@linabase/js 0.4.4 → 0.5.1

package/dist/index.cjs

@@ -52,7 +52,12 @@ var DatabaseClient = class {
   // ─── Query Methods ──────────────────────────────────────
   /** Select columns. Supports nested joins: "*, comments(*)" and aliases: "full_name:name" */
   select(columns, options) {
-    this.method = options?.head ? "HEAD" : "GET";
+    const isMutation = this.method === "POST" || this.method === "PATCH" || this.method === "DELETE";
+    if (!isMutation) {
+      this.method = options?.head ? "HEAD" : "GET";
+    } else if (!this.preferHeaders.some((h) => h.startsWith("return="))) {
+      this.preferHeaders.push("return=representation");
+    }
     if (columns && columns !== "*") this.params.set("select", columns);
     if (options?.count) this.preferHeaders.push(`count=${options.count}`);
     return this;
@@ -698,6 +703,12 @@ var AuthClient = class {
   _restorePromise = Promise.resolve();
   /** API key for auth requests that shouldn't use the (possibly expired) access token. */
   _apiKey = "";
+  /** Absolute base URL of the Linabase REST API, used to build browser-level
+   *  redirect targets (signInWithOAuth) that must be resolved against the
+   *  API origin, not the caller's page origin. Empty string means "resolve
+   *  relative to the current page" which is only safe in server-side or
+   *  test contexts. */
+  _baseUrl = "";
   currentSession = null;
   /**
    * Callback that the parent LinabaseClient can set to update the Authorization
@@ -708,17 +719,59 @@ var AuthClient = class {
     this.request = request;
   }
   /**
-   * Set (or clear) the current session. Use this to restore a persisted
-   * session on app launch (e.g., from AsyncStorage / SecureStore).
-   * Automatically refreshes the token if it has expired.
-   * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-   * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+   * Set (or clear) the current session.
+   *
+   * Three valid shapes:
+   *   - `null` — clear the session.
+   *   - Full `AuthSession` — restore a persisted session (e.g. from
+   *     AsyncStorage). Auto-refreshes if the token is already expired.
+   *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+   *     pattern. Used by OAuth / magic-link callbacks that only have
+   *     tokens in the URL hash and no user object. The SDK installs the
+   *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+   *     a promise that resolves once the user is populated (or rejects
+   *     if the token is invalid).
+   *
+   * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+   * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+   * lifecycle events.
    */
   setSession(session, _internal) {
+    if (session === null) {
+      this.currentSession = null;
+      if (this.onSessionChange) this.onSessionChange(null);
+      if (!_internal) this.emit("INITIAL_SESSION", null);
+      return;
+    }
+    if (!("user" in session) || !session.user) {
+      const tokens = {
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        token_type: session.token_type ?? "bearer",
+        expires_in: session.expires_in ?? 3600,
+        expires_at: session.expires_at ?? Math.floor(Date.now() / 1e3) + (session.expires_in ?? 3600),
+        user: null
+      };
+      this.currentSession = tokens;
+      if (this.onSessionChange) this.onSessionChange(tokens);
+      return (async () => {
+        const { data, error } = await this.getUser();
+        if (error || !data.user) {
+          this.currentSession = null;
+          if (this.onSessionChange) this.onSessionChange(null);
+          return { data: null, error: error ?? { message: "User lookup failed" } };
+        }
+        const full = { ...tokens, user: data.user };
+        this.currentSession = full;
+        if (this.onSessionChange) this.onSessionChange(full);
+        if (!_internal) this.emit("SIGNED_IN", full);
+        return { data: full, error: null };
+      })();
+    }
     this.currentSession = session;
     if (this.onSessionChange) this.onSessionChange(session);
     if (!_internal) {
-      if (session && session.expires_at <= Math.floor(Date.now() / 1e3)) {
+      if (session.expires_at <= Math.floor(Date.now() / 1e3)) {
         this.refreshSession().then(({ error }) => {
           if (error) {
             this.currentSession = null;
@@ -794,8 +847,10 @@ var AuthClient = class {
   // ─── OAuth ─────────────────────────────────────────────────
   signInWithOAuth(params) {
     const queryParams = new URLSearchParams({ provider: params.provider });
+    if (this._apiKey) queryParams.set("apikey", this._apiKey);
     if (params.redirectTo) queryParams.set("redirect_to", params.redirectTo);
-    const url = `/auth/v1/authorize?${queryParams}`;
+    const base = this._baseUrl.replace(/\/$/, "");
+    const url = `${base}/auth/v1/authorize?${queryParams}`;
     if (typeof window !== "undefined") {
       window.location.href = url;
     }
@@ -824,9 +879,25 @@ var AuthClient = class {
     }
     return { data: { session: null }, error: null };
   }
-  async getUser() {
+  /**
+   * Install an OAuth / magic-link session from the URL hash.
