@aws/nx-plugin 1.0.0-rc.2 → 1.0.0-rc.21

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -7,6 +7,8 @@ import { tanstackRouter } from '@tanstack/router-plugin/vite';
 /// <reference types='vitest' />
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
 
 export default defineConfig(() => ({
   root: import.meta.dirname,
@@ -25,11 +27,13 @@ export default defineConfig(() => ({
       generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
+    nxViteTsPaths(),
+    nxCopyAssetsPlugin(['*.md']),
     tailwindcss(),
   ],
   // Uncomment this if you are using workers.
   // worker: {
-  //  plugins: [],
+  //   plugins: () => [ nxViteTsPaths() ],
   // },
   build: {
     outDir: '../dist/test-app',
@@ -40,6 +44,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -47,10 +52,9 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../coverage/test-app',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -64,6 +68,8 @@ import { tanstackRouter } from '@tanstack/router-plugin/vite';
 /// <reference types='vitest' />
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
 
 export default defineConfig(() => ({
   root: import.meta.dirname,
@@ -82,10 +88,12 @@ export default defineConfig(() => ({
       generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
+    nxViteTsPaths(),
+    nxCopyAssetsPlugin(['*.md']),
   ],
   // Uncomment this if you are using workers.
   // worker: {
-  //  plugins: [],
+  //   plugins: () => [ nxViteTsPaths() ],
   // },
   build: {
     outDir: '../dist/test-app',
@@ -96,6 +104,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -103,10 +112,9 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../coverage/test-app',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -152,6 +160,15 @@ variable "website_file_path" {
   type        = string
 }
 
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -512,13 +529,41 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "\${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -548,11 +593,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -656,7 +702,7 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "\${path.root}"
+      cd "$ROOT_PATH"
       uv run --with boto3 python3 -c "
 import os
 import sys
@@ -745,9 +791,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -755,11 +806,12 @@ sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -776,6 +828,7 @@ resource "null_resource" "cloudfront_invalidation" {
     command = <<-EOT
       uv run --with boto3 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -797,7 +850,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: \${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\\"Invalidation\\"][\\"Status\\"]}')
 
     except NoCredentialsError:
@@ -811,9 +864,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('\${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [
@@ -905,61 +961,71 @@ vitest.config.*.timestamp*
 runtime-config.json"
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > .prettierignore 1`] = `
+"# Add files here to ignore them from prettier formatting
+/dist
+/coverage
+/.nx/cache
+/.nx/workspace-data"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > .prettierrc 1`] = `
 "{ "singleQuote": true }
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > eslint.config.mjs 1`] = `
-"import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import nx from '@nx/eslint-plugin';
-
-export default [
-  eslintPluginPrettierRecommended,
-  ...nx.configs['flat/base'],
-  ...nx.configs['flat/typescript'],
-  ...nx.configs['flat/javascript'],
-  {
-    ignores: [
-      '**/dist',
-      '**/out-tsc',
-      '**/vite.config.*.timestamp*',
-      '**/vitest.config.*.timestamp*',
-    ],
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
+"{
+  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": true,
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80
   },
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    rules: {
-      '@nx/enforce-module-boundaries': [
-        'error',
-        {
-          enforceBuildableLibDependency: true,
-          allow: ['^.*/eslint(\\\\.base)?\\\\.config\\\\.[cm]?[jt]s$'],
-          depConstraints: [
-            {
-              sourceTag: '*',
-              onlyDependOnLibsWithTags: ['*'],
-            },
-          ],
-        },
-      ],
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "all"
+    }
+  },
+  "css": {
+    "formatter": {
+      "quoteStyle": "single"
     },
+    "linter": {
+      "enabled": false
+    }
   },
-  {
-    files: [
-      '**/*.ts',
-      '**/*.tsx',
-      '**/*.cts',
-      '**/*.mts',
-      '**/*.js',
-      '**/*.jsx',
-      '**/*.cjs',
-      '**/*.mjs',
-    ],
-    // Override or add rules here
-    rules: {},
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": false,
+      "correctness": {
+        "noUndeclaredDependencies": "warn"
+      }
+    }
   },
-];
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/dist",
+      "!**/out-tsc",
+      "!**/node_modules",
+      "!**/.nx",
+      "!**/.venv",
+      "!**/*.css"
+    ]
+  }
+}
 "
 `;
 
