@molecule/api-resource-bookmark 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/authorizers/index.d.ts

@@ -0,0 +1,10 @@
+export {};
+/**
+ * Bookmark authorizers.
+ *
+ * All bookmark operations require authentication and are scoped to the
+ * current user via session. No additional authorizers needed.
+ *
+ * @module
+ */
+//# sourceMappingURL=index.d.ts.map

package/dist/authorizers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorizers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/authorizers/index.js

@@ -0,0 +1,9 @@
+export {};
+/**
+ * Bookmark authorizers.
+ *
+ * All bookmark operations require authentication and are scoped to the
+ * current user via session. No additional authorizers needed.
+ *
+ * @module
+ */

package/dist/browser-guard.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=browser-guard.d.ts.map

package/dist/browser-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-guard.d.ts","sourceRoot":"","sources":["../src/browser-guard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,CAAA"}

package/dist/browser-guard.js

@@ -0,0 +1,18 @@
+/**
+ * Browser guard — `@molecule/api-resource-bookmark` is SERVER-ONLY.
+ *
+ * Generated by scripts/gen-browser-guards.mjs (workspace root) — edit THAT, not this.
+ * Evaluating a server package in a browser bundle is always an import-graph mistake
+ * (node APIs, secrets); without this guard it surfaces as a cryptic downstream crash
+ * ("Buffer is not defined") far from the culprit. Throwing here names the package and
+ * the fix at the exact moment the client bundle evaluates it. jsdom tests and SSR are
+ * unaffected: the throw requires browser globals AND the absence of a node runtime.
+ */
+const g = globalThis;
+if (g.window !== undefined && g.document !== undefined && !g.process?.versions?.node) {
+    throw new Error('@molecule/api-resource-bookmark is SERVER-ONLY: it was bundled into browser/client code. Import it only ' +
+        'from server code (a server route/function or your API), or dynamic-import it inside ' +
+        'the server handler — never from components or shared client modules, and never ' +
+        'polyfill Buffer/process to silence this.');
+}
+export {};

package/dist/handlers/create.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Add bookmark handler.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Adds a bookmark for the current user. Idempotent.
+ *
+ * @param req - The request with bookmark body (resourceType, resourceId, folder?).
+ * @param res - The response object.
+ */
+export declare function create(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=create.d.ts.map

package/dist/handlers/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/handlers/create.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAK/E;;;;;GAKG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkCvF"}

package/dist/handlers/create.js

@@ -0,0 +1,44 @@
+/**
+ * Add bookmark handler.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { addBookmark } from '../service.js';
+import { createBookmarkSchema } from '../validation.js';
+/**
+ * Adds a bookmark for the current user. Idempotent.
+ *
+ * @param req - The request with bookmark body (resourceType, resourceId, folder?).
+ * @param res - The response object.
+ */
+export async function create(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const parsed = createBookmarkSchema.safeParse(req.body);
+    if (!parsed.success) {
+        const errors = parsed.error.issues.map((e) => `${e.path.join('.')}: ${e.message}`).join(', ');
+        res.status(400).json({ error: errors, errorKey: 'bookmark.error.validationFailed' });
+        return;
+    }
+    try {
+        const bookmark = await addBookmark(userId, parsed.data.resourceType, parsed.data.resourceId, parsed.data.folder);
+        res.status(201).json(bookmark);
+    }
+    catch (error) {
+        logger.error('Failed to add bookmark', { userId, error });
+        res.status(500).json({
+            error: t('bookmark.error.createFailed', undefined, {
+                defaultValue: 'Failed to add bookmark',
+            }),
+            errorKey: 'bookmark.error.createFailed',
+        });
+    }
+}

package/dist/handlers/del.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Remove bookmark handler.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Removes a bookmark by resource type and ID.
+ *
+ * @param req - The request with `resourceType` and `resourceId` params.
+ * @param res - The response object.
+ */
+export declare function del(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=del.d.ts.map

package/dist/handlers/del.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"del.d.ts","sourceRoot":"","sources":["../../src/handlers/del.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;GAKG;AACH,wBAAsB,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCpF"}

