@aws/nx-plugin 1.0.0-rc.3 → 1.0.0-rc.30

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -32,7 +32,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -40,6 +40,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -50,7 +51,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -88,7 +88,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -96,6 +96,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -106,7 +107,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -131,12 +131,12 @@ exports[`react-website generator > TailwindCSS integration > terraform iac > sho
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
       configuration_aliases = [aws.us_east_1]
     }
     random = {
       source  = "hashicorp/random"
-      version = "~> 3.1"
+      version = "3.9.0"
     }
   }
 }
@@ -152,6 +152,15 @@ variable "website_file_path" {
   type        = string
 }
 
+# Content-Security-Policy enforced on all responses. Restricts scripts and
+# framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+# (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+# Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+# connect-src to your specific origins once they are known.
+locals {
+  content_security_policy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' https: wss:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+}
+
 
 # Data sources
 data "aws_caller_identity" "current" {}
@@ -512,13 +521,42 @@ resource "aws_cloudfront_origin_access_control" "website_oac" {
   signing_protocol                  = "sigv4"
 }
 
+# Security headers applied to all responses.
+resource "aws_cloudfront_response_headers_policy" "website" {
+  name = "\${aws_s3_bucket.website.bucket}-security-headers"
+
+  security_headers_config {
+    strict_transport_security {
+      access_control_max_age_sec = 63072000
+      include_subdomains         = true
+      preload                    = true
+      override                   = true
+    }
+    content_type_options {
+      override = true
+    }
+    frame_options {
+      frame_option = "DENY"
+      override     = true
+    }
+    referrer_policy {
+      referrer_policy = "strict-origin-when-cross-origin"
+      override        = true
+    }
+    content_security_policy {
+      content_security_policy = local.content_security_policy
+      override                = true
+    }
+  }
+}
+
 # CloudFront Distribution
 resource "aws_cloudfront_distribution" "website" {
+  # See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
   #checkov:skip=CKV_AWS_174:Using CloudFront default certificate which does not support TLS v1.2
   #checkov:skip=CKV_AWS_310:Origin failover not required for single S3 origin static website
   #checkov:skip=CKV_AWS_374:Geo restrictions not required for global web application
   #checkov:skip=CKV2_AWS_42:Custom SSL certificate not required for development - using CloudFront default
-  #checkov:skip=CKV2_AWS_32:Response headers policy not required for basic static website
   #checkov:skip=CKV2_AWS_47:WAF includes AWSManagedRulesKnownBadInputsRuleSet which provides Log4j protection
   origin {
     domain_name              = aws_s3_bucket.website.bucket_regional_domain_name
@@ -548,11 +586,12 @@ resource "aws_cloudfront_distribution" "website" {
       }
     }
 
-    viewer_protocol_policy = "redirect-to-https"
-    min_ttl                = 0
-    default_ttl            = 3600
-    max_ttl                = 86400
-    compress               = true
+    viewer_protocol_policy     = "redirect-to-https"
+    response_headers_policy_id = aws_cloudfront_response_headers_policy.website.id
+    min_ttl                    = 0
+    default_ttl                = 3600
+    max_ttl                    = 86400
+    compress                   = true
   }
 
   # Custom error responses for SPA routing
@@ -656,8 +695,8 @@ resource "null_resource" "upload_website_files" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      cd "\${path.root}"
-      uv run --with boto3 python3 -c "
+      cd "$ROOT_PATH"
+      uv run --with boto3==1.43.37 python3 -c "
 import os
 import sys
 import boto3
@@ -745,9 +784,14 @@ def sync_to_s3(local_path, bucket_name):
         sys.exit(1)
 
 # Execute sync
-sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
+sync_to_s3(os.environ['WEBSITE_FILE_PATH'], os.environ['BUCKET_NAME'])
 "
     EOT
+    environment = {
+      ROOT_PATH         = path.root
+      WEBSITE_FILE_PATH = var.website_file_path
+      BUCKET_NAME       = aws_s3_bucket.website.bucket
+    }
   }
 
   depends_on = [aws_s3_bucket_policy.website_cloudfront_policy]
@@ -755,11 +799,12 @@ sync_to_s3('\${var.website_file_path}', '\${aws_s3_bucket.website.bucket}')
 
 # Upload runtime config file
 resource "aws_s3_object" "runtime_config" {
-  bucket       = aws_s3_bucket.website.id
-  key          = "runtime-config.json"
-  content      = module.runtime_config_reader.config_json
-  content_type = "application/json"
-  etag         = md5(module.runtime_config_reader.config_json)
+  bucket        = aws_s3_bucket.website.id
+  key           = "runtime-config.json"
+  content       = module.runtime_config_reader.config_json
+  content_type  = "application/json"
+  cache_control = "no-cache"
+  etag          = md5(module.runtime_config_reader.config_json)
 
   depends_on = [null_resource.upload_website_files]
 }
@@ -774,8 +819,9 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3 python3 -c "
+      uv run --with boto3==1.43.37 python3 -c "
 import boto3
+import os
 import sys
 from botocore.exceptions import ClientError, NoCredentialsError
 
@@ -797,7 +843,7 @@ def create_invalidation(distribution_id):
 
         invalidation_id = response['Invalidation']['Id']
         print(f'CloudFront cache invalidation created: {invalidation_id}')
-        print(f'Distribution: \${aws_cloudfront_distribution.website.id}')
+        print(f'Distribution: {distribution_id}')
         print(f'Status: {response[\\"Invalidation\\"][\\"Status\\"]}')
 
     except NoCredentialsError:
@@ -811,9 +857,12 @@ def create_invalidation(distribution_id):
         sys.exit(1)
 
