chore: release v0.12.0

[github-actions]

This PR was opened by the Changelogs release workflow.

When you're ready to release, merge this PR and the packages will be published.

---

0.12.0 (2026-08-15)

Minor Changes

• Accept asynchronous Alloy signers for Tempo fee sponsorship and session closing,
• enabling remote KMS, HSM, and MPC-backed server keys. (by @GeorgiosKonstantopoulos, #389)
• Added automatic native TIP-1034 channel top-ups before session vouchers exceed the current deposit, with credentials bound to each active WebSocket challenge across reconnects. (by @GeorgiosKonstantopoulos, #389)
• Support Tempo Wallet P-256 access keys for charge payments and expose the
• shared store.json loader for native command-line clients. (by @GeorgiosKonstantopoulos, #389)
• Add route-bound machineUSD session channels and atomic settlement into the
• merchant's configured stablecoin. (by @GeorgiosKonstantopoulos, #389)
• Add atomic stablecoin auto-swaps for native TIP-1034 session opens and top-ups,
• including the required Stablecoin DEX approval for charge and session payments. (by @GeorgiosKonