bump 0.9.12: add auth: plugin to all HTTP route registrations

OpenClaw 2026.3.2+ requires explicit auth field on registerHttpRoute.
All JACS well-known and public endpoints use auth: plugin (plugin-managed,
no gateway token required) since they must be publicly accessible for
agent discovery and document verification.

Author: Hendler

openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "moltyjacs",
   "name": "JACS Cryptographic Provenance",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "Add JACS cryptographic provenance plus HAI platform features (attestation, username, mailbox, and benchmark workflows)",
   "homepage": "https://hai.ai/jacs",
   "configSchema": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "moltyjacs",
-  "version": "0.9.11",
+  "version": "0.9.12",
   "description": "JACS cryptographic provenance plugin for OpenClaw - signing, verification, commitments, todos, agent state, and conversations",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

src/gateway/wellknown.ts

@@ -70,6 +70,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/.well-known/jacs-pubkey.json",
+    auth: "plugin",
     handler: async (req: GatewayRequest, res: GatewayResponse) => {
       if (!api.runtime.jacs?.isInitialized()) {
         res.status(503).json({
@@ -115,6 +116,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/.well-known/agent-card.json",
+    auth: "plugin",
     handler: async (_req: GatewayRequest, res: GatewayResponse) => {
       await serveGeneratedWellKnownDocument("/.well-known/agent-card.json", res);
     },
@@ -124,6 +126,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/.well-known/jwks.json",
+    auth: "plugin",
     handler: async (_req: GatewayRequest, res: GatewayResponse) => {
       await serveGeneratedWellKnownDocument("/.well-known/jwks.json", res);
     },
@@ -133,6 +136,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/.well-known/jacs-agent.json",
+    auth: "plugin",
     handler: async (_req: GatewayRequest, res: GatewayResponse) => {
       await serveGeneratedWellKnownDocument("/.well-known/jacs-agent.json", res);
     },
@@ -142,6 +146,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/.well-known/jacs-extension.json",
+    auth: "plugin",
     handler: async (_req: GatewayRequest, res: GatewayResponse) => {
       await serveGeneratedWellKnownDocument("/.well-known/jacs-extension.json", res);
     },
@@ -151,6 +156,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "POST",
     path: "/jacs/verify",
+    auth: "plugin",
     handler: async (req: GatewayRequest, res: GatewayResponse) => {
       if (!api.runtime.jacs?.isInitialized()) {
         res.status(503).json({ error: "JACS not initialized" });
@@ -185,6 +191,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/jacs/agent",
+    auth: "plugin",
     handler: async (_req: GatewayRequest, res: GatewayResponse) => {
       if (!api.runtime.jacs?.isInitialized()) {
         res.status(503).json({
@@ -229,6 +236,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/jacs/status",
+    auth: "plugin",
     handler: async (req: GatewayRequest, res: GatewayResponse) => {
       const config = api.config;
       const initialized = api.runtime.jacs?.isInitialized() || false;
@@ -247,6 +255,7 @@ export function registerGatewayMethods(api: OpenClawPluginAPI): void {
   registerRoute({
     method: "GET",
     path: "/jacs/attestation",
+    auth: "plugin",
     handler: async (req: GatewayRequest, res: GatewayResponse) => {
       if (!api.runtime.jacs?.isInitialized()) {
         res.status(503).json({