Migrating from @arex95/vue-core

v6 is published as @arex95/phalanx. @arex95/vue-core stops at 5.1.0.

pnpm remove @arex95/vue-core
pnpm add @arex95/phalanx @tanstack/vue-query
pnpm remove ofetch uuid   # if they were installed only for the library

Renamed

v5	v6
ArexVueCore	Phalanx
ArexVueCoreOptions	PhalanxOptions
[arex-core] error prefix	[phalanx]

Session handling

Tokens are no longer stored by the library. The access token is held in memory and the refresh token is expected in a cookie set by the server.

Removed	Replacement
appKey, configKey	—
tokenKeys, configTokens, storeTokens	the accessToken ref
configSession, cleanCredentials	logout() clears the session
storage modes 'local', 'session', 'cookie'	a server-set cookie
refreshTokenBodyKey	the refresh request has no body

 app.use(Phalanx, {
-  appKey: import.meta.env.VITE_APP_KEY,
   endpoints: { login: '/auth/login', refresh: '/auth/refresh', logout: '/auth/logout' },
-  tokenKeys: { accessToken: 'access_token', refreshToken: 'refresh_token' },
   tokenPaths: { accessToken: 'data.access_token' },
   refreshResponsePaths: { accessToken: 'data.access_token' },
-  refreshTokenBodyKey: 'refresh_token',
-  axios: { baseURL },
+  axios: { baseURL, withCredentials: true },
 });

Reading the token:

-const token = await getDecryptedItem('access_token', 'any');
+import { accessToken } from '@arex95/phalanx';
+const token = accessToken.value;

This step needs the API to set the refresh cookie — see Server requirements.

Fetchers

createOfetchFetcher is removed, and ofetch is no longer a peer dependency. Any non-axios client is an adapter in your project:

-import { createOfetchFetcher, configAuthFetcher } from '@arex95/vue-core';
-configAuthFetcher(createOfetchFetcher('https://api.example.com'));
+import { configAuthFetcher, type Fetcher } from '@arex95/phalanx';
+import { $fetch } from 'ofetch';
+
+const ofetchFetcher: Fetcher = (config) =>
+    $fetch(config.url, {
+        method: config.method,
+        query: config.params,
+        body: config.data,
+        headers: config.headers
+    });
+
+configAuthFetcher(ofetchFetcher);

Encrypted storage

storeEncryptedItem and getDecryptedItem are replaced by setSecureItem and getSecureItem. The old pair used AES-CBC, which is unauthenticated, and took a key derived from a string that shipped in the bundle — recoverable from the browser, which is the one condition the guidance places on encrypting anything client-side.

-import { getAppKey, storeEncryptedItem, getDecryptedItem } from '@arex95/vue-core';
-
-await storeEncryptedItem('draft', value, getAppKey(), 'local');
-const draft = await getDecryptedItem('draft', getAppKey(), 'local');
+import { setSecureItem, getSecureItem } from '@arex95/phalanx';
+
+await setSecureItem('draft', value);
+const draft = await getSecureItem('draft');

There is no key to pass: the library generates a non-extractable CryptoKey and keeps it in IndexedDB. VITE_APP_KEY and anything like it can be deleted.

Cookies are no longer a storage target — 'local' | 'session' replaces LocationPreference. encrypt, decrypt, importKey and hex2ab are gone with the AES-CBC implementation they belonged to.

See Secure storage.

Services

static isFormData is removed. FormData, Blob and ArrayBuffer bodies are detected from the value.

 class DocumentService extends RestStd {
     static resource = 'documents';
-    static isFormData = true;
 }

customRequest takes a complete url and no longer prefixes resource.

New in v6

• createDomainQueries and createDomainMutations — TanStack composables derived from a service
• defineAction — permission, confirmation, notification and invalidation as metadata
• encryptField — hybrid field encryption
• CSRF double-submit on refresh and logout