 # Execute invalidation
-create_invalidation('\${aws_cloudfront_distribution.website.id}')
+create_invalidation(os.environ['DISTRIBUTION_ID'])
 "
     EOT
+    environment = {
+      DISTRIBUTION_ID = aws_cloudfront_distribution.website.id
+    }
   }
 
   depends_on = [
@@ -856,7 +905,7 @@ output "waf_web_acl_arn" {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 6.0"
+      version = "6.52.0"
       configuration_aliases = [aws.us_east_1]
     }
   }
@@ -905,61 +954,60 @@ vitest.config.*.timestamp*
 runtime-config.json"
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > .prettierrc 1`] = `
-"{ "singleQuote": true }
-"
-`;
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > .prettierrc 1`] = `"{"singleQuote":true}"`;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > eslint.config.mjs 1`] = `
-"import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import nx from '@nx/eslint-plugin';
-
-export default [
-  eslintPluginPrettierRecommended,
-  ...nx.configs['flat/base'],
-  ...nx.configs['flat/typescript'],
-  ...nx.configs['flat/javascript'],
-  {
-    ignores: [
-      '**/dist',
-      '**/out-tsc',
-      '**/vite.config.*.timestamp*',
-      '**/vitest.config.*.timestamp*',
-    ],
+exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > biome.json 1`] = `
+"{
+  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": true,
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80
   },
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    rules: {
-      '@nx/enforce-module-boundaries': [
-        'error',
-        {
-          enforceBuildableLibDependency: true,
-          allow: ['^.*/eslint(\\\\.base)?\\\\.config\\\\.[cm]?[jt]s$'],
-          depConstraints: [
-            {
-              sourceTag: '*',
-              onlyDependOnLibsWithTags: ['*'],
-            },
-          ],
-        },
-      ],
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "all"
+    }
+  },
+  "css": {
+    "formatter": {
+      "quoteStyle": "single"
     },
+    "linter": {
+      "enabled": false
+    }
   },
-  {
-    files: [
-      '**/*.ts',
-      '**/*.tsx',
-      '**/*.cts',
-      '**/*.mts',
-      '**/*.js',
-      '**/*.jsx',
-      '**/*.cjs',
-      '**/*.mjs',
-    ],
-    // Override or add rules here
-    rules: {},
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": false,
+      "correctness": {
+        "noUndeclaredDependencies": "warn"
+      }
+    }
   },
-];
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/dist",
+      "!**/out-tsc",
+      "!**/node_modules",
+      "!**/.nx",
+      "!**/.venv",
+      "!**/*.css"
+    ]
+  }
+}
 "
 `;
 