package/dist/handlers/del.js

@@ -0,0 +1,47 @@
+/**
+ * Remove bookmark handler.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { removeBookmark } from '../service.js';
+/**
+ * Removes a bookmark by resource type and ID.
+ *
+ * @param req - The request with `resourceType` and `resourceId` params.
+ * @param res - The response object.
+ */
+export async function del(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const { resourceType, resourceId } = req.params;
+    if (!resourceType || !resourceId) {
+        res.status(400).json({
+            error: t('bookmark.error.missingResource', undefined, {
+                defaultValue: 'Resource type and ID are required',
+            }),
+            errorKey: 'bookmark.error.missingResource',
+        });
+        return;
+    }
+    try {
+        await removeBookmark(userId, resourceType, resourceId);
+        res.status(204).end();
+    }
+    catch (error) {
+        logger.error('Failed to remove bookmark', { userId, resourceType, resourceId, error });
+        res.status(500).json({
+            error: t('bookmark.error.deleteFailed', undefined, {
+                defaultValue: 'Failed to remove bookmark',
+            }),
+            errorKey: 'bookmark.error.deleteFailed',
+        });
+    }
+}

package/dist/handlers/index.d.ts

@@ -0,0 +1,6 @@
+export * from './create.js';
+export * from './del.js';
+export * from './list.js';
+export * from './read.js';
+export * from './update.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/handlers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handlers/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA"}

package/dist/handlers/index.js

@@ -0,0 +1,5 @@
+export * from './create.js';
+export * from './del.js';
+export * from './list.js';
+export * from './read.js';
+export * from './update.js';

package/dist/handlers/list.d.ts

@@ -0,0 +1,14 @@
+/**
+ * List bookmarks handler.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Lists the current user's bookmarks with optional filtering and pagination.
+ *
+ * @param req - The request with optional query params (resourceType, folder, limit, offset).
+ * @param res - The response object.
+ */
+export declare function list(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=list.d.ts.map

package/dist/handlers/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/handlers/list.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BrF"}

package/dist/handlers/list.js

@@ -0,0 +1,41 @@
+/**
+ * List bookmarks handler.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { getBookmarks } from '../service.js';
+/**
+ * Lists the current user's bookmarks with optional filtering and pagination.
+ *
+ * @param req - The request with optional query params (resourceType, folder, limit, offset).
+ * @param res - The response object.
+ */
+export async function list(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const resourceType = req.query.resourceType;
+    const folder = req.query.folder;
+    const limit = parseInt(req.query.limit, 10) || 20;
+    const offset = parseInt(req.query.offset, 10) || 0;
+    try {
+        const result = await getBookmarks(userId, { resourceType, folder, limit, offset });
+        res.json(result);
+    }
+    catch (error) {
+        logger.error('Failed to list bookmarks', { userId, error });
+        res.status(500).json({
+            error: t('bookmark.error.listFailed', undefined, {
+                defaultValue: 'Failed to list bookmarks',
+            }),
+            errorKey: 'bookmark.error.listFailed',
+        });
+    }
+}

package/dist/handlers/read.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Check bookmark handler.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Checks whether the current user has bookmarked a resource.
+ *
+ * @param req - The request with `resourceType` and `resourceId` params.
+ * @param res - The response object.
+ */
+export declare function check(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=read.d.ts.map

package/dist/handlers/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/handlers/read.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCtF"}

package/dist/handlers/read.js

@@ -0,0 +1,47 @@
+/**
+ * Check bookmark handler.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { isBookmarked } from '../service.js';
+/**
+ * Checks whether the current user has bookmarked a resource.
+ *
+ * @param req - The request with `resourceType` and `resourceId` params.
+ * @param res - The response object.
+ */
+export async function check(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const { resourceType, resourceId } = req.params;
+    if (!resourceType || !resourceId) {
+        res.status(400).json({
+            error: t('bookmark.error.missingResource', undefined, {
+                defaultValue: 'Resource type and ID are required',
+            }),
+            errorKey: 'bookmark.error.missingResource',
+        });
+        return;
+    }
+    try {
+        const bookmarked = await isBookmarked(userId, resourceType, resourceId);
+        res.json({ bookmarked });
+    }
+    catch (error) {
+        logger.error('Failed to check bookmark', { userId, resourceType, resourceId, error });
+        res.status(500).json({
+            error: t('bookmark.error.checkFailed', undefined, {
+                defaultValue: 'Failed to check bookmark',
+            }),
+            errorKey: 'bookmark.error.checkFailed',
+        });
+    }
+}

