---
id: 09-app-wiring-web-tanstack-and-cms
epic: security-headers-rate-limit-sbom
title: "App wiring: web-tanstack and cms"
type: technical-story
status: done
feature: web-tanstack
depends-on: [07-security-header-adapters]
blocks: []
created: 2026-05-20T00:00:00Z
updated: 2026-05-20T11:22:09.324Z
---

## Goal

Wire the security headers middleware in `apps/web-tanstack` (TanStack Start server middleware + nonce-aware Sentry init) and `apps/cms` (Payload Express middleware) so all three template apps emit the six security headers by default.

## Why

Completing the three-app wiring fulfils the PRD success criterion that a consumer picking any template app gets compliant default headers without writing middleware. The two tasks are independent and can land in either order; grouping them in one story reflects that they share the same depends-on (Story 07) and both close the "all apps wired" milestone together.

## Done when

- `apps/web-tanstack/app.config.ts` registers the `core-shared/security/tanstack` server middleware.
- The web-tanstack client init file reads nonce from request context and passes it to `Sentry.init` replay + feedback integrations (mirroring the web-next pattern).
- `apps/cms` Payload config wires the `core-shared/security` Express middleware; CMS responses emit all six headers (no nonce needed — server-side only app).
- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass after each task.

## In scope

- `apps/web-tanstack/app.config.ts` — `core-shared/security/tanstack` server middleware registration.
- web-tanstack client init file — nonce-aware Sentry init (nonce from request context via tanstack adapter's extractor).
- `apps/cms` Payload config — Express middleware from `core-shared/security` (framework-agnostic builder; no nonce needed for CMS).

## Out of scope

- web-next wiring — Story 08.
- CSP report-uri collector — deferred.
- Storybook CSP — explicitly out of Epic C scope.

## Tasks

- [x] Register `core-shared/security/tanstack` server middleware in `apps/web-tanstack/app.config.ts`; update the web-tanstack client init file with nonce-aware Sentry init reading nonce from request context via the tanstack adapter's nonce extractor; all gates pass.
- [x] Wire `core-shared/security` Express middleware in `apps/cms` Payload config (no nonce needed — CMS is server-side only); all gates pass.