SPA's tend to come with build systems, but that is just a side effect of their complexity. You can have a front-end build system independent of SPA/MPA architecture. In fact, you should, at least for minification and whatnot. That system can add a content hash or some other strategy to force invalidation at build time for deployed artifacts. Barring that, whatever is serving the asset should handle it's caching/TTL stuff correctly, but config of that can be hard (in complexity or domain knowledge.) Build hashes have been the most resilient approach that I've found so far. Mostly because it is easily automated in artifact generation.

Versioned URLs of everything except index.html should work just fine.

versioned url

As others have mentioned: app.min.js?$hash-or-date-or-releasever$