package/dist/handlers/update.d.ts

@@ -0,0 +1,14 @@
+/**
+ * List bookmark folders handler.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Lists all unique folder names for the current user's bookmarks.
+ *
+ * @param _req - The request (unused).
+ * @param res - The response object.
+ */
+export declare function folders(_req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=update.d.ts.map

package/dist/handlers/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/handlers/update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBzF"}

package/dist/handlers/update.js

@@ -0,0 +1,37 @@
+/**
+ * List bookmark folders handler.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { getFolders } from '../service.js';
+/**
+ * Lists all unique folder names for the current user's bookmarks.
+ *
+ * @param _req - The request (unused).
+ * @param res - The response object.
+ */
+export async function folders(_req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    try {
+        const result = await getFolders(userId);
+        res.json({ folders: result });
+    }
+    catch (error) {
+        logger.error('Failed to list bookmark folders', { userId, error });
+        res.status(500).json({
+            error: t('bookmark.error.foldersFailed', undefined, {
+                defaultValue: 'Failed to list folders',
+            }),
+            errorKey: 'bookmark.error.foldersFailed',
+        });
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Bookmark/favorite resource for molecule.dev.
+ *
+ * Allows users to bookmark any resource, organize into folders, and check
+ * bookmark status.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { routes, requestHandlerMap } from '@molecule/api-resource-bookmark'
+ *
+ * // Wire routes into your Express app via mlcl inject
+ * // POST   /bookmarks
+ * // GET    /bookmarks
+ * // GET    /bookmarks/folders
+ * // GET    /bookmarks/check/:resourceType/:resourceId
+ * // DELETE /bookmarks/:resourceType/:resourceId
+ * ```
+ *
+ * @remarks
+ * - **List endpoints return a PAGINATED envelope** `{ data, total, limit, offset }`, not a
+ *   bare array — read the rows off `result.data` (server). On the client, `unwrapList(res)`
+ *   from `@molecule/app-http` normalizes this envelope (pass it the whole HttpResponse), so
+ *   the rows come back; reading the response as a bare array — or `res.data` alone (which is
+ *   the envelope) — yields an EMPTY list.
+ * - **Migration required.** `src/__setup__/bookmarks.sql` ships with this package
+ *   and must exist in the target database before use (scaffolded apps apply it
+ *   automatically). Note the `UNIQUE ("userId","resourceType","resourceId")`
+ *   constraint — one bookmark per user per resource.
+ * - **`addBookmark()` is idempotent and does NOT move folders.** Re-adding an
+ *   existing bookmark returns the existing row unchanged — to move a bookmark to
+ *   another folder, remove and re-add it (or add your own update path).
+ * - **Owner-scoped via the session.** All routes require `authenticate` and every
+ *   query filters by the session `userId` — never accept a target userId from the
+ *   client (IDOR).
+ * - Bookmarked resources are polymorphic and unverified (no FK): use the same
+ *   canonical `resourceType` slugs as your other polymorphic resources
+ *   (comments, activity feed) so `check`/`remove` keys line up.
+ * - Folders are free-form strings on the bookmark row (`GET /bookmarks/folders`
+ *   returns the distinct set) — there is no folder entity to create first.
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] Bookmarking an item (POST /bookmarks with its resourceType +
+ *   resourceId) saves it, it then appears in the user's bookmarks list
+ *   (GET /bookmarks), and its bookmark/star control reflects the saved state
+ *   (GET /bookmarks/check/:resourceType/:resourceId returns { bookmarked: true }).
+ * - [ ] It is idempotent and toggles cleanly: bookmarking the SAME
+ *   resourceType+resourceId twice does NOT create a duplicate (the UNIQUE
+ *   (userId, resourceType, resourceId) constraint holds — the second add
+ *   returns the existing row), and un-bookmarking
+ *   (DELETE /bookmarks/:resourceType/:resourceId) removes it from the list and
+ *   flips the control back (check returns { bookmarked: false }).
+ * - [ ] Folders work: a bookmark filed into a folder (the free-form `folder`
+ *   string, set at create time — re-adding does NOT move it between folders)
+ *   shows under that folder, GET /bookmarks/folders returns the distinct folder
+ *   set, and GET /bookmarks?folder=X (and ?resourceType=X) filters the list to
+ *   only the matching bookmarks.
+ * - [ ] Display data resolves from the referenced resource: the bookmark row
+ *   stores only resourceType+resourceId (no title/url/thumbnail, no FK), so each
+ *   list item renders its real title/thumbnail by looking the target up, and a
+ *   bookmark whose target was since deleted is handled gracefully (hidden or
+ *   tombstoned, never a crash or a blank row).
+ * - [ ] Authorization — bookmarks are strictly per-user: the owner is the
+ *   session userId (res.locals.session), NEVER a userId taken from the request
+ *   body; every list/check/remove is scoped to that session user, so one user
+ *   can neither see nor delete another user's saved items (there is no
+ *   bookmark-id route to guess — keys are resourceType+resourceId under the
+ *   caller's own userId); and a user can only bookmark targets they are allowed
+ *   to see (the target is polymorphic and unverified, so gate the create by
+ *   target visibility).
+ */
+export * from './authorizers/index.js';
+export * from './browser-guard.js';
+export * from './handlers/index.js';
+export * from './requestHandlerMap.js';
+export * from './routes.js';
+export * from './service.js';
+export * from './types.js';
+export * from './validation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAEH,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA"}

