
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@replit/graphql-codegen-persisted-queries
Advanced tools
GraphQL Codegen plugin to generate persisted query manifests for server and client
A GraphQL Codegen plugin for generating persisted query manifests for server and client.
pnpm add -D @replit/graphql-codegen-persisted-queries
# codegen.yml
generates:
./generated-gql/persisted-query-manifest/client.json:
plugins:
- @replit/graphql-codegen-persisted-queries
config:
output: client
./generated-gql/persisted-query-manifest/server.json:
plugins:
- @replit/graphql-codegen-persisted-queries
config:
output: server
includeAlgorithmPrefix: true # Enable prefixed document identifiers for compliance with GraphQL over HTTP spec
// codegen.ts
import type { CodegenConfig } from '@graphql-codegen/cli';
const config: CodegenConfig = {
// ... other config
generates: {
'./generated-gql/persisted-query-manifest/client.json': {
documents: ['./client/**/*.{graphql,gql}', './pages/**/*.{graphql,gql}'],
plugins: ['@replit/graphql-codegen-persisted-queries'],
config: {
output: 'client',
},
},
'./generated-gql/persisted-query-manifest/server.json': {
documents: ['./client/**/*.{graphql,gql}', './pages/**/*.{graphql,gql}'],
plugins: ['@replit/graphql-codegen-persisted-queries'],
config: {
output: 'server',
includeAlgorithmPrefix: true, // Enable prefixed document identifiers for compliance with GraphQL over HTTP spec
},
}
}
};
export default config;
| Option | Type | Default | Description |
|---|---|---|---|
output | 'client' | 'server' | (required) | Format of the generated manifest |
algorithm | string | 'sha256' | Hash algorithm to use for generating operation IDs |
includeAlgorithmPrefix | boolean | false | Whether to prefix hashes with algorithm name (e.g., sha256:abc123...) |
The client format provides a simple mapping between operation names and their hashes, making it easy for clients to reference operations by name:
{
"GetUser": "abcdef123456...",
"UpdateUser": "fedcba654321..."
}
With includeAlgorithmPrefix: true:
{
"GetUser": "sha256:abcdef123456...",
"UpdateUser": "sha256:fedcba654321..."
}
The server format is more comprehensive, mapping operation hashes to their complete details (type, name, and body). This is ideal for server-side lookup and validation:
{
"format": "apollo-persisted-query-manifest",
"version": 1,
"operations": {
"abcdef123456...": {
"type": "query",
"name": "GetUser",
"body": "query GetUser { user { id name } }"
},
"fedcba654321...": {
"type": "mutation",
"name": "UpdateUser",
"body": "mutation UpdateUser($id: ID!, $name: String!) { updateUser(id: $id, name: $name) { id name } }"
}
}
}
With includeAlgorithmPrefix: true:
{
"format": "apollo-persisted-query-manifest",
"version": 1,
"operations": {
"sha256:abcdef123456...": {
"type": "query",
"name": "GetUser",
"body": "query GetUser { user { id name } }"
},
"sha256:fedcba654321...": {
"type": "mutation",
"name": "UpdateUser",
"body": "mutation UpdateUser($id: ID!, $name: String!) { updateUser(id: $id, name: $name) { id name } }"
}
}
}
The plugin's workflow is straightforward:
__typename to all selection sets in the operations for proper type resolutionsha256)You can enable the "Prefixed Document Identifier" format (e.g., sha256:abc123...) for compliance with the GraphQL over HTTP specification (RFC at the time of publishing this package) by setting includeAlgorithmPrefix: true.
# Install dependencies
pnpm install
# Watch mode for development
pnpm dev
The plugin includes a comprehensive test suite built with Vitest:
# Run tests
pnpm test
# Run tests in watch mode
pnpm test:watch
MIT
FAQs
GraphQL Codegen plugin to generate persisted query manifests for server and client
The npm package @replit/graphql-codegen-persisted-queries receives a total of 33,475 weekly downloads. As such, @replit/graphql-codegen-persisted-queries popularity was classified as popular.
We found that @replit/graphql-codegen-persisted-queries demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 22 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.