@@ -977,17 +1043,6 @@ exports[`react-website generator > Tanstack router integration > should generate
     "lint": {
       "cache": true
     },
-    "@nx/eslint:lint": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^default",
-        "{workspaceRoot}/.eslintrc.json",
-        "{workspaceRoot}/.eslintignore",
-        "{workspaceRoot}/eslint.config.mjs",
-        "{workspaceRoot}/tools/eslint-rules/**/*"
-      ]
-    },
     "@nx/vite:build": {
       "cache": true,
       "dependsOn": ["^build"],
@@ -1016,7 +1071,7 @@ exports[`react-website generator > Tanstack router integration > should generate
       "application": {
         "babel": true,
         "style": "css",
-        "linter": "eslint",
+        "linter": "none",
         "bundler": "vite"
       },
       "component": {
@@ -1024,16 +1079,12 @@ exports[`react-website generator > Tanstack router integration > should generate
       },
       "library": {
         "style": "css",
-        "linter": "eslint"
+        "linter": "none"
       }
     }
   },
   "namedInputs": {
-    "eslint": [
-      "default",
-      "{workspaceRoot}/eslint.config.mjs",
-      "{projectRoot}/eslint.config.mjs"
-    ],
+    "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
         "dependentTasksOutputFiles": "**/*",
@@ -1065,52 +1116,39 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.183",
-    "@cloudscape-design/components": "3.0.1300",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "aws-cdk-lib": "2.257.0",
+    "@cloudscape-design/board-components": "3.0.190",
+    "@cloudscape-design/components": "3.0.1310",
+    "@cloudscape-design/global-styles": "1.0.60",
+    "aws-cdk-lib": "2.259.0",
     "constructs": "10.6.0",
-    "react": "19.2.6",
-    "react-dom": "19.2.6",
-    "tailwindcss": "4.3.0"
+    "react": "19.2.7",
+    "react-dom": "19.2.7",
+    "tailwindcss": "4.2.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.8.0",
-    "@nx/eslint": "22.7.3",
-    "@nx/eslint-plugin": "22.7.3",
-    "@nx/js": "22.7.3",
-    "@nx/react": "22.7.3",
-    "@nx/vite": "22.7.3",
-    "@nx/vitest": "22.7.3",
-    "@nx/web": "22.7.3",
+    "@nx/js": "22.7.5",
+    "@nx/react": "22.7.5",
+    "@nx/vite": "22.7.5",
+    "@nx/vitest": "22.7.5",
+    "@nx/web": "22.7.5",
     "@swc-node/register": "~1.11.1",
-    "@swc/cli": "~0.8.0",
     "@swc/core": "~1.15.5",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.0",
+    "@tailwindcss/vite": "4.2.2",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.1",
+    "@types/node": "25.9.3",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.7",
-    "@vitest/ui": "4.1.7",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-jsx-a11y": "6.10.1",
-    "eslint-plugin-prettier": "5.5.5",
-    "eslint-plugin-react": "7.35.0",
-    "eslint-plugin-react-hooks": "5.0.0",
+    "@vitest/coverage-v8": "4.1.8",
+    "@vitest/ui": "4.1.8",
     "jiti": "2.4.2",
     "jsdom": "~22.1.0",
-    "jsonc-eslint-parser": "3.1.0",
-    "prettier": "3.8.3",
+    "prettier": "~3.6.2",
     "typescript": "~5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "vite": "8.0.14",
-    "vitest": "4.1.7"
+    "vite": "8.0.16",
+    "vitest": "4.1.8"
   },
   "type": "module",
   "scripts": {
@@ -1153,35 +1191,7 @@ You can also automatiaclly fix some lint errors by running the following command
 
