skills/pwa-expert/SKILL.md
Progressive Web App development with Service Workers, offline support, and app-like behavior. Use for caching strategies, install prompts, push notifications, background sync. Activate on "PWA", "Service Worker", "offline", "install prompt", "beforeinstallprompt", "manifest.json", "workbox", "cache-first". NOT for native app development (use React Native), general web performance (use performance docs), or server-side rendering.
npx skillsauth add curiositech/windags-skills pwa-expertInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Build installable, offline-capable web apps with Service Workers, smart caching, and native-like experiences.
REQUEST TYPE?
├─ Static assets (CSS, JS, fonts, images)
│ └─ CACHE-FIRST: Check cache → fallback to network
├─ API data that changes frequently
│ ├─ User expects fresh data?
│ │ └─ NETWORK-FIRST: Try network → fallback to cache
│ └─ Performance over freshness?
│ └─ STALE-WHILE-REVALIDATE: Serve cache → update in background
└─ Authentication/Real-time data
└─ NETWORK-ONLY: Always fetch, no cache
CONNECTIVITY STATUS?
├─ navigator.onLine === false
│ └─ Serve from cache OR show offline page
├─ Request fails (fetch throws)
│ ├─ Resource in cache?
│ │ └─ Serve cached version
│ └─ No cache available?
│ └─ Show offline fallback
└─ Online AND request succeeds
└─ Update cache with fresh data
beforeinstallprompt FIRED?
├─ User just arrived (< 30 seconds on site)?
│ └─ DEFER: Store prompt, don't show yet
├─ User engaged (scrolled, clicked, 2+ page views)?
│ ├─ Mobile device?
│ │ └─ SHOW: Mobile users expect app install
│ └─ Desktop?
│ └─ CONTEXTUAL: Show near task completion
└─ User dismissed before?
└─ WAIT: Don't show again for 7+ days
Symptom: Users see outdated content, complain "app isn't working"
Detection: User reports + cache timestamp > expected refresh interval
Fix: Force cache update with caches.delete() + trigger fresh fetch
Symptom: PWA features not working, install prompt never appears
Detection: Console error "Failed to register service worker" OR navigator.serviceWorker undefined
Fix: Check HTTPS requirement (HTTP only works on localhost), validate SW file path, verify manifest linked in HTML
Symptom: App updates not appearing, old SW keeps running
Detection: registration.waiting exists but skipWaiting() not called
Fix: Implement update flow with postMessage() to SW + skipWaiting() + clients.claim()
Symptom: "Add to Home Screen" never appears, PWA audit fails Detection: DevTools Application tab shows manifest errors OR Lighthouse PWA score < 80 Fix: Validate required fields (name, start_url, display, icons 192x192 + 512x512), ensure HTTPS, check icon paths exist
Symptom: App slows down, storage quota exceeded errors
Detection: Cache storage > 50MB OR "QuotaExceededError" in console
Fix: Implement cache expiration (maxEntries, maxAgeSeconds), clean old cache versions in SW activate event
Scenario: Convert existing Next.js recovery support app to installable PWA with offline meeting finder
Step 1: Assess Current State
Step 2: Decision - Caching Strategy
Meeting data API → Changes daily → NETWORK-FIRST
User profile images → Rarely change → CACHE-FIRST
Static assets → Never change per version → CACHE-FIRST
Meeting search → Mix strategy → STALE-WHILE-REVALIDATE
Step 3: Create manifest.json
{
"name": "Recovery Meetings Finder",
"short_name": "Meetings",
"start_url": "/",
"display": "standalone",
"background_color": "#1a1410",
"theme_color": "#1a1410",
"icons": [
{"src": "/icons/icon-192.png", "sizes": "192x192", "type": "image/png"},
{"src": "/icons/icon-512.png", "sizes": "512x512", "type": "image/png"}
]
}
Step 4: Implement Service Worker
// public/sw.js - Network-first for API
self.addEventListener('fetch', (event) => {
if (event.request.url.includes('/api/meetings')) {
event.respondWith(networkFirst(event.request));
}
});
Expert catches: Novice would miss offline fallback page, expert adds catch-all route to serve cached "/offline" for navigation requests that fail.
Do NOT use this skill for:
react-native-expert or flutter-expert insteadweb-performance-expert for non-PWA performance issuesnextjs-expert or framework-specific skillspush-notification-expert for complex notification systemsWhen to delegate:
data-sync-expertcdn-expertcapacitor-expert or electron-experttools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.