@@ -971,52 +1019,72 @@ exports[`react-website generator > Tanstack router integration > should generate
   "targetDefaults": {
     "build": {
       "cache": true,
-      "dependsOn": ["^build"],
       "inputs": ["default"]
     },
     "lint": {
       "cache": true
     },
-    "@nx/eslint:lint": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^default",
-        "{workspaceRoot}/.eslintrc.json",
-        "{workspaceRoot}/.eslintignore",
-        "{workspaceRoot}/eslint.config.mjs",
-        "{workspaceRoot}/tools/eslint-rules/**/*"
-      ]
-    },
-    "@nx/vite:build": {
-      "cache": true,
+    "test": {
       "dependsOn": ["^build"],
-      "inputs": ["default", "^default"]
+      "inputs": ["default"]
     },
     "@nx/vitest:test": {
       "cache": true,
-      "inputs": ["default", "^default"],
+      "inputs": ["default", "^production"],
       "configurations": {
         "update-snapshot": {
           "args": "--update"
         }
       }
     },
-    "test": {
-      "dependsOn": ["^build"],
-      "inputs": ["default"]
-    },
     "compile": {
       "cache": true,
       "inputs": ["default"]
     }
   },
+  "plugins": [
+    {
+      "plugin": "@nx/js/typescript",
+      "options": {
+        "typecheck": {
+          "targetName": "typecheck"
+        },
+        "build": {
+          "targetName": "compile",
+          "configName": "tsconfig.lib.json",
+          "buildDepsName": "build-deps",
+          "watchDepsName": "watch-deps"
+        }
+      }
+    },
+    {
+      "plugin": "@nx/vite/plugin",
+      "options": {
+        "buildTargetName": "bundle",
+        "serveTargetName": "serve",
+        "devTargetName": "serve",
+        "previewTargetName": "preview",
+        "serveStaticTargetName": "serve-static",
+        "typecheckTargetName": "vite:typecheck",
+        "buildDepsTargetName": "build-deps",
+        "watchDepsTargetName": "watch-deps"
+      }
+    },
+    {
+      "plugin": "@nx/vitest",
+      "options": {
+        "testTargetName": "test",
+        "ciTargetName": "test-ci",
+        "testMode": "watch"
+      }
+    }
+  ],
   "generators": {
     "@nx/react": {
       "application": {
         "babel": true,
         "style": "css",
-        "linter": "eslint",
+        "linter": "none",
         "bundler": "vite"
       },
       "component": {
@@ -1024,39 +1092,19 @@ exports[`react-website generator > Tanstack router integration > should generate
       },
       "library": {
         "style": "css",
-        "linter": "eslint"
+        "linter": "none"
       }
     }
   },
   "namedInputs": {
-    "eslint": [
-      "default",
-      "{workspaceRoot}/eslint.config.mjs",
-      "{projectRoot}/eslint.config.mjs"
-    ],
+    "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
         "dependentTasksOutputFiles": "**/*",
         "transitive": true
       }
     ]
-  },
-  "plugins": [
-    {
-      "plugin": "@nx/js/typescript",
-      "options": {
-        "typecheck": {
-          "targetName": "typecheck"
-        },
-        "build": {
-          "targetName": "compile",
-          "configName": "tsconfig.lib.json",
-          "buildDepsName": "build-deps",
-          "watchDepsName": "watch-deps"
-        }
-      }
-    }
-  ]
+  }
 }
 "
 `;
@@ -1065,57 +1113,38 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.187",
-    "@cloudscape-design/components": "3.0.1304",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "aws-cdk-lib": "2.257.0",
+    "@cloudscape-design/board-components": "3.0.197",
+    "@cloudscape-design/components": "3.0.1320",
+    "@cloudscape-design/global-styles": "1.0.61",
+    "aws-cdk-lib": "2.260.0",
     "constructs": "10.6.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "tailwindcss": "4.3.0"
+    "tailwindcss": "4.2.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.8.0",
-    "@nx/eslint": "22.7.5",
-    "@nx/eslint-plugin": "22.7.5",
-    "@nx/js": "22.7.5",
-    "@nx/react": "22.7.5",
-    "@nx/vite": "22.7.5",
-    "@nx/vitest": "22.7.5",
-    "@nx/web": "22.7.5",
-    "@swc-node/register": "~1.11.1",
-    "@swc/cli": "~0.8.0",
-    "@swc/core": "~1.15.5",
+    "@nx/js": "23.0.1",
+    "@nx/react": "23.0.1",
+    "@nx/vite": "23.0.1",
+    "@nx/vitest": "23.0.1",
+    "@nx/web": "23.0.1",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.0",
+    "@tailwindcss/vite": "4.2.2",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.1",
+    "@types/node": "25.9.4",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.7",
-    "@vitest/ui": "4.1.7",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-jsx-a11y": "6.10.1",
-    "eslint-plugin-prettier": "5.5.6",
-    "eslint-plugin-react": "7.35.0",
-    "eslint-plugin-react-hooks": "5.0.0",
+    "@vitest/coverage-v8": "4.1.9",
+    "@vitest/ui": "4.1.9",
     "jiti": "2.4.2",
-    "jsdom": "~22.1.0",
-    "jsonc-eslint-parser": "3.1.0",
-    "prettier": "3.8.3",
+    "jsdom": "^27.1.0",
     "typescript": "~5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "vite": "8.0.14",
-    "vitest": "4.1.7"
+    "vite": "8.1.0",
+    "vitest": "4.1.9"
   },
-  "type": "module",
-  "scripts": {
-    "dev": "nx serve-local @proj/test-app"
-  }
+  "type": "module"
 }
 "
 `;
@@ -1153,35 +1182,7 @@ You can also automatiaclly fix some lint errors by running the following command
 
 - [common-constructs reference docs](TODO)
 - [Learn more about NX](https://nx.dev/getting-started/intro)
-"
-`;
-
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > packages/common/constructs/eslint.config.mjs 1`] = `
-"import baseConfig from '../../../eslint.config.mjs';
 
-export default [
-  ...baseConfig,
-  {
-    files: ['**/*.json'],
-    rules: {
-      '@nx/dependency-checks': [
-        'warn',
-        {
-          ignoredFiles: [
-            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
-            '{projectRoot}/vitest.config.{js,ts,mjs,mts}',
-          ],
-        },
-      ],
-    },
-    languageOptions: {
-      parser: await import('jsonc-eslint-parser'),
-    },
-  },
-  {
-    ignores: ['**/out-tsc'],
-  },
-];
 "
 `;
 
@@ -1192,6 +1193,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "sourceRoot": "packages/common/constructs/src",
   "projectType": "library",
   "tags": [],
+  "metadata": {
+    "generator": "ts#project"
+  },
   "targets": {
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
@@ -1205,28 +1209,21 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
     }
-  },
-  "metadata": {
-    "generator": "ts#project"
   }
 }
 "
@@ -1536,11 +1533,18 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -1549,7 +1553,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -1558,6 +1566,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -1649,6 +1674,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -1660,6 +1715,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -1676,6 +1732,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],
@@ -1684,8 +1741,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -1697,8 +1763,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -1909,6 +1976,7 @@ export default defineConfig(() => ({
   root: __dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
+    passWithNoTests: true,
     name: '@proj/common-constructs',
     watch: false,
     globals: true,
@@ -1919,7 +1987,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
 }));
 "
@@ -1927,15 +1994,14 @@ export default defineConfig(() => ({
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > pnpm-workspace.yaml 1`] = `
 "packages:
-  - 'packages/*'
-  - 'test-app'
-  - 'packages/common/*'
+  - "packages/*"
+  - "test-app"
+  - "packages/common/*"
 "
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/README.md 1`] = `
 "# @proj/test-app
-
 This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-plugin-for-aws/).
 