package/dist/index.js

@@ -0,0 +1,82 @@
+/**
+ * Bookmark/favorite resource for molecule.dev.
+ *
+ * Allows users to bookmark any resource, organize into folders, and check
+ * bookmark status.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { routes, requestHandlerMap } from '@molecule/api-resource-bookmark'
+ *
+ * // Wire routes into your Express app via mlcl inject
+ * // POST   /bookmarks
+ * // GET    /bookmarks
+ * // GET    /bookmarks/folders
+ * // GET    /bookmarks/check/:resourceType/:resourceId
+ * // DELETE /bookmarks/:resourceType/:resourceId
+ * ```
+ *
+ * @remarks
+ * - **List endpoints return a PAGINATED envelope** `{ data, total, limit, offset }`, not a
+ *   bare array — read the rows off `result.data` (server). On the client, `unwrapList(res)`
+ *   from `@molecule/app-http` normalizes this envelope (pass it the whole HttpResponse), so
+ *   the rows come back; reading the response as a bare array — or `res.data` alone (which is
+ *   the envelope) — yields an EMPTY list.
+ * - **Migration required.** `src/__setup__/bookmarks.sql` ships with this package
+ *   and must exist in the target database before use (scaffolded apps apply it
+ *   automatically). Note the `UNIQUE ("userId","resourceType","resourceId")`
+ *   constraint — one bookmark per user per resource.
+ * - **`addBookmark()` is idempotent and does NOT move folders.** Re-adding an
+ *   existing bookmark returns the existing row unchanged — to move a bookmark to
+ *   another folder, remove and re-add it (or add your own update path).
+ * - **Owner-scoped via the session.** All routes require `authenticate` and every
+ *   query filters by the session `userId` — never accept a target userId from the
+ *   client (IDOR).
+ * - Bookmarked resources are polymorphic and unverified (no FK): use the same
+ *   canonical `resourceType` slugs as your other polymorphic resources
+ *   (comments, activity feed) so `check`/`remove` keys line up.
+ * - Folders are free-form strings on the bookmark row (`GET /bookmarks/folders`
+ *   returns the distinct set) — there is no folder entity to create first.
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] Bookmarking an item (POST /bookmarks with its resourceType +
+ *   resourceId) saves it, it then appears in the user's bookmarks list
+ *   (GET /bookmarks), and its bookmark/star control reflects the saved state
+ *   (GET /bookmarks/check/:resourceType/:resourceId returns { bookmarked: true }).
+ * - [ ] It is idempotent and toggles cleanly: bookmarking the SAME
+ *   resourceType+resourceId twice does NOT create a duplicate (the UNIQUE
+ *   (userId, resourceType, resourceId) constraint holds — the second add
+ *   returns the existing row), and un-bookmarking
+ *   (DELETE /bookmarks/:resourceType/:resourceId) removes it from the list and
+ *   flips the control back (check returns { bookmarked: false }).
+ * - [ ] Folders work: a bookmark filed into a folder (the free-form `folder`
+ *   string, set at create time — re-adding does NOT move it between folders)
+ *   shows under that folder, GET /bookmarks/folders returns the distinct folder
+ *   set, and GET /bookmarks?folder=X (and ?resourceType=X) filters the list to
+ *   only the matching bookmarks.
+ * - [ ] Display data resolves from the referenced resource: the bookmark row
+ *   stores only resourceType+resourceId (no title/url/thumbnail, no FK), so each
+ *   list item renders its real title/thumbnail by looking the target up, and a
+ *   bookmark whose target was since deleted is handled gracefully (hidden or
+ *   tombstoned, never a crash or a blank row).
+ * - [ ] Authorization — bookmarks are strictly per-user: the owner is the
+ *   session userId (res.locals.session), NEVER a userId taken from the request
+ *   body; every list/check/remove is scoped to that session user, so one user
+ *   can neither see nor delete another user's saved items (there is no
+ *   bookmark-id route to guess — keys are resourceType+resourceId under the
+ *   caller's own userId); and a user can only bookmark targets they are allowed
+ *   to see (the target is polymorphic and unverified, so gate the create by
+ *   target visibility).
+ */
+export * from './authorizers/index.js';
+export * from './browser-guard.js';
+export * from './handlers/index.js';
+export * from './requestHandlerMap.js';
+export * from './routes.js';
+export * from './service.js';
+export * from './types.js';
+export * from './validation.js';

package/dist/requestHandlerMap.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Maps route handler names to their implementations.
+ *
+ * @module
+ */
+import { create } from './handlers/create.js';
+import { del } from './handlers/del.js';
+import { list } from './handlers/list.js';
+import { check } from './handlers/read.js';
+import { folders } from './handlers/update.js';
+/**
+ * Handler map for bookmark routes.
+ */
+export declare const requestHandlerMap: {
+    readonly create: typeof create;
+    readonly list: typeof list;
+    readonly check: typeof check;
+    readonly folders: typeof folders;
+    readonly del: typeof del;
+};
+//# sourceMappingURL=requestHandlerMap.d.ts.map

package/dist/requestHandlerMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestHandlerMap.d.ts","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE9C;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAA"}

package/dist/requestHandlerMap.js

@@ -0,0 +1,20 @@
+/**
+ * Maps route handler names to their implementations.
+ *
+ * @module
+ */
+import { create } from './handlers/create.js';
+import { del } from './handlers/del.js';
+import { list } from './handlers/list.js';
+import { check } from './handlers/read.js';
+import { folders } from './handlers/update.js';
+/**
+ * Handler map for bookmark routes.
+ */
+export const requestHandlerMap = {
+    create,
+    list,
+    check,
+    folders,
+    del,
+};

package/dist/routes.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Bookmark route definitions.
+ *
+ * Declarative routing — mlcl inject reads these to generate the Express router.
+ *
+ * @module
+ */
+/**
+ * Routes for bookmark add/remove/list/check and folder listing.
+ */
+export declare const routes: readonly [{
+    readonly method: "post";
+    readonly path: "/bookmarks";
+    readonly handler: "create";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/bookmarks";
+    readonly handler: "list";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/bookmarks/folders";
+    readonly handler: "folders";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/bookmarks/check/:resourceType/:resourceId";
+    readonly handler: "check";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "delete";
+    readonly path: "/bookmarks/:resourceType/:resourceId";
+    readonly handler: "del";
+    readonly middlewares: readonly ["authenticate"];
+}];
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;EAgBT,CAAA"}

package/dist/routes.js

@@ -0,0 +1,27 @@
+/**
+ * Bookmark route definitions.
+ *
+ * Declarative routing — mlcl inject reads these to generate the Express router.
+ *
+ * @module
+ */
+/**
+ * Routes for bookmark add/remove/list/check and folder listing.
+ */
+export const routes = [
+    { method: 'post', path: '/bookmarks', handler: 'create', middlewares: ['authenticate'] },
+    { method: 'get', path: '/bookmarks', handler: 'list', middlewares: ['authenticate'] },
+    { method: 'get', path: '/bookmarks/folders', handler: 'folders', middlewares: ['authenticate'] },
+    {
+        method: 'get',
+        path: '/bookmarks/check/:resourceType/:resourceId',
+        handler: 'check',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'delete',
+        path: '/bookmarks/:resourceType/:resourceId',
+        handler: 'del',
+        middlewares: ['authenticate'],
+    },
+];