 - [common-constructs reference docs](TODO)
 - [Learn more about NX](https://nx.dev/getting-started/intro)
-"
-`;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/eslint.config.mjs 1`] = `
-"import baseConfig from '../../../eslint.config.mjs';
-
-export default [
-  ...baseConfig,
-  {
-    files: ['**/*.json'],
-    rules: {
-      '@nx/dependency-checks': [
-        'warn',
-        {
-          ignoredFiles: [
-            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
-            '{projectRoot}/vitest.config.{js,ts,mjs,mts}',
-          ],
-        },
-      ],
-    },
-    languageOptions: {
-      parser: await import('jsonc-eslint-parser'),
-    },
-  },
-  {
-    ignores: ['**/out-tsc'],
-  },
-];
 "
 `;
 
@@ -1192,6 +1202,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "sourceRoot": "packages/common/constructs/src",
   "projectType": "library",
   "tags": [],
+  "metadata": {
+    "generator": "ts#project"
+  },
   "targets": {
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
@@ -1205,15 +1218,18 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -1224,9 +1240,6 @@ exports[`react-website generator > Tanstack router integration > should generate
         "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
       }
     }
-  },
-  "metadata": {
-    "generator": "ts#project"
   }
 }
 "
@@ -1536,11 +1549,18 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -1549,7 +1569,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -1558,6 +1582,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -1649,6 +1690,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -1660,6 +1731,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -1684,8 +1756,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -1697,8 +1778,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -1909,6 +1991,7 @@ export default defineConfig(() => ({
   root: __dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
+    passWithNoTests: true,
     name: '@proj/common-constructs',
     watch: false,
     globals: true,
@@ -1919,7 +2002,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
 }));
 "
@@ -1935,7 +2017,6 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/README.md 1`] = `
 "# @proj/test-app
-
 This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-plugin-for-aws/).
 
 ## Building
@@ -1984,22 +2065,6 @@ In order to integrate with cognito or trpc backends, you need to have a \`runtim
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/eslint.config.mjs 1`] = `
-"import nx from '@nx/eslint-plugin';
-import baseConfig from '../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/react'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    // Override or add rules here
-    rules: {},
-  },
-];
-"
-`;
-
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/index.html 1`] = `
 "<!doctype html>
 <html lang="en">
@@ -2066,15 +2131,18 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -2399,9 +2467,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/tsconfig.spec.json 1`] = `
 "{
-  "extends": "../tsconfig.base.json",
+  "extends": "./tsconfig.json",
   "compilerOptions": {
-    "outDir": "./out-tsc/vitest",
+    "outDir": "../dist/out-tsc",
     "types": [
       "vitest/globals",
       "vitest/importMeta",
@@ -2441,6 +2509,8 @@ exports[`react-website generator > Tanstack router integration > should generate
 /// <reference types='vitest' />
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
 
 export default defineConfig(() => ({
   root: import.meta.dirname,
@@ -2453,10 +2523,15 @@ export default defineConfig(() => ({
     port: 4300,
     host: 'localhost',
   },
-  plugins: [react(), tailwindcss()],
+  plugins: [
+    react(),
+    nxViteTsPaths(),
+    nxCopyAssetsPlugin(['*.md']),
+    tailwindcss(),
+  ],
   // Uncomment this if you are using workers.
   // worker: {
-  //  plugins: [],
+  //   plugins: () => [ nxViteTsPaths() ],
   // },
   build: {
     outDir: '../dist/test-app',
@@ -2467,6 +2542,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -2474,10 +2550,9 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../coverage/test-app',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -2528,61 +2603,71 @@ vitest.config.*.timestamp*
 runtime-config.json"
 `;
 