 ## Building
@@ -1984,24 +2050,8 @@ In order to integrate with cognito or trpc backends, you need to have a \`runtim
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/eslint.config.mjs 1`] = `
-"import nx from '@nx/eslint-plugin';
-import baseConfig from '../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/react'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    // Override or add rules here
-    rules: {},
-  },
-];
-"
-`;
-
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > test-app/index.html 1`] = `
-"<!doctype html>
+"<!DOCTYPE html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -2035,29 +2085,10 @@ exports[`react-website generator > Tanstack router integration > should generate
   },
   "targets": {
     "build": {
-      "dependsOn": ["lint", "compile", "bundle", "test"],
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      }
-    },
-    "bundle": {
-      "executor": "@nx/vite:build",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      },
-      "configurations": {
-        "development": {
-          "mode": "development"
-        },
-        "production": {
-          "mode": "production"
-        }
-      }
+      "dependsOn": ["lint", "compile", "test", "bundle"]
     },
     "compile": {
-      "dependsOn": ["bundle"],
+      "dependsOn": ["^build"],
       "executor": "nx:run-commands",
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
@@ -2065,16 +2096,27 @@ exports[`react-website generator > Tanstack router integration > should generate
         "cwd": "{projectRoot}"
       }
     },
+    "dev": {
+      "executor": "nx:run-commands",
+      "continuous": true,
+      "options": {
+        "command": "vite --mode local-dev",
+        "cwd": "{projectRoot}"
+      }
+    },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -2086,63 +2128,6 @@ exports[`react-website generator > Tanstack router integration > should generate
       "options": {
         "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
       }
-    },
-    "preview": {
-      "dependsOn": ["build"],
-      "executor": "@nx/vite:preview-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
-      },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development"
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production"
-        }
-      }
-    },
-    "serve": {
-      "executor": "@nx/vite:dev-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
-      },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development",
-          "hmr": true
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production",
-          "hmr": false
-        }
-      }
-    },
-    "serve-local": {
-      "executor": "@nx/vite:dev-server",
-      "options": {
-        "buildTarget": "@proj/test-app:build:development",
-        "hmr": true,
-        "mode": "serve-local"
-      },
-      "continuous": true
-    },
-    "serve-static": {
-      "executor": "@nx/web:file-server",
-      "dependsOn": ["build"],
-      "options": {
-        "buildTarget": "@proj/test-app:build",
-        "spa": true
-      }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
     }
   }
 }
@@ -2355,9 +2340,14 @@ exports[`react-website generator > Tanstack router integration > should generate
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts",
       "vite/client"
-    ]
+    ],
+    "rootDir": "src",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "exclude": [
+    "out-tsc",
+    "dist",
     "src/**/*.spec.ts",
     "src/**/*.test.ts",
     "src/**/*.spec.tsx",
@@ -2410,7 +2400,10 @@ exports[`react-website generator > Tanstack router integration > should generate
       "vitest",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts"
-    ]
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "include": [
     "vite.config.ts",
@@ -2459,7 +2452,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -2467,6 +2460,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -2477,7 +2471,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -2492,6 +2485,7 @@ exports[`react-website generator > Tanstack router integration > should generate
       ":proj/test-app": ["./test-app/src/index.ts"],
       ":proj/common-constructs": ["./packages/common/constructs/src/index.ts"]
     },
+    "composite": true,
     "rootDir": "."
   }
 }
@@ -2500,6 +2494,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with no router correctly > tsconfig.json 1`] = `
 "{
+  "extends": "./tsconfig.base.json",
+  "files": [],
+  "include": [],
   "references": [
     {
       "path": "./test-app"
@@ -2528,61 +2525,60 @@ vitest.config.*.timestamp*
 runtime-config.json"
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > .prettierrc 1`] = `
-"{ "singleQuote": true }
-"
-`;
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > .prettierrc 1`] = `"{"singleQuote":true}"`;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > eslint.config.mjs 1`] = `
-"import eslintPluginPrettierRecommended from 'eslint-plugin-prettier/recommended';
-import nx from '@nx/eslint-plugin';
-
-export default [
-  eslintPluginPrettierRecommended,
-  ...nx.configs['flat/base'],
-  ...nx.configs['flat/typescript'],
-  ...nx.configs['flat/javascript'],
-  {
-    ignores: [
-      '**/dist',
-      '**/out-tsc',
-      '**/vite.config.*.timestamp*',
-      '**/vitest.config.*.timestamp*',
-    ],
+exports[`react-website generator > Tanstack router integration > should generate website with router correctly > biome.json 1`] = `
+"{
+  "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+  "root": true,
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80
   },
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    rules: {
-      '@nx/enforce-module-boundaries': [
-        'error',
-        {
-          enforceBuildableLibDependency: true,
-          allow: ['^.*/eslint(\\\\.base)?\\\\.config\\\\.[cm]?[jt]s$'],
-          depConstraints: [
-            {
-              sourceTag: '*',
-              onlyDependOnLibsWithTags: ['*'],
-            },
-          ],
-        },
-      ],
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "trailingCommas": "all"
+    }
+  },
+  "css": {
+    "formatter": {
+      "quoteStyle": "single"
     },
+    "linter": {
+      "enabled": false
+    }
   },
-  {
-    files: [
-      '**/*.ts',
-      '**/*.tsx',
-      '**/*.cts',
-      '**/*.mts',
-      '**/*.js',
-      '**/*.jsx',
-      '**/*.cjs',
-      '**/*.mjs',
-    ],
-    // Override or add rules here
-    rules: {},
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": false,
+      "correctness": {
+        "noUndeclaredDependencies": "warn"
+      }
+    }
   },
-];
+  "assist": {
+    "actions": {
+      "source": {
+        "organizeImports": "on"
+      }
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/dist",
+      "!**/out-tsc",
+      "!**/node_modules",
+      "!**/.nx",
+      "!**/.venv",
+      "!**/*.css"
+    ]
+  }
+}
 "
 `;
 