package/dist/service.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Bookmark business logic service.
+ *
+ * @module
+ */
+import type { Bookmark, BookmarkQuery, PaginatedResult } from './types.js';
+/**
+ * Adds a bookmark. Idempotent — returns existing bookmark if already bookmarked.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource to bookmark.
+ * @param resourceId - The ID of the resource to bookmark.
+ * @param folder - Optional folder name.
+ * @returns The created or existing bookmark.
+ */
+export declare function addBookmark(userId: string, resourceType: string, resourceId: string, folder?: string): Promise<Bookmark>;
+/**
+ * Removes a bookmark.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource.
+ * @param resourceId - The ID of the resource.
+ */
+export declare function removeBookmark(userId: string, resourceType: string, resourceId: string): Promise<void>;
+/**
+ * Gets all bookmarks for a user with optional filtering and pagination.
+ *
+ * @param userId - The user ID.
+ * @param options - Query options.
+ * @returns Paginated bookmarks.
+ */
+export declare function getBookmarks(userId: string, options?: BookmarkQuery): Promise<PaginatedResult<Bookmark>>;
+/**
+ * Checks if a resource is bookmarked by a user.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource.
+ * @param resourceId - The ID of the resource.
+ * @returns `true` if bookmarked.
+ */
+export declare function isBookmarked(userId: string, resourceType: string, resourceId: string): Promise<boolean>;
+/**
+ * Gets all unique folder names for a user's bookmarks.
+ *
+ * @param userId - The user ID.
+ * @returns Array of folder names.
+ */
+export declare function getFolders(userId: string): Promise<string[]>;
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAI1E;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,QAAQ,CAAC,CAgBnB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAuBpC;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWlE"}

package/dist/service.js

@@ -0,0 +1,108 @@
+/**
+ * Bookmark business logic service.
+ *
+ * @module
+ */
+import { count, create as dbCreate, deleteMany, findMany, findOne } from '@molecule/api-database';
+const TABLE = 'bookmarks';
+/**
+ * Adds a bookmark. Idempotent — returns existing bookmark if already bookmarked.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource to bookmark.
+ * @param resourceId - The ID of the resource to bookmark.
+ * @param folder - Optional folder name.
+ * @returns The created or existing bookmark.
+ */
+export async function addBookmark(userId, resourceType, resourceId, folder) {
+    const existing = await findOne(TABLE, [
+        { field: 'userId', operator: '=', value: userId },
+        { field: 'resourceType', operator: '=', value: resourceType },
+        { field: 'resourceId', operator: '=', value: resourceId },
+    ]);
+    if (existing)
+        return existing;
+    const result = await dbCreate(TABLE, {
+        userId,
+        resourceType,
+        resourceId,
+        folder: folder ?? null,
+    });
+    return result.data;
+}
+/**
+ * Removes a bookmark.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource.
+ * @param resourceId - The ID of the resource.
+ */
+export async function removeBookmark(userId, resourceType, resourceId) {
+    await deleteMany(TABLE, [
+        { field: 'userId', operator: '=', value: userId },
+        { field: 'resourceType', operator: '=', value: resourceType },
+        { field: 'resourceId', operator: '=', value: resourceId },
+    ]);
+}
+/**
+ * Gets all bookmarks for a user with optional filtering and pagination.
+ *
+ * @param userId - The user ID.
+ * @param options - Query options.
+ * @returns Paginated bookmarks.
+ */
+export async function getBookmarks(userId, options = {}) {
+    const limit = options.limit ?? 20;
+    const offset = options.offset ?? 0;
+    const where = [
+        { field: 'userId', operator: '=', value: userId },
+        ...(options.resourceType
+            ? [{ field: 'resourceType', operator: '=', value: options.resourceType }]
+            : []),
+        ...(options.folder ? [{ field: 'folder', operator: '=', value: options.folder }] : []),
+    ];
+    const [data, total] = await Promise.all([
+        findMany(TABLE, {
+            where,
+            orderBy: [{ field: 'createdAt', direction: 'desc' }],
+            limit,
+            offset,
+        }),
+        count(TABLE, where),
+    ]);
+    return { data, total, limit, offset };
+}
+/**
+ * Checks if a resource is bookmarked by a user.
+ *
+ * @param userId - The user ID.
+ * @param resourceType - The type of resource.
+ * @param resourceId - The ID of the resource.
+ * @returns `true` if bookmarked.
+ */
+export async function isBookmarked(userId, resourceType, resourceId) {
+    const existing = await findOne(TABLE, [
+        { field: 'userId', operator: '=', value: userId },
+        { field: 'resourceType', operator: '=', value: resourceType },
+        { field: 'resourceId', operator: '=', value: resourceId },
+    ]);
+    return existing !== null;
+}
+/**
+ * Gets all unique folder names for a user's bookmarks.
+ *
+ * @param userId - The user ID.
+ * @returns Array of folder names.
+ */
+export async function getFolders(userId) {
+    const bookmarks = await findMany(TABLE, {
+        where: [{ field: 'userId', operator: '=', value: userId }],
+        select: ['folder'],
+    });
+    const folders = new Set();
+    for (const b of bookmarks) {
+        if (b.folder)
+            folders.add(b.folder);
+    }
+    return [...folders].sort();
+}