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > .prettierignore 1`] = `
+"# Add files here to ignore them from prettier formatting
+/dist
+/coverage
+/.nx/cache
+/.nx/workspace-data"
+`;
+
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > .prettierrc 1`] = `
 "{ "singleQuote": true }
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > eslint.config.mjs 1`] = `
-"import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import nx from '@nx/eslint-plugin';
-
-export default [
-  eslintPluginPrettierRecommended,
-  ...nx.configs['flat/base'],
-  ...nx.configs['flat/typescript'],
-  ...nx.configs['flat/javascript'],
-  {
-    ignores: [
-      '**/dist',
-      '**/out-tsc',
-      '**/vite.config.*.timestamp*',
-      '**/vitest.config.*.timestamp*',
-    ],
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
+"{
+  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": true,
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80
   },
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    rules: {
-      '@nx/enforce-module-boundaries': [
-        'error',
-        {
-          enforceBuildableLibDependency: true,
-          allow: ['^.*/eslint(\\\\.base)?\\\\.config\\\\.[cm]?[jt]s$'],
-          depConstraints: [
-            {
-              sourceTag: '*',
-              onlyDependOnLibsWithTags: ['*'],
-            },
-          ],
-        },
-      ],
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "all"
+    }
+  },
+  "css": {
+    "formatter": {
+      "quoteStyle": "single"
     },
+    "linter": {
+      "enabled": false
+    }
   },
-  {
-    files: [
-      '**/*.ts',
-      '**/*.tsx',
-      '**/*.cts',
-      '**/*.mts',
-      '**/*.js',
-      '**/*.jsx',
-      '**/*.cjs',
-      '**/*.mjs',
-    ],
-    // Override or add rules here
-    rules: {},
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": false,
+      "correctness": {
+        "noUndeclaredDependencies": "warn"
+      }
+    }
   },
-];
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/dist",
+      "!**/out-tsc",
+      "!**/node_modules",
+      "!**/.nx",
+      "!**/.venv",
+      "!**/*.css"
+    ]
+  }
+}
 "
 `;
 
@@ -2600,17 +2685,6 @@ exports[`react-website generator > Tanstack router integration > should generate
     "lint": {
       "cache": true
     },
-    "@nx/eslint:lint": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^default",
-        "{workspaceRoot}/.eslintrc.json",
-        "{workspaceRoot}/.eslintignore",
-        "{workspaceRoot}/eslint.config.mjs",
-        "{workspaceRoot}/tools/eslint-rules/**/*"
-      ]
-    },
     "@nx/vite:build": {
       "cache": true,
       "dependsOn": ["^build"],
@@ -2639,7 +2713,7 @@ exports[`react-website generator > Tanstack router integration > should generate
       "application": {
         "babel": true,
         "style": "css",
-        "linter": "eslint",
+        "linter": "none",
         "bundler": "vite"
       },
       "component": {
@@ -2647,16 +2721,12 @@ exports[`react-website generator > Tanstack router integration > should generate
       },
       "library": {
         "style": "css",
-        "linter": "eslint"
+        "linter": "none"
       }
     }
   },
   "namedInputs": {
-    "eslint": [
-      "default",
-      "{workspaceRoot}/eslint.config.mjs",
-      "{projectRoot}/eslint.config.mjs"
-    ],
+    "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
         "dependentTasksOutputFiles": "**/*",
@@ -2688,57 +2758,44 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.183",
-    "@cloudscape-design/components": "3.0.1300",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "@tanstack/react-router": "1.170.8",
-    "aws-cdk-lib": "2.257.0",
+    "@cloudscape-design/board-components": "3.0.190",
+    "@cloudscape-design/components": "3.0.1310",
+    "@cloudscape-design/global-styles": "1.0.60",
+    "@tanstack/react-router": "1.170.15",
+    "aws-cdk-lib": "2.259.0",
     "constructs": "10.6.0",
-    "react": "19.2.6",
-    "react-dom": "19.2.6",
-    "tailwindcss": "4.3.0"
+    "react": "19.2.7",
+    "react-dom": "19.2.7",
+    "tailwindcss": "4.2.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.8.0",
-    "@nx/eslint": "22.7.3",
-    "@nx/eslint-plugin": "22.7.3",
-    "@nx/js": "22.7.3",
-    "@nx/react": "22.7.3",
-    "@nx/vite": "22.7.3",
-    "@nx/vitest": "22.7.3",
-    "@nx/web": "22.7.3",
+    "@nx/js": "22.7.5",
+    "@nx/react": "22.7.5",
+    "@nx/vite": "22.7.5",
+    "@nx/vitest": "22.7.5",
+    "@nx/web": "22.7.5",
     "@swc-node/register": "~1.11.1",
-    "@swc/cli": "~0.8.0",
     "@swc/core": "~1.15.5",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.0",
-    "@tanstack/router-generator": "1.167.10",
-    "@tanstack/router-plugin": "1.168.11",
-    "@tanstack/router-utils": "1.162.1",
+    "@tailwindcss/vite": "4.2.2",
+    "@tanstack/router-generator": "1.167.17",
+    "@tanstack/router-plugin": "1.168.18",
+    "@tanstack/router-utils": "1.162.2",
     "@tanstack/virtual-file-routes": "1.162.0",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.1",
+    "@types/node": "25.9.3",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.7",
-    "@vitest/ui": "4.1.7",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-jsx-a11y": "6.10.1",
-    "eslint-plugin-prettier": "5.5.5",
-    "eslint-plugin-react": "7.35.0",
-    "eslint-plugin-react-hooks": "5.0.0",
+    "@vitest/coverage-v8": "4.1.8",
+    "@vitest/ui": "4.1.8",
     "jiti": "2.4.2",
     "jsdom": "~22.1.0",
-    "jsonc-eslint-parser": "3.1.0",
-    "prettier": "3.8.3",
+    "prettier": "~3.6.2",
     "typescript": "~5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "vite": "8.0.14",
-    "vitest": "4.1.7"
+    "vite": "8.0.16",
+    "vitest": "4.1.8"
   },
   "type": "module",
   "scripts": {
@@ -2781,35 +2838,7 @@ You can also automatiaclly fix some lint errors by running the following command
 
