agentic-dev/docs/work/epics/security-headers-rate-limit-sbom/09-app-wiring-web-tanstack-and-cms/_story.md

id, epic, title, type, status, feature, depends-on, blocks, created, updated

id	epic	title	type	status	feature	depends-on	blocks	created	updated
09-app-wiring-web-tanstack-and-cms	security-headers-rate-limit-sbom	App wiring: web-tanstack and cms	technical-story	done	web-tanstack	07-security-header-adapters		2026-05-20T00:00:00Z	2026-05-20T11:22:09.324Z

Goal

Wire the security headers middleware in apps/web-tanstack (TanStack Start server middleware + nonce-aware Sentry init) and apps/cms (Payload Express middleware) so all three template apps emit the six security headers by default.

Why

Completing the three-app wiring fulfils the PRD success criterion that a consumer picking any template app gets compliant default headers without writing middleware. The two tasks are independent and can land in either order; grouping them in one story reflects that they share the same depends-on (Story 07) and both close the "all apps wired" milestone together.

Done when

• apps/web-tanstack/app.config.ts registers the core-shared/security/tanstack server middleware.
• The web-tanstack client init file reads nonce from request context and passes it to Sentry.init replay + feedback integrations (mirroring the web-next pattern).
• apps/cms Payload config wires the core-shared/security Express middleware; CMS responses emit all six headers (no nonce needed — server-side only app).
• pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass after each task.

In scope

• apps/web-tanstack/app.config.ts — core-shared/security/tanstack server middleware registration.
• web-tanstack client init file — nonce-aware Sentry init (nonce from request context via tanstack adapter's extractor).
• apps/cms Payload config — Express middleware from core-shared/security (framework-agnostic builder; no nonce needed for CMS).

Out of scope

• web-next wiring — Story 08.
• CSP report-uri collector — deferred.
• Storybook CSP — explicitly out of Epic C scope.

Tasks

• Register core-shared/security/tanstack server middleware in apps/web-tanstack/app.config.ts; update the web-tanstack client init file with nonce-aware Sentry init reading nonce from request context via the tanstack adapter's nonce extractor; all gates pass.
• Wire core-shared/security Express middleware in apps/cms Payload config (no nonce needed — CMS is server-side only); all gates pass.