e3)) {
         this.refreshSession().then(({ error }) => {
           if (error) {
             this.currentSession = null;
@@ -760,8 +810,10 @@ var AuthClient = class {
   // ─── OAuth ─────────────────────────────────────────────────
   signInWithOAuth(params) {
     const queryParams = new URLSearchParams({ provider: params.provider });
+    if (this._apiKey) queryParams.set("apikey", this._apiKey);
     if (params.redirectTo) queryParams.set("redirect_to", params.redirectTo);
-    const url = `/auth/v1/authorize?${queryParams}`;
+    const base = this._baseUrl.replace(/\/$/, "");
+    const url = `${base}/auth/v1/authorize?${queryParams}`;
     if (typeof window !== "undefined") {
       window.location.href = url;
     }
@@ -790,9 +842,25 @@ var AuthClient = class {
     }
     return { data: { session: null }, error: null };
   }
-  async getUser() {
+  /**
+   * Install an OAuth / magic-link session from the URL hash.
+   * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+   * in createClient. New consumers should just call `setSession()` directly.
+   */
+  async _ingestHashTokens(tokens) {
+    const result = this.setSession(tokens);
+    if (result instanceof Promise) await result;
+  }
+  /**
+   * Fetch the current user.
+   * @param jwt Optional access token to use instead of the stored session.
+   *   Useful for validating a JWT without installing it as the active session
+   *   (e.g. admin tooling, custom auth bridges).
+   */
+  async getUser(jwt) {
     try {
-      const res = await this.request("/auth/v1/user");
+      const options = jwt ? { headers: { Authorization: `Bearer ${jwt}` } } : {};
+      const res = await this.request("/auth/v1/user", options);
       const data = await res.json();
       if (!res.ok) return { data: { user: null }, error: data };
       return { data: { user: data }, error: null };
@@ -807,6 +875,8 @@ var AuthClient = class {
     try {
       const res = await this.request("/auth/v1/token?grant_type=refresh_token", {
         method: "POST",
+        // Force API key auth instead of (possibly expired) access token
+        headers: { "Authorization": `Bearer ${this._apiKey}` },
         body: JSON.stringify({ refresh_token: this.currentSession.refresh_token })
       });
       const data = await res.json();
@@ -1122,6 +1192,8 @@ function createClient(config) {
     });
   }
   const authClient = new AuthClient(request);
+  authClient._apiKey = apiKey;
+  authClient._baseUrl = baseUrl;
   const persistSession = config.auth?.persistSession !== false && !!config.auth?.storage;
   const sessionStorage = config.auth?.storage;
   const sessionKey = config.auth?.storageKey || "@linabase/session";
@@ -1146,10 +1218,41 @@ function createClient(config) {
       }
     });
   }
+  const detectSessionInUrl = config.auth?.detectSessionInUrl !== false;
+  if (detectSessionInUrl && typeof window !== "undefined" && window.location?.hash) {
+    const pending = authClient._restorePromise;
+    authClient._restorePromise = Promise.resolve(pending).then(async () => {
+      const hash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const params = new URLSearchParams(hash);
+      const access_token = params.get("access_token");
+      const refresh_token = params.get("refresh_token");
+      if (!access_token || !refresh_token) return;
+      const expires_in = Number(params.get("expires_in") || 3600);
+      const expires_at = Number(
+        params.get("expires_at") || Math.floor(Date.now() / 1e3) + expires_in
+      );
+      const ingest = authClient._ingestHashTokens({
+        access_token,
+        refresh_token,
+        token_type: params.get("token_type") || "bearer",
+        expires_in,
+        expires_at
+      });
+      try {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        window.history.replaceState(null, "", url.toString());
+      } catch {
+      }
+      await ingest;
+    });
+  }
   function buildClient(reqFn, branchSlug) {
     const rc = new RpcClient(reqFn);
     const ac = branchSlug ? new AuthClient(reqFn) : authClient;
     if (branchSlug) {
+      ac._apiKey = apiKey;
+      ac._baseUrl = baseUrl;
       ac.onSessionChange = (session) => {
         accessToken = session?.access_token || null;
       };
@@ -1198,6 +1301,20 @@ function createClient(config) {
       }
     };
   }
+  if (config.branch) {
+    let pinnedRequest2 = function(path, options = {}) {
+      return request(path, {
+        ...options,
+        headers: {
+          ...options.headers,
+          "X-Branch": pinned
+        }
+      });
+    };
+    var pinnedRequest = pinnedRequest2;
+    const pinned = config.branch;
+    return buildClient(pinnedRequest2, pinned);
+  }
   return buildClient(request);
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linabase/js",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "JavaScript/TypeScript client SDK for Linabase (database, storage, auth)",
   "license": "MIT",
   "type": "module",
@@ -35,24 +35,23 @@
     "directory": "packages/sdk-js"
   },
   "homepage": "https://linabase.com",
+  "devDependencies": {
+    "@types/pg": "^8.11.0",
+    "@vitest/coverage-v8": "^3.2.4",
+    "pg": "^8.13.0",
+    "tsup": "^8.3.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.1",
+    "@linabase/rest-api": "0.0.1",
+    "@linabase/db": "0.0.1"
+  },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "prepublishOnly": "tsup",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src/"
-  },
-  "devDependencies": {
-    "@linabase/db": "workspace:*",
-    "@linabase/rest-api": "workspace:*",
-    "@types/pg": "^8.11.0",
-    "@vitest/coverage-v8": "^3.2.4",
-    "pg": "^8.13.0",
-    "tsup": "^8.3.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.2.1"
   }
-}
+}