 - [common-constructs reference docs](TODO)
 - [Learn more about NX](https://nx.dev/getting-started/intro)
-"
-`;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/eslint.config.mjs 1`] = `
-"import baseConfig from '../../../eslint.config.mjs';
-
-export default [
-  ...baseConfig,
-  {
-    files: ['**/*.json'],
-    rules: {
-      '@nx/dependency-checks': [
-        'warn',
-        {
-          ignoredFiles: [
-            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
-            '{projectRoot}/vitest.config.{js,ts,mjs,mts}',
-          ],
-        },
-      ],
-    },
-    languageOptions: {
-      parser: await import('jsonc-eslint-parser'),
-    },
-  },
-  {
-    ignores: ['**/out-tsc'],
-  },
-];
 "
 `;
 
@@ -2820,6 +2849,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "sourceRoot": "packages/common/constructs/src",
   "projectType": "library",
   "tags": [],
+  "metadata": {
+    "generator": "ts#project"
+  },
   "targets": {
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
@@ -2833,15 +2865,18 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -2852,9 +2887,6 @@ exports[`react-website generator > Tanstack router integration > should generate
         "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
       }
     }
-  },
-  "metadata": {
-    "generator": "ts#project"
   }
 }
 "
@@ -3164,11 +3196,18 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -3177,7 +3216,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -3186,6 +3229,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -3277,6 +3337,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -3288,6 +3378,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -3312,8 +3403,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -3325,8 +3425,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -3537,6 +3638,7 @@ export default defineConfig(() => ({
   root: __dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
+    passWithNoTests: true,
     name: '@proj/common-constructs',
     watch: false,
     globals: true,
@@ -3547,7 +3649,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
 }));
 "
@@ -3563,7 +3664,6 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/README.md 1`] = `
 "# @proj/test-app
-
 This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-plugin-for-aws/).
 