+   * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+   * in createClient. New consumers should just call `setSession()` directly.
+   */
+  async _ingestHashTokens(tokens) {
+    const result = this.setSession(tokens);
+    if (result instanceof Promise) await result;
+  }
+  /**
+   * Fetch the current user.
+   * @param jwt Optional access token to use instead of the stored session.
+   *   Useful for validating a JWT without installing it as the active session
+   *   (e.g. admin tooling, custom auth bridges).
+   */
+  async getUser(jwt) {
     try {
-      const res = await this.request("/auth/v1/user");
+      const options = jwt ? { headers: { Authorization: `Bearer ${jwt}` } } : {};
+      const res = await this.request("/auth/v1/user", options);
       const data = await res.json();
       if (!res.ok) return { data: { user: null }, error: data };
       return { data: { user: data }, error: null };
@@ -1159,6 +1230,7 @@ function createClient(config) {
   }
   const authClient = new AuthClient(request);
   authClient._apiKey = apiKey;
+  authClient._baseUrl = baseUrl;
   const persistSession = config.auth?.persistSession !== false && !!config.auth?.storage;
   const sessionStorage = config.auth?.storage;
   const sessionKey = config.auth?.storageKey || "@linabase/session";
@@ -1183,10 +1255,41 @@ function createClient(config) {
       }
     });
   }
+  const detectSessionInUrl = config.auth?.detectSessionInUrl !== false;
+  if (detectSessionInUrl && typeof window !== "undefined" && window.location?.hash) {
+    const pending = authClient._restorePromise;
+    authClient._restorePromise = Promise.resolve(pending).then(async () => {
+      const hash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const params = new URLSearchParams(hash);
+      const access_token = params.get("access_token");
+      const refresh_token = params.get("refresh_token");
+      if (!access_token || !refresh_token) return;
+      const expires_in = Number(params.get("expires_in") || 3600);
+      const expires_at = Number(
+        params.get("expires_at") || Math.floor(Date.now() / 1e3) + expires_in
+      );
+      const ingest = authClient._ingestHashTokens({
+        access_token,
+        refresh_token,
+        token_type: params.get("token_type") || "bearer",
+        expires_in,
+        expires_at
+      });
+      try {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        window.history.replaceState(null, "", url.toString());
+      } catch {
+      }
+      await ingest;
+    });
+  }
   function buildClient(reqFn, branchSlug) {
     const rc = new RpcClient(reqFn);
     const ac = branchSlug ? new AuthClient(reqFn) : authClient;
     if (branchSlug) {
+      ac._apiKey = apiKey;
+      ac._baseUrl = baseUrl;
       ac.onSessionChange = (session) => {
         accessToken = session?.access_token || null;
       };
@@ -1235,6 +1338,20 @@ function createClient(config) {
       }
     };
   }
+  if (config.branch) {
+    let pinnedRequest2 = function(path, options = {}) {
+      return request(path, {
+        ...options,
+        headers: {
+          ...options.headers,
+          "X-Branch": pinned
+        }
+      });
+    };
+    var pinnedRequest = pinnedRequest2;
+    const pinned = config.branch;
+    return buildClient(pinnedRequest2, pinned);
+  }
   return buildClient(request);
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/index.d.cts

@@ -251,6 +251,20 @@ interface AuthSession {
     expires_at: number;
     user: AuthUser;
 }
+/**
+ * Token-only input accepted by `setSession` when a full AuthSession isn't
+ * available yet (OAuth / magic-link callbacks, custom auth bridges). The SDK
+ * fetches the user and fills in defaults for `token_type` / `expires_in` /
+ * `expires_at` when omitted.
+ */
+interface SetSessionTokens {
+    access_token: string;
+    refresh_token: string;
+    token_type?: string;
+    expires_in?: number;
+    expires_at?: number;
+    user?: null;
+}
 interface AuthUser {
     id: string;
     email: string | null;
@@ -270,6 +284,12 @@ declare class AuthClient {
     _restorePromise: Promise<void>;
     /** API key for auth requests that shouldn't use the (possibly expired) access token. */
     _apiKey: string;
+    /** Absolute base URL of the Linabase REST API, used to build browser-level
+     *  redirect targets (signInWithOAuth) that must be resolved against the
+     *  API origin, not the caller's page origin. Empty string means "resolve
+     *  relative to the current page" which is only safe in server-side or
+     *  test contexts. */
+    _baseUrl: string;
     private currentSession;
     /**
      * Callback that the parent LinabaseClient can set to update the Authorization
@@ -278,13 +298,27 @@ declare class AuthClient {
     onSessionChange: ((session: AuthSession | null) => void) | null;
     constructor(request: RequestFn$1);
     /**
-     * Set (or clear) the current session. Use this to restore a persisted
-     * session on app launch (e.g., from AsyncStorage / SecureStore).
-     * Automatically refreshes the token if it has expired.
-     * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-     * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+     * Set (or clear) the current session.
+     *
+     * Three valid shapes:
+     *   - `null` — clear the session.
+     *   - Full `AuthSession` — restore a persisted session (e.g. from
+     *     AsyncStorage). Auto-refreshes if the token is already expired.
+     *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+     *     pattern. Used by OAuth / magic-link callbacks that only have
+     *     tokens in the URL hash and no user object. The SDK installs the
+     *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+     *     a promise that resolves once the user is populated (or rejects
+     *     if the token is invalid).
+     *
+     * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+     * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+     * lifecycle events.
      */
-    setSession(session: AuthSession | null, _internal?: boolean): void;
+    setSession(session: AuthSession | SetSessionTokens | null, _internal?: boolean): void | Promise<{
+        data: AuthSession | null;
+        error: any;
+    }>;
     signUp(params: {
         email: string;
         password: string;
@@ -331,7 +365,19 @@ declare class AuthClient {
         };
         error: any;
     }>;
-    getUser(): Promise<{
+    /**
+     * Install an OAuth / magic-link session from the URL hash.
+     * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+     * in createClient. New consumers should just call `setSession()` directly.
+     */
+    _ingestHashTokens(tokens: SetSessionTokens): Promise<void>;
+    /**
+     * Fetch the current user.
+     * @param jwt Optional access token to use instead of the stored session.
+     *   Useful for validating a JWT without installing it as the active session
+     *   (e.g. admin tooling, custom auth bridges).
+     */
+    getUser(jwt?: string): Promise<{
         data: {
             user: AuthUser | null;
         };
@@ -472,11 +518,31 @@ interface LinabaseConfig {
     url: string;
     anonKey?: string;
     serviceRoleKey?: string;
+    /**
+     * Optional: target a specific DB branch for the entire lifetime of the client.
+     * When set, every request carries an `X-Branch: {slug}` header so the REST API
+     * routes it to the branch schemas. Equivalent to calling `.branch(slug)` on
+     * the returned client, except it applies to the root client directly.
+     *
+     * Leave unset (the default) to use the main project schemas.
+     */
+    branch?: string;
     /** Persistent storage for auth sessions (e.g., AsyncStorage for React Native). */
     auth?: {
         storage?: SessionStorage;
         storageKey?: string;
         persistSession?: boolean;
+        /**
+         * Auto-consume OAuth / magic-link tokens from the URL hash on startup.
+         * When the server redirects the user back with
+         * `#access_token=…&refresh_token=…`, the SDK reads the fragment, calls
+         * setSession, and clears the hash from the URL so the tokens aren't
+         * visible in the address bar or bookmarked by mistake.
+         *
+         * Defaults to true in browsers (disable only if you want to handle the
+         * hash yourself). No-op in Node / SSR since there's no window.
+         */
+        detectSessionInUrl?: boolean;
     };
 }
 interface LinabaseClient {

package/dist/index.d.ts

@@ -251,6 +251,20 @@ interface AuthSession {
     expires_at: number;
     user: AuthUser;
 }
+/**
+ * Token-only input accepted by `setSession` when a full AuthSession isn't
+ * available yet (OAuth / magic-link callbacks, custom auth bridges). The SDK
+ * fetches the user and fills in defaults for `token_type` / `expires_in` /
+ * `expires_at` when omitted.
+ */
+interface SetSessionTokens {
+    access_token: string;
+    refresh_token: string;
+    token_type?: string;
+    expires_in?: number;
+    expires_at?: number;
+    user?: null;
+}
 interface AuthUser {
     id: string;
     email: string | null;
@@ -270,6 +284,12 @@ declare class AuthClient {
     _restorePromise: Promise<void>;
     /** API key for auth requests that shouldn't use the (possibly expired) access token. */
     _apiKey: string;
+    /** Absolute base URL of the Linabase REST API, used to build browser-level
+     *  redirect targets (signInWithOAuth) that must be resolved against the
+     *  API origin, not the caller's page origin. Empty string means "resolve
+     *  relative to the current page" which is only safe in server-side or
+     *  test contexts. */
+    _baseUrl: string;
     private currentSession;
     /**
      * Callback that the parent LinabaseClient can set to update the Authorization
@@ -278,13 +298,27 @@ declare class AuthClient {
     onSessionChange: ((session: AuthSession | null) => void) | null;
     constructor(request: RequestFn$1);
     /**
-     * Set (or clear) the current session. Use this to restore a persisted
-     * session on app launch (e.g., from AsyncStorage / SecureStore).
-     * Automatically refreshes the token if it has expired.
-     * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-     * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+     * Set (or clear) the current session.
+     *
+     * Three valid shapes:
+     *   - `null` — clear the session.
+     *   - Full `AuthSession` — restore a persisted session (e.g. from
+     *     AsyncStorage). Auto-refreshes if the token is already expired.
+     *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+     *     pattern. Used by OAuth / magic-link callbacks that only have
+     *     tokens in the URL hash and no user object. The SDK installs the
+     *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+     *     a promise that resolves once the user is populated (or rejects
+     *     if the token is invalid).
+     *
+     * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+     * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+     * lifecycle events.
      */
-    setSession(session: AuthSession | null, _internal?: boolean): void;
+    setSession(session: AuthSession | SetSessionTokens | null, _internal?: boolean): void | Promise<{
+        data: AuthSession | null;
+        error: any;
+    }>;
     signUp(params: {
         email: string;
         password: string;
@@ -331,7 +365,19 @@ declare class AuthClient {
         };
         error: any;
     }>;
-    getUser(): Promise<{
+    /**
+     * Install an OAuth / magic-link session from the URL hash.
+     * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+     * in createClient. New consumers should just call `setSession()` directly.
+     */
+    _ingestHashTokens(tokens: SetSessionTokens): Promise<void>;
+    /**
+     * Fetch the current user.
+     * @param jwt Optional access token to use instead of the stored session.
+     *   Useful for validating a JWT without installing it as the active session
+     *   (e.g. admin tooling, custom auth bridges).
+     */
+    getUser(jwt?: string): Promise<{
         data: {
             user: AuthUser | null;
         };
@@ -472,11 +518,31 @@ interface LinabaseConfig {
     url: string;
     anonKey?: string;
     serviceRoleKey?: string;
+    /**
+     * Optional: target a specific DB branch for the entire lifetime of the client.
+     * When set, every request carries an `X-Branch: {slug}` header so the REST API
+     * routes it to the branch schemas. Equivalent to calling `.branch(slug)` on
+     * the returned client, except it applies to the root client directly.
+     *
+     * Leave unset (the default) to use the main project schemas.
+     */
+    branch?: string;
     /** Persistent storage for auth sessions (e.g., AsyncStorage for React Native). */
     auth?: {
         storage?: SessionStorage;
         storageKey?: string;
         persistSession?: boolean;
+        /**
+         * Auto-consume OAuth / magic-link tokens from the URL hash on startup.
+         * When the server redirects the user back with
+         * `#access_token=…&refresh_token=…`, the SDK reads the fragment, calls
+         * setSession, and clears the hash from the URL so the tokens aren't
+         * visible in the address bar or bookmarked by mistake.
+         *
+         * Defaults to true in browsers (disable only if you want to handle the
+         * hash yourself). No-op in Node / SSR since there's no window.
