Changelog API contracts

apiContract.mjs is the pure declaration source for all six authenticated routes. Runtime registration spreads the descriptors; query and decoded path parsers use those exact Zod instances at the existing handler boundaries. Importing the module performs no I/O.

Listing accepts the audience (default user), optional guide slug and locale; unsupported locales retain English fallback. Guide reads do not inspect or mutate reading receipts. Detail and unread-reset routes use the stable entryId and retain live audience/plugin authorization. Seen writes validate the exact entry, audience, revision and reset generation; reset writes validate the audience and generation, preserving malformed-body 400 and stale-receipt 409 responses. Readers accepts an entry and audience and remains administrator-only, as does resetting one audience card. All validation uses the descriptor's exact schema instances; the pure module also owns the audience enum used by entry parsing.

Assets use validated path segments, existing image extensions and real-path filesystem confinement, returning 404 on invalid, absent or unreferenced assets. The existing audience and plugin-grant projection authorizes exact Markdown image references and filters fingerprints; responses remain private/no-store. Assets return binary bytes, not JSON; other responses are buffered JSON. All current credential types retain the existing host and content-grant checks.

The browser release-notes page and guide article are the real consumers. Missing or failed plugin initialization publishes no live routes. Tests: tests/plugins/changelogPlugin.int.test.ts and tests/plugins/pluginApiBundledContracts.test.ts.