@@ -2594,52 +2590,72 @@ exports[`react-website generator > Tanstack router integration > should generate
   "targetDefaults": {
     "build": {
       "cache": true,
-      "dependsOn": ["^build"],
       "inputs": ["default"]
     },
     "lint": {
       "cache": true
     },
-    "@nx/eslint:lint": {
-      "cache": true,
-      "inputs": [
-        "default",
-        "^default",
-        "{workspaceRoot}/.eslintrc.json",
-        "{workspaceRoot}/.eslintignore",
-        "{workspaceRoot}/eslint.config.mjs",
-        "{workspaceRoot}/tools/eslint-rules/**/*"
-      ]
-    },
-    "@nx/vite:build": {
-      "cache": true,
+    "test": {
       "dependsOn": ["^build"],
-      "inputs": ["default", "^default"]
+      "inputs": ["default"]
     },
     "@nx/vitest:test": {
       "cache": true,
-      "inputs": ["default", "^default"],
+      "inputs": ["default", "^production"],
       "configurations": {
         "update-snapshot": {
           "args": "--update"
         }
       }
     },
-    "test": {
-      "dependsOn": ["^build"],
-      "inputs": ["default"]
-    },
     "compile": {
       "cache": true,
       "inputs": ["default"]
     }
   },
+  "plugins": [
+    {
+      "plugin": "@nx/js/typescript",
+      "options": {
+        "typecheck": {
+          "targetName": "typecheck"
+        },
+        "build": {
+          "targetName": "compile",
+          "configName": "tsconfig.lib.json",
+          "buildDepsName": "build-deps",
+          "watchDepsName": "watch-deps"
+        }
+      }
+    },
+    {
+      "plugin": "@nx/vite/plugin",
+      "options": {
+        "buildTargetName": "bundle",
+        "serveTargetName": "serve",
+        "devTargetName": "serve",
+        "previewTargetName": "preview",
+        "serveStaticTargetName": "serve-static",
+        "typecheckTargetName": "vite:typecheck",
+        "buildDepsTargetName": "build-deps",
+        "watchDepsTargetName": "watch-deps"
+      }
+    },
+    {
+      "plugin": "@nx/vitest",
+      "options": {
+        "testTargetName": "test",
+        "ciTargetName": "test-ci",
+        "testMode": "watch"
+      }
+    }
+  ],
   "generators": {
     "@nx/react": {
       "application": {
         "babel": true,
         "style": "css",
-        "linter": "eslint",
+        "linter": "none",
         "bundler": "vite"
       },
       "component": {
@@ -2647,39 +2663,19 @@ exports[`react-website generator > Tanstack router integration > should generate
       },
       "library": {
         "style": "css",
-        "linter": "eslint"
+        "linter": "none"
       }
     }
   },
   "namedInputs": {
-    "eslint": [
-      "default",
-      "{workspaceRoot}/eslint.config.mjs",
-      "{projectRoot}/eslint.config.mjs"
-    ],
+    "biome": ["default", "{workspaceRoot}/biome.json"],
     "default": [
       {
         "dependentTasksOutputFiles": "**/*",
         "transitive": true
       }
     ]
-  },
-  "plugins": [
-    {
-      "plugin": "@nx/js/typescript",
-      "options": {
-        "typecheck": {
-          "targetName": "typecheck"
-        },
-        "build": {
-          "targetName": "compile",
-          "configName": "tsconfig.lib.json",
-          "buildDepsName": "build-deps",
-          "watchDepsName": "watch-deps"
-        }
-      }
-    }
-  ]
+  }
 }
 "
 `;
@@ -2688,62 +2684,43 @@ exports[`react-website generator > Tanstack router integration > should generate
 "{
   "name": "@proj/source",
   "dependencies": {
-    "@cloudscape-design/board-components": "3.0.187",
-    "@cloudscape-design/components": "3.0.1304",
-    "@cloudscape-design/global-styles": "1.0.59",
-    "@tanstack/react-router": "1.170.10",
-    "aws-cdk-lib": "2.257.0",
+    "@cloudscape-design/board-components": "3.0.197",
+    "@cloudscape-design/components": "3.0.1320",
+    "@cloudscape-design/global-styles": "1.0.61",
+    "@tanstack/react-router": "1.170.16",
+    "aws-cdk-lib": "2.260.0",
     "constructs": "10.6.0",
     "react": "19.2.7",
     "react-dom": "19.2.7",
-    "tailwindcss": "4.3.0"
+    "tailwindcss": "4.2.2"
   },
   "devDependencies": {
-    "@eslint/js": "^9.8.0",
-    "@nx/eslint": "22.7.5",
-    "@nx/eslint-plugin": "22.7.5",
-    "@nx/js": "22.7.5",
-    "@nx/react": "22.7.5",
-    "@nx/vite": "22.7.5",
-    "@nx/vitest": "22.7.5",
-    "@nx/web": "22.7.5",
-    "@swc-node/register": "~1.11.1",
-    "@swc/cli": "~0.8.0",
-    "@swc/core": "~1.15.5",
+    "@nx/js": "23.0.1",
+    "@nx/react": "23.0.1",
+    "@nx/vite": "23.0.1",
+    "@nx/vitest": "23.0.1",
+    "@nx/web": "23.0.1",
     "@swc/helpers": "~0.5.18",
-    "@tailwindcss/vite": "4.3.0",
-    "@tanstack/router-generator": "1.167.12",
-    "@tanstack/router-plugin": "1.168.13",
-    "@tanstack/router-utils": "1.162.1",
+    "@tailwindcss/vite": "4.2.2",
+    "@tanstack/router-generator": "1.167.17",
+    "@tanstack/router-plugin": "1.168.18",
+    "@tanstack/router-utils": "1.162.2",
     "@tanstack/virtual-file-routes": "1.162.0",
     "@testing-library/dom": "10.4.0",
     "@testing-library/react": "16.3.0",
-    "@types/node": "25.9.1",
+    "@types/node": "25.9.4",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^6.0.0",
-    "@vitest/coverage-v8": "4.1.7",
-    "@vitest/ui": "4.1.7",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-jsx-a11y": "6.10.1",
-    "eslint-plugin-prettier": "5.5.6",
-    "eslint-plugin-react": "7.35.0",
-    "eslint-plugin-react-hooks": "5.0.0",
+    "@vitest/coverage-v8": "4.1.9",
+    "@vitest/ui": "4.1.9",
     "jiti": "2.4.2",
-    "jsdom": "~22.1.0",
-    "jsonc-eslint-parser": "3.1.0",
-    "prettier": "3.8.3",
+    "jsdom": "^27.1.0",
     "typescript": "~5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "vite": "8.0.14",
-    "vitest": "4.1.7"
+    "vite": "8.1.0",
+    "vitest": "4.1.9"
   },
-  "type": "module",
-  "scripts": {
-    "dev": "nx serve-local @proj/test-app"
-  }
+  "type": "module"
 }
 "
 `;
@@ -2781,35 +2758,7 @@ You can also automatiaclly fix some lint errors by running the following command
 