+         */
+        detectSessionInUrl?: boolean;
     };
 }
 interface LinabaseClient {

package/dist/index.js

@@ -20,7 +20,12 @@ var DatabaseClient = class {
   // ─── Query Methods ──────────────────────────────────────
   /** Select columns. Supports nested joins: "*, comments(*)" and aliases: "full_name:name" */
   select(columns, options) {
-    this.method = options?.head ? "HEAD" : "GET";
+    const isMutation = this.method === "POST" || this.method === "PATCH" || this.method === "DELETE";
+    if (!isMutation) {
+      this.method = options?.head ? "HEAD" : "GET";
+    } else if (!this.preferHeaders.some((h) => h.startsWith("return="))) {
+      this.preferHeaders.push("return=representation");
+    }
     if (columns && columns !== "*") this.params.set("select", columns);
     if (options?.count) this.preferHeaders.push(`count=${options.count}`);
     return this;
@@ -666,6 +671,12 @@ var AuthClient = class {
   _restorePromise = Promise.resolve();
   /** API key for auth requests that shouldn't use the (possibly expired) access token. */
   _apiKey = "";
+  /** Absolute base URL of the Linabase REST API, used to build browser-level
+   *  redirect targets (signInWithOAuth) that must be resolved against the
+   *  API origin, not the caller's page origin. Empty string means "resolve
+   *  relative to the current page" which is only safe in server-side or
+   *  test contexts. */
+  _baseUrl = "";
   currentSession = null;
   /**
    * Callback that the parent LinabaseClient can set to update the Authorization
@@ -676,17 +687,59 @@ var AuthClient = class {
     this.request = request;
   }
   /**
-   * Set (or clear) the current session. Use this to restore a persisted
-   * session on app launch (e.g., from AsyncStorage / SecureStore).
-   * Automatically refreshes the token if it has expired.
-   * Emits INITIAL_SESSION to onAuthStateChange listeners when called externally.
-   * Internal callers (signIn, signUp, etc.) pass _internal=true to skip the emit.
+   * Set (or clear) the current session.
+   *
+   * Three valid shapes:
+   *   - `null` — clear the session.
+   *   - Full `AuthSession` — restore a persisted session (e.g. from
+   *     AsyncStorage). Auto-refreshes if the token is already expired.
+   *   - `{ access_token, refresh_token, ... }` — token-only, Supabase v2
+   *     pattern. Used by OAuth / magic-link callbacks that only have
+   *     tokens in the URL hash and no user object. The SDK installs the
+   *     tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns
+   *     a promise that resolves once the user is populated (or rejects
+   *     if the token is invalid).
+   *
+   * Internal callers (signIn, signUp, etc.) pass `_internal=true` to
+   * skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own
+   * lifecycle events.
    */
   setSession(session, _internal) {
+    if (session === null) {
+      this.currentSession = null;
+      if (this.onSessionChange) this.onSessionChange(null);
+      if (!_internal) this.emit("INITIAL_SESSION", null);
+      return;
+    }
+    if (!("user" in session) || !session.user) {
+      const tokens = {
+        access_token: session.access_token,
+        refresh_token: session.refresh_token,
+        token_type: session.token_type ?? "bearer",
+        expires_in: session.expires_in ?? 3600,
+        expires_at: session.expires_at ?? Math.floor(Date.now() / 1e3) + (session.expires_in ?? 3600),
+        user: null
+      };
+      this.currentSession = tokens;
+      if (this.onSessionChange) this.onSessionChange(tokens);
+      return (async () => {
+        const { data, error } = await this.getUser();
+        if (error || !data.user) {
+          this.currentSession = null;
+          if (this.onSessionChange) this.onSessionChange(null);
+          return { data: null, error: error ?? { message: "User lookup failed" } };
+        }
+        const full = { ...tokens, user: data.user };
+        this.currentSession = full;
+        if (this.onSessionChange) this.onSessionChange(full);
+        if (!_internal) this.emit("SIGNED_IN", full);
+        return { data: full, error: null };
+      })();
+    }
     this.currentSession = session;
     if (this.onSessionChange) this.onSessionChange(session);
     if (!_internal) {
-      if (session && session.expires_at <= Math.floor(Date.now() / 1e3)) {
+      if (session.expires_at <= Math.floor(Date.now() / 1e3)) {
         this.refreshSession().then(({ error }) => {
           if (error) {
             this.currentSession = null;
@@ -762,8 +815,10 @@ var AuthClient = class {
   // ─── OAuth ─────────────────────────────────────────────────
   signInWithOAuth(params) {
     const queryParams = new URLSearchParams({ provider: params.provider });
+    if (this._apiKey) queryParams.set("apikey", this._apiKey);
     if (params.redirectTo) queryParams.set("redirect_to", params.redirectTo);
-    const url = `/auth/v1/authorize?${queryParams}`;
+    const base = this._baseUrl.replace(/\/$/, "");
+    const url = `${base}/auth/v1/authorize?${queryParams}`;
     if (typeof window !== "undefined") {
       window.location.href = url;
     }
@@ -792,9 +847,25 @@ var AuthClient = class {
     }
     return { data: { session: null }, error: null };
   }
-  async getUser() {
+  /**
+   * Install an OAuth / magic-link session from the URL hash.
