Design and Implement GraphQL APIs

Covers GraphQL schema design (intentional nullability, union-typed payloads for errors-as-data, Relay-style pagination), resolvers, DataLoader for N+1 prevention, federation for microservices, subscriptions, code generation, and client integration with Apollo Client or urql. The skill's core is a set of eight documented "Sharp Edges," each with a severity rating, a situation, symptoms, why it breaks, and a recommended fix: resolvers making separate database queries per item (fixed with DataLoader batching), deeply nested queries that can DoS a server (fixed with depth-limit and complexity-limit validation rules), introspection left enabled in production (exposes the full schema to attackers), authorization implemented only in schema directives rather than resolvers, authorization checked on queries but not on individual fields (leaking private data alongside public fields), non-null field failures nullifying entire parent objects, expensive queries treated the same as cheap ones, and subscriptions not cleaned up on disconnect. It also lists a set of validation checks (introspection in production, direct database calls inside resolvers, missing depth limiting, resolvers without try-catch, JSON/Any types bypassing type safety, mutations returning bare types instead of error-carrying payloads, and list fields without pagination arguments).

Use it when designing or reviewing a GraphQL schema, writing resolvers, preventing N+1 database queries, setting up federation, or integrating an Apollo or urql client. Per the skill's own 2025 lesson, GraphQL isn't always the answer: for simple CRUD, REST is simpler, and for high-performance public APIs, REST with caching wins - use GraphQL specifically when the application has complex data relationships and diverse client needs.

Input is existing schema or resolver code, or a description of a performance, authorization, or caching problem. Output is schema and resolver code following the documented patterns: non-null-aware type definitions, DataLoader batching functions that preserve input order, union-typed mutation payloads for expected failures, Apollo Client cache typePolicies, a codegen.ts configuration, and targeted fixes for each Sharp Edge such as depthLimit(10), createComplexityLimitRule, and field-level authorization checks.

Names @apollo/server, graphql-yoga, and mercurius for the server; @apollo/client, urql, and graphql-request for the client; graphql-codegen and dataloader as core tooling; graphql-depth-limit and graphql-validation-complexity for query limiting; and graphql-subscriptions with graphql-ws for subscription cleanup. It delegates database optimization to a postgres-wizard skill, authentication to authentication-oauth, caching to caching-strategies, and WebSocket infrastructure to backend, and is designed to pair with backend, postgres-wizard, nextjs-app-router, and react-patterns.

Backend and full-stack engineers building or hardening a GraphQL API - schema authors, resolver implementers, and anyone integrating an Apollo or urql client who need concrete performance and security fixes rather than conceptual GraphQL theory.