 ## Building
@@ -3612,22 +3712,6 @@ In order to integrate with cognito or trpc backends, you need to have a \`runtim
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/eslint.config.mjs 1`] = `
-"import nx from '@nx/eslint-plugin';
-import baseConfig from '../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/react'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    // Override or add rules here
-    rules: {},
-  },
-];
-"
-`;
-
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/index.html 1`] = `
 "<!doctype html>
 <html lang="en">
@@ -3694,15 +3778,18 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -4211,9 +4298,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/tsconfig.spec.json 1`] = `
 "{
-  "extends": "../tsconfig.base.json",
+  "extends": "./tsconfig.json",
   "compilerOptions": {
-    "outDir": "./out-tsc/vitest",
+    "outDir": "../dist/out-tsc",
     "types": [
       "vitest/globals",
       "vitest/importMeta",
@@ -4255,6 +4342,8 @@ import { tanstackRouter } from '@tanstack/router-plugin/vite';
 /// <reference types='vitest' />
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
 
 export default defineConfig(() => ({
   root: import.meta.dirname,
@@ -4273,11 +4362,13 @@ export default defineConfig(() => ({
       generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
+    nxViteTsPaths(),
+    nxCopyAssetsPlugin(['*.md']),
     tailwindcss(),
   ],
   // Uncomment this if you are using workers.
   // worker: {
-  //  plugins: [],
+  //   plugins: () => [ nxViteTsPaths() ],
   // },
   build: {
     outDir: '../dist/test-app',
@@ -4288,6 +4379,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -4295,10 +4387,9 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../coverage/test-app',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -4368,6 +4459,8 @@ import { tanstackRouter } from '@tanstack/router-plugin/vite';
 /// <reference types='vitest' />
 import { defineConfig } from 'vite';
 import react from '@vitejs/plugin-react';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
 
 export default defineConfig(() => ({
   root: import.meta.dirname,
@@ -4386,11 +4479,13 @@ export default defineConfig(() => ({
       generatedRouteTree: resolve(__dirname, 'src/routeTree.gen.ts'),
     }),
     react(),
+    nxViteTsPaths(),
+    nxCopyAssetsPlugin(['*.md']),
     tailwindcss(),
   ],
   // Uncomment this if you are using workers.
   // worker: {
-  //  plugins: [],
+  //   plugins: () => [ nxViteTsPaths() ],
   // },
   build: {
     outDir: '../dist/test-app',
@@ -4401,6 +4496,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -4408,10 +4504,9 @@ export default defineConfig(() => ({
     include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
     reporters: ['default'],
     coverage: {
-      reportsDirectory: './test-output/vitest/coverage',
+      reportsDirectory: '../coverage/test-app',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -4667,11 +4762,18 @@ exports[`react-website generator > should generate shared constructs > common/co
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -4680,7 +4782,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -4689,6 +4795,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -4780,6 +4903,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -4791,6 +4944,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -4815,8 +4969,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -4828,8 +4991,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -4975,15 +5139,15 @@ root &&
 
 exports[`react-website generator > should handle npm scope prefix correctly > scoped-dependencies 1`] = `
 {
-  "@cloudscape-design/board-components": "3.0.183",
-  "@cloudscape-design/components": "3.0.1300",
-  "@cloudscape-design/global-styles": "1.0.59",
-  "@tanstack/react-router": "1.170.8",
-  "aws-cdk-lib": "2.257.0",
+  "@cloudscape-design/board-components": "3.0.190",
+  "@cloudscape-design/components": "3.0.1310",
+  "@cloudscape-design/global-styles": "1.0.60",
+  "@tanstack/react-router": "1.170.15",
+  "aws-cdk-lib": "2.259.0",
   "constructs": "10.6.0",
-  "react": "19.2.6",
-  "react-dom": "19.2.6",
-  "tailwindcss": "4.3.0",
+  "react": "19.2.7",
+  "react-dom": "19.2.7",
+  "tailwindcss": "4.2.2",
 }
 `;
 
@@ -5687,6 +5851,5 @@ function RouteComponent() {
 
 exports[`react-website generator ux tests > Shadcn > should update package.json with required dependencies > test-app/src/styles.css 1`] = `
 "@import '../../packages/common/shadcn/src/styles/globals.css';
-@source './**/*.{ts,tsx}';
-"
+@source './**/*.{ts,tsx}';"
 `;