+   * Thin wrapper around `setSession(tokens)` kept for the auto-detect path
+   * in createClient. New consumers should just call `setSession()` directly.
+   */
+  async _ingestHashTokens(tokens) {
+    const result = this.setSession(tokens);
+    if (result instanceof Promise) await result;
+  }
+  /**
+   * Fetch the current user.
+   * @param jwt Optional access token to use instead of the stored session.
+   *   Useful for validating a JWT without installing it as the active session
+   *   (e.g. admin tooling, custom auth bridges).
+   */
+  async getUser(jwt) {
     try {
-      const res = await this.request("/auth/v1/user");
+      const options = jwt ? { headers: { Authorization: `Bearer ${jwt}` } } : {};
+      const res = await this.request("/auth/v1/user", options);
       const data = await res.json();
       if (!res.ok) return { data: { user: null }, error: data };
       return { data: { user: data }, error: null };
@@ -1127,6 +1198,7 @@ function createClient(config) {
   }
   const authClient = new AuthClient(request);
   authClient._apiKey = apiKey;
+  authClient._baseUrl = baseUrl;
   const persistSession = config.auth?.persistSession !== false && !!config.auth?.storage;
   const sessionStorage = config.auth?.storage;
   const sessionKey = config.auth?.storageKey || "@linabase/session";
@@ -1151,10 +1223,41 @@ function createClient(config) {
       }
     });
   }
+  const detectSessionInUrl = config.auth?.detectSessionInUrl !== false;
+  if (detectSessionInUrl && typeof window !== "undefined" && window.location?.hash) {
+    const pending = authClient._restorePromise;
+    authClient._restorePromise = Promise.resolve(pending).then(async () => {
+      const hash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const params = new URLSearchParams(hash);
+      const access_token = params.get("access_token");
+      const refresh_token = params.get("refresh_token");
+      if (!access_token || !refresh_token) return;
+      const expires_in = Number(params.get("expires_in") || 3600);
+      const expires_at = Number(
+        params.get("expires_at") || Math.floor(Date.now() / 1e3) + expires_in
+      );
+      const ingest = authClient._ingestHashTokens({
+        access_token,
+        refresh_token,
+        token_type: params.get("token_type") || "bearer",
+        expires_in,
+        expires_at
+      });
+      try {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        window.history.replaceState(null, "", url.toString());
+      } catch {
+      }
+      await ingest;
+    });
+  }
   function buildClient(reqFn, branchSlug) {
     const rc = new RpcClient(reqFn);
     const ac = branchSlug ? new AuthClient(reqFn) : authClient;
     if (branchSlug) {
+      ac._apiKey = apiKey;
+      ac._baseUrl = baseUrl;
       ac.onSessionChange = (session) => {
         accessToken = session?.access_token || null;
       };
@@ -1203,6 +1306,20 @@ function createClient(config) {
       }
     };
   }
+  if (config.branch) {
+    let pinnedRequest2 = function(path, options = {}) {
+      return request(path, {
+        ...options,
+        headers: {
+          ...options.headers,
+          "X-Branch": pinned
+        }
+      });
+    };
+    var pinnedRequest = pinnedRequest2;
+    const pinned = config.branch;
+    return buildClient(pinnedRequest2, pinned);
+  }
   return buildClient(request);
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linabase/js",
-  "version": "0.4.4",
+  "version": "0.5.1",
   "description": "JavaScript/TypeScript client SDK for Linabase (database, storage, auth)",
   "license": "MIT",
   "type": "module",