 - [common-constructs reference docs](TODO)
 - [Learn more about NX](https://nx.dev/getting-started/intro)
-"
-`;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > packages/common/constructs/eslint.config.mjs 1`] = `
-"import baseConfig from '../../../eslint.config.mjs';
-
-export default [
-  ...baseConfig,
-  {
-    files: ['**/*.json'],
-    rules: {
-      '@nx/dependency-checks': [
-        'warn',
-        {
-          ignoredFiles: [
-            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
-            '{projectRoot}/vitest.config.{js,ts,mjs,mts}',
-          ],
-        },
-      ],
-    },
-    languageOptions: {
-      parser: await import('jsonc-eslint-parser'),
-    },
-  },
-  {
-    ignores: ['**/out-tsc'],
-  },
-];
 "
 `;
 
@@ -2820,6 +2769,9 @@ exports[`react-website generator > Tanstack router integration > should generate
   "sourceRoot": "packages/common/constructs/src",
   "projectType": "library",
   "tags": [],
+  "metadata": {
+    "generator": "ts#project"
+  },
   "targets": {
     "build": {
       "dependsOn": ["lint", "compile", "test", "@proj/test-app:build"]
@@ -2833,28 +2785,21 @@ exports[`react-website generator > Tanstack router integration > should generate
       }
     },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
     }
-  },
-  "metadata": {
-    "generator": "ts#project"
   }
 }
 "
@@ -3164,11 +3109,18 @@ exports[`react-website generator > Tanstack router integration > should generate
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -3177,7 +3129,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -3186,6 +3142,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -3277,6 +3250,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -3288,6 +3291,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -3304,6 +3308,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],
@@ -3312,8 +3317,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -3325,8 +3339,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -3537,6 +3552,7 @@ export default defineConfig(() => ({
   root: __dirname,
   cacheDir: '../../../node_modules/.vite/packages/common/constructs',
   test: {
+    passWithNoTests: true,
     name: '@proj/common-constructs',
     watch: false,
     globals: true,
@@ -3547,7 +3563,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
 }));
 "
@@ -3555,15 +3570,14 @@ export default defineConfig(() => ({
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > pnpm-workspace.yaml 1`] = `
 "packages:
-  - 'packages/*'
-  - 'test-app'
-  - 'packages/common/*'
+  - "packages/*"
+  - "test-app"
+  - "packages/common/*"
 "
 `;
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/README.md 1`] = `
 "# @proj/test-app
-
 This library was generated with [@aws/nx-plugin](https://github.com/awslabs/nx-plugin-for-aws/).
 
 ## Building
@@ -3612,24 +3626,8 @@ In order to integrate with cognito or trpc backends, you need to have a \`runtim
 "
 `;
 
-exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/eslint.config.mjs 1`] = `
-"import nx from '@nx/eslint-plugin';
-import baseConfig from '../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/react'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx'],
-    // Override or add rules here
-    rules: {},
-  },
-];
-"
-`;
-
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > test-app/index.html 1`] = `
-"<!doctype html>
+"<!DOCTYPE html>
 <html lang="en">
   <head>
     <meta charset="utf-8" />
@@ -3663,29 +3661,10 @@ exports[`react-website generator > Tanstack router integration > should generate
   },
   "targets": {
     "build": {
-      "dependsOn": ["lint", "compile", "bundle", "test"],
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      }
-    },
-    "bundle": {
-      "executor": "@nx/vite:build",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/{projectRoot}/bundle"
-      },
-      "configurations": {
-        "development": {
-          "mode": "development"
-        },
-        "production": {
-          "mode": "production"
-        }
-      }
+      "dependsOn": ["lint", "compile", "test", "bundle"]
     },
     "compile": {
-      "dependsOn": ["bundle"],
+      "dependsOn": ["^build"],
       "executor": "nx:run-commands",
       "outputs": ["{workspaceRoot}/dist/{projectRoot}/tsc"],
       "options": {
@@ -3693,16 +3672,27 @@ exports[`react-website generator > Tanstack router integration > should generate
         "cwd": "{projectRoot}"
       }
     },
+    "dev": {
+      "executor": "nx:run-commands",
+      "continuous": true,
+      "options": {
+        "command": "vite --mode local-dev",
+        "cwd": "{projectRoot}"
+      }
+    },
     "lint": {
-      "executor": "@nx/eslint:lint",
+      "executor": "nx:run-commands",
       "cache": true,
-      "inputs": ["eslint"],
+      "inputs": ["biome"],
+      "options": {
+        "command": "biome lint {projectRoot}"
+      },
       "configurations": {
         "fix": {
-          "fix": true
+          "command": "biome check --write {projectRoot}"
         },
         "skip-lint": {
-          "force": true
+          "command": "node -e \\"\\""
         }
       }
     },
@@ -3714,63 +3704,6 @@ exports[`react-website generator > Tanstack router integration > should generate
       "options": {
         "command": "aws s3 cp s3://\`aws cloudformation describe-stacks --query \\"Stacks[?starts_with(StackName, 'proj-')][].Outputs[] | [?contains(OutputKey, 'TestAppWebsiteBucketName')].OutputValue\\" --output text\`/runtime-config.json \\"{projectRoot}/public/runtime-config.json\\""
       }
-    },
-    "preview": {
-      "dependsOn": ["build"],
-      "executor": "@nx/vite:preview-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
-      },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development"
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production"
-        }
-      }
-    },
-    "serve": {
-      "executor": "@nx/vite:dev-server",
-      "defaultConfiguration": "development",
-      "options": {
-        "buildTarget": "@proj/test-app:build"
-      },
-      "configurations": {
-        "development": {
-          "buildTarget": "@proj/test-app:build:development",
-          "hmr": true
-        },
-        "production": {
-          "buildTarget": "@proj/test-app:build:production",
-          "hmr": false
-        }
-      }
-    },
-    "serve-local": {
-      "executor": "@nx/vite:dev-server",
-      "options": {
-        "buildTarget": "@proj/test-app:build:development",
-        "hmr": true,
-        "mode": "serve-local"
-      },
-      "continuous": true
-    },
-    "serve-static": {
-      "executor": "@nx/web:file-server",
-      "dependsOn": ["build"],
-      "options": {
-        "buildTarget": "@proj/test-app:build",
-        "spa": true
-      }
-    },
-    "test": {
-      "executor": "@nx/vitest:test",
-      "outputs": ["{options.reportsDirectory}"],
-      "options": {
-        "reportsDirectory": "{workspaceRoot}/coverage/{projectRoot}"
-      }
     }
   }
 }
@@ -4167,9 +4100,14 @@ exports[`react-website generator > Tanstack router integration > should generate
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts",
       "vite/client"
-    ]
+    ],
+    "rootDir": "src",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "exclude": [
+    "out-tsc",
+    "dist",
     "src/**/*.spec.ts",
     "src/**/*.test.ts",
     "src/**/*.spec.tsx",
@@ -4222,7 +4160,10 @@ exports[`react-website generator > Tanstack router integration > should generate
       "vitest",
       "@nx/react/typings/cssmodule.d.ts",
       "@nx/react/typings/image.d.ts"
-    ]
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler"
   },
   "include": [
     "vite.config.ts",
@@ -4280,7 +4221,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -4288,6 +4229,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -4298,7 +4240,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -4313,6 +4254,7 @@ exports[`react-website generator > Tanstack router integration > should generate
       ":proj/test-app": ["./test-app/src/index.ts"],
       ":proj/common-constructs": ["./packages/common/constructs/src/index.ts"]
     },
+    "composite": true,
     "rootDir": "."
   }
 }
@@ -4321,6 +4263,9 @@ exports[`react-website generator > Tanstack router integration > should generate
 
 exports[`react-website generator > Tanstack router integration > should generate website with router correctly > tsconfig.json 1`] = `
 "{
+  "extends": "./tsconfig.base.json",
+  "files": [],
+  "include": [],
   "references": [
     {
       "path": "./test-app"
@@ -4393,7 +4338,7 @@ export default defineConfig(() => ({
   //  plugins: [],
   // },
   build: {
-    outDir: '../dist/test-app',
+    outDir: '../dist/test-app/bundle',
     emptyOutDir: true,
     reportCompressedSize: true,
     commonjsOptions: {
@@ -4401,6 +4346,7 @@ export default defineConfig(() => ({
     },
   },
   test: {
+    passWithNoTests: true,
     name: '@proj/test-app',
     watch: false,
     globals: true,
@@ -4411,7 +4357,6 @@ export default defineConfig(() => ({
       reportsDirectory: './test-output/vitest/coverage',
       provider: 'v8' as const,
     },
-    passWithNoTests: true,
   },
   resolve: { tsconfigPaths: true },
   define: { global: {} },
@@ -4667,11 +4612,18 @@ exports[`react-website generator > should generate shared constructs > common/co
 "import {
   CfnOutput,
   CfnResource,
+  Duration,
   Lazy,
   RemovalPolicy,
   Stack,
 } from 'aws-cdk-lib';
-import { Distribution, ViewerProtocolPolicy } from 'aws-cdk-lib/aws-cloudfront';
+import {
+  Distribution,
+  HeadersFrameOption,
+  HeadersReferrerPolicy,
+  ResponseHeadersPolicy,
+  ViewerProtocolPolicy,
+} from 'aws-cdk-lib/aws-cloudfront';
 import { S3BucketOrigin } from 'aws-cdk-lib/aws-cloudfront-origins';
 import {
   BlockPublicAccess,
@@ -4680,7 +4632,11 @@ import {
   IBucket,
   ObjectOwnership,
 } from 'aws-cdk-lib/aws-s3';
-import { BucketDeployment, Source } from 'aws-cdk-lib/aws-s3-deployment';
+import {
+  BucketDeployment,
+  CacheControl,
+  Source,
+} from 'aws-cdk-lib/aws-s3-deployment';
 import { Construct } from 'constructs';
 import { RuntimeConfig } from './runtime-config.js';
 import { Key } from 'aws-cdk-lib/aws-kms';
@@ -4689,6 +4645,23 @@ import { suppressRules } from './checkov.js';
 
 const DEFAULT_RUNTIME_CONFIG_FILENAME = 'runtime-config.json';
 
+// Content-Security-Policy enforced on all responses. Restricts scripts and
+// framing to mitigate XSS and clickjacking, while permitting HTTPS/WSS calls
+// (connect-src) to AWS service endpoints such as API Gateway, Cognito and
+// Bedrock AgentCore which are only known at deploy time. Edit this to tighten
+// connect-src to your specific origins once they are known.
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 export interface StaticWebsiteProps {
   readonly websiteName: string;
   readonly websiteFilePath: string;
@@ -4780,6 +4753,36 @@ export class StaticWebsite extends Construct {
       'Distribution log bucket does not need versioning enabled',
     );
 
+    // Security headers applied to all responses.
+    const responseHeadersPolicy = new ResponseHeadersPolicy(
+      this,
+      'ResponseHeadersPolicy',
+      {
+        securityHeadersBehavior: {
+          strictTransportSecurity: {
+            accessControlMaxAge: Duration.days(730),
+            includeSubdomains: true,
+            preload: true,
+            override: true,
+          },
+          contentTypeOptions: { override: true },
+          frameOptions: {
+            frameOption: HeadersFrameOption.DENY,
+            override: true,
+          },
+          referrerPolicy: {
+            referrerPolicy:
+              HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+            override: true,
+          },
+          contentSecurityPolicy: {
+            contentSecurityPolicy: CONTENT_SECURITY_POLICY,
+            override: true,
+          },
+        },
+      },
+    );
+
     const defaultRootObject = 'index.html';
     this.cloudFrontDistribution = new Distribution(
       this,
@@ -4791,6 +4794,7 @@ export class StaticWebsite extends Construct {
         defaultBehavior: {
           origin: S3BucketOrigin.withOriginAccessControl(this.websiteBucket),
           viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
+          responseHeadersPolicy,
         },
         defaultRootObject,
         errorResponses: [
@@ -4807,6 +4811,7 @@ export class StaticWebsite extends Construct {
         ],
       },
     );
+    // See https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html
     suppressRules(
       this.cloudFrontDistribution,
       ['CKV_AWS_174'],
@@ -4815,8 +4820,17 @@ export class StaticWebsite extends Construct {
 
     // Deploy Website
     this.bucketDeployment = new BucketDeployment(this, 'WebsiteDeployment', {
+      sources: [Source.asset(websiteFilePath)],
+      destinationBucket: this.websiteBucket,
+      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
+      distribution: this.cloudFrontDistribution,
+      memoryLimit: 1024,
+    });
+
+    // Deploy runtime-config.json separately so it is never cached - clients
+    // must always fetch the latest configuration.
+    new BucketDeployment(this, 'RuntimeConfigDeployment', {
       sources: [
-        Source.asset(websiteFilePath),
         Source.data(
           DEFAULT_RUNTIME_CONFIG_FILENAME,
           Lazy.string({
@@ -4828,8 +4842,9 @@ export class StaticWebsite extends Construct {
         ),
       ],
       destinationBucket: this.websiteBucket,
-      // Files in the distribution's edge caches will be invalidated after files are uploaded to the destination bucket.
       distribution: this.cloudFrontDistribution,
+      cacheControl: [CacheControl.noCache()],
+      prune: false,
       memoryLimit: 1024,
     });
 
@@ -4975,15 +4990,15 @@ root &&
 
 exports[`react-website generator > should handle npm scope prefix correctly > scoped-dependencies 1`] = `
 {
-  "@cloudscape-design/board-components": "3.0.187",
-  "@cloudscape-design/components": "3.0.1304",
-  "@cloudscape-design/global-styles": "1.0.59",
-  "@tanstack/react-router": "1.170.10",
-  "aws-cdk-lib": "2.257.0",
+  "@cloudscape-design/board-components": "3.0.197",
+  "@cloudscape-design/components": "3.0.1320",
+  "@cloudscape-design/global-styles": "1.0.61",
+  "@tanstack/react-router": "1.170.16",
+  "aws-cdk-lib": "2.260.0",
   "constructs": "10.6.0",
   "react": "19.2.7",
   "react-dom": "19.2.7",
-  "tailwindcss": "4.3.0",
+  "tailwindcss": "4.2.2",
 }
 `;
 
@@ -5687,6 +5702,5 @@ function RouteComponent() {
 
 exports[`react-website generator ux tests > Shadcn > should update package.json with required dependencies > test-app/src/styles.css 1`] = `
 "@import '../../packages/common/shadcn/src/styles/globals.css';
-@source './**/*.{ts,tsx}';
-"
+@source './**/*.{ts,tsx}';"
 `;