package/dist/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Bookmark resource type definitions.
+ *
+ * User bookmarks that can reference any resource type. Supports optional
+ * folder organization.
+ *
+ * @module
+ */
+/**
+ * A bookmark linking a user to a resource, with optional folder grouping.
+ */
+export interface Bookmark {
+    /** Unique bookmark identifier. */
+    id: string;
+    /** The ID of the user who created the bookmark. */
+    userId: string;
+    /** The type of resource bookmarked (e.g. 'post', 'project'). */
+    resourceType: string;
+    /** The ID of the bookmarked resource. */
+    resourceId: string;
+    /** Optional folder name for organizing bookmarks. */
+    folder: string | null;
+    /** When the bookmark was created (ISO 8601). */
+    createdAt: string;
+    /** When the bookmark was last updated (ISO 8601). */
+    updatedAt: string;
+}
+/**
+ * Query options for listing bookmarks.
+ */
+export interface BookmarkQuery {
+    /** Filter by resource type. */
+    resourceType?: string;
+    /** Filter by folder name. */
+    folder?: string;
+    /** Maximum number of results to return. */
+    limit?: number;
+    /** Number of results to skip. */
+    offset?: number;
+}
+/**
+ * A paginated result set.
+ */
+export interface PaginatedResult<T> {
+    /** The result items for the current page. */
+    data: T[];
+    /** Total number of matching items across all pages. */
+    total: number;
+    /** Maximum number of results per page. */
+    limit: number;
+    /** Number of results skipped. */
+    offset: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,6CAA6C;IAC7C,IAAI,EAAE,CAAC,EAAE,CAAA;IACT,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAA;CACf"}

package/dist/types.js

@@ -0,0 +1,9 @@
+/**
+ * Bookmark resource type definitions.
+ *
+ * User bookmarks that can reference any resource type. Supports optional
+ * folder organization.
+ *
+ * @module
+ */
+export {};

package/dist/validation.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Bookmark input validation schemas.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Schema for validating bookmark creation input.
+ */
+export declare const createBookmarkSchema: z.ZodObject<{
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+    folder: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;iBAO/B,CAAA"}

package/dist/validation.js

@@ -0,0 +1,17 @@
+/**
+ * Bookmark input validation schemas.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Schema for validating bookmark creation input.
+ */
+export const createBookmarkSchema = z.object({
+    /** The type of resource to bookmark. */
+    resourceType: z.string().min(1).max(255),
+    /** The ID of the resource to bookmark. */
+    resourceId: z.string().min(1).max(255),
+    /** Optional folder name for organization. */
+    folder: z.string().min(1).max(255).optional(),
+});

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@molecule/api-resource-bookmark",
+  "version": "1.0.0",
+  "description": "Bookmark/favorite any resource with folder organization",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "bookmark",
+    "favorite",
+    "resource"
+  ],
+  "license": "Apache-2.0",
+  "devDependencies": {
+    "@types/node": "26.1.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "@molecule/api-database": "^1.0.0",
+    "@molecule/api-i18n": "^1.0.0",
+    "@molecule/api-logger": "^1.0.0",
+    "@molecule/api-resource": "^1.0.0",
+    "zod": "^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@molecule/api-database": {
+      "optional": true
+    },
+    "@molecule/api-i18n": {
+      "optional": true
+    },
+    "@molecule/api-logger": {
+      "optional": true
+    },
+    "@molecule/api-resource": {
+      "optional": true
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/molecule-dev/molecule.git",
+    "directory": "packages/api/resources/bookmark"
+  },
+  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/resources/bookmark",
+  "bugs": "https://github.com/molecule-dev/molecule/issues",
+  "publishConfig": {
+    "access": "public"
+  }
+}