skills/frontend-architect/SKILL.md
Frontend stack decisions, Cloudflare deployment patterns, component systems, and internal tools architecture. Use for framework selection, deployment strategy, design system bridging, shadcn setup. Activate on "frontend architecture", "tech stack", "Cloudflare Pages", "component library", "internal tools", "shadcn setup". NOT for writing CSS (use frontend-developer), design critique (use design-critic), or backend APIs.
npx skillsauth add curiositech/windags-skills frontend-architectInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Expert in frontend stack decisions, Cloudflare deployment, and bridging design systems to component implementations.
1. Performance Budget Assessment
If bundle size must be <100KB:
→ Use Astro (islands architecture)
If first contentful paint must be <800ms:
→ Use Astro or SvelteKit
If you need full SSR + interactivity:
→ Use Next.js or Remix
If team only knows React:
→ Use Next.js or Vite + React
2. Deployment Target Decision
If deploying to Cloudflare Pages:
→ Astro (native) > Next.js (OpenNext) > SvelteKit
If need edge compute + database:
→ Next.js + Turso or Astro + D1
If team uses Vercel:
→ Next.js (best DX) > Astro
If self-hosting:
→ Any framework, consider maintenance overhead
3. Team Capability Assessment
If team <3 developers:
→ Pick familiar stack, avoid learning curves
If team >5 developers:
→ Consider TypeScript monorepo (Turborepo)
If designers hand off static mockups:
→ Astro + MDX for content
If designers work in Figma with dev mode:
→ Next.js + shadcn/ui
4. Content Type Classification
If >80% static content:
→ Astro
If heavy user interactions (dashboards, SPAs):
→ Next.js App Router or Vite + React
If marketing site with CMS:
→ Astro + Sanity/Contentful
If internal tool prototype:
→ Next.js (faster iteration) or Vite (faster builds)
Detection: Bundle size >500KB from framework overhead alone Diagnosis: Using full-stack framework for static content Fix: Switch to Astro. If you see hydration for simple interactions, you're over-engineering
Detection: Build takes >5 minutes or frequent deployment failures Diagnosis: Wrong adapter for platform (e.g., Node.js app on edge runtime) Fix: Next.js on Cloudflare needs OpenNext. Check runtime compatibility early
Detection: Complex auth logic in frontend for internal tools Diagnosis: Implementing security in wrong layer Fix: Use Cloudflare Access for auth, simple role checks in app. Don't build OAuth from scratch
Detection: Considering migration without clear performance/DX problems Diagnosis: Chasing trends instead of solving real problems Fix: Measure current pain points. Only migrate if you can quantify 2x improvement
Detection: 3+ repos for a team of <5 developers Diagnosis: Over-engineering for future scale that may never come Fix: Consolidate to monorepo. Split when you have dedicated teams per service
Scenario: Marketing site, 20 pages, blog, team of 2 developers, Contentful CMS
Decision Process:
Framework Analysis:
Next.js Route:
- Pros: Team familiar, rich ecosystem, good CMS integrations
- Cons: Bundle size ~200KB, hydration cost, overkill for mostly static
- Performance: 75-85 Lighthouse (hydration penalty)
Astro Route:
- Pros: <50KB bundle, 95+ Lighthouse, partial hydration
- Cons: 1-week learning curve, smaller ecosystem
- Performance: 90-100 Lighthouse
Decision: Choose Astro
Implementation:
npm create astro@latest -- --template minimal
npx astro add react tailwind
# Use .astro for pages, .tsx for interactive islands
Scenario: Admin dashboard prototype, 5 beta users, 2-week sprint
Decision Process:
Architecture Decision:
Framework: Next.js (fast iteration, familiar)
Styling: shadcn/ui (components without design time)
Auth: Cloudflare Access (zero auth code)
Deployment: Cloudflare Pages with protection
Database: Turso (edge-compatible, easy setup)
Access Control Setup:
1. Cloudflare Access Application:
- Domain: internal-admin.pages.dev
- Policy: Allow emails from allowlist
2. Feature flags in app:
- Check cf-access-authenticated-user-email header
- Grant features based on email (admin vs beta)
What expert catches vs novice misses:
Don't use this skill for:
frontend-developer insteaddesign-critic insteadapi-architect insteaddatabase-architect insteadfrontend-developer insteaddevops-automator insteadperformance-optimizer insteadDelegation triggers:
frontend-developerdesign-criticapi-architectdatabase-architecttools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.