skills/mobile-offline-sync-architect/SKILL.md
Mobile offline-first architecture with local databases, CRDT conflict resolution, and background sync. Activate on: offline sync, offline-first, local database, WatermelonDB, SQLite, CRDT, conflict resolution, background sync, mobile persistence. NOT for: server-side databases (use data-pipeline-engineer), web caching strategies (use pwa-architect), API design (use api-architect).
npx skillsauth add curiositech/windags-skills mobile-offline-sync-architectInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Expert in building offline-first mobile applications with local databases, conflict resolution, and reliable background synchronization.
Activate on: "offline sync", "offline-first app", "local database mobile", "WatermelonDB", "SQLite sync", "CRDT conflict resolution", "background sync", "mobile data persistence", "op-sqlite"
NOT for: Server databases → data-pipeline-engineer | Web caching → pwa-architect | API design → api-architect
updated_at, deleted_at, sync_status columns to all synced tables| Domain | Technologies | |--------|-------------| | Local DB | op-sqlite, WatermelonDB, Realm, expo-sqlite | | Sync Protocols | Delta sync, CRDT (Yjs, Automerge), operational transform | | Conflict Resolution | Last-write-wins, merge functions, CRDT automatic merge | | Background Sync | react-native-background-fetch, expo-background-fetch | | Platforms | PowerSync, ElectricSQL, Replicache, custom sync engines |
┌─────────────────────────────────┐
│ Mobile App │
│ ┌──────────┐ ┌─────────────┐ │
│ │ UI Layer │──│ Sync Engine │ │
│ └──────────┘ └──────┬──────┘ │
│ │ │
│ ┌────────────────────┴───────┐ │
│ │ Local SQLite DB │ │
│ │ (source of truth offline) │ │
│ └────────────────────────────┘ │
└────────────────┬────────────────┘
│ Background sync
│ (when online)
▼
┌────────────────────────────────┐
│ Server │
│ ┌──────────┐ ┌────────────┐ │
│ │ Sync API │──│ Server DB │ │
│ │ /sync │ │ (Postgres) │ │
│ └──────────┘ └────────────┘ │
└────────────────────────────────┘
Pull: GET /sync?since=<timestamp> → changed records
Push: POST /sync { changes: [...] } → conflicts
interface SyncRequest {
lastSyncTimestamp: string;
changes: ChangeSet[]; // Local changes since last sync
}
interface ChangeSet {
table: string;
created: Record[];
updated: Record[];
deleted: { id: string; deleted_at: string }[];
}
interface SyncResponse {
serverTimestamp: string;
changes: ChangeSet[]; // Server changes since client's lastSync
conflicts: Conflict[]; // Records changed on both sides
}
// Conflict resolution strategy
function resolveConflict(local: Record, server: Record): Record {
// Strategy 1: Last-write-wins (simple, data loss possible)
return local.updated_at > server.updated_at ? local : server;
// Strategy 2: Field-level merge (no data loss for non-conflicting fields)
// return mergeFields(local, server, base);
// Strategy 3: CRDT (automatic, no conflicts by design)
// return crdtMerge(local, server);
}
import { synchronize } from '@nozbe/watermelondb/sync';
async function syncDatabase() {
await synchronize({
database,
pullChanges: async ({ lastPulledAt }) => {
const response = await api.get('/sync', {
params: { since: lastPulledAt },
});
return {
changes: response.data.changes,
timestamp: response.data.serverTimestamp,
};
},
pushChanges: async ({ changes, lastPulledAt }) => {
await api.post('/sync', { changes, lastPulledAt });
},
migrationsEnabledAtVersion: 1,
});
}
[ ] Local database chosen and configured (op-sqlite, WatermelonDB, Realm)
[ ] Sync schema includes updated_at, deleted_at, sync_status columns
[ ] Delta sync protocol implemented (not full-table)
[ ] Conflict resolution strategy defined and tested
[ ] Background sync configured (periodic + on-reconnect)
[ ] Offline indicator visible in UI
[ ] Pending local changes count displayed
[ ] Sync errors handled gracefully (retry with exponential backoff)
[ ] Data integrity: no data loss during conflict resolution
[ ] Large dataset performance tested (10K+ records)
[ ] Soft deletes used (deleted_at, not hard DELETE)
[ ] Sync works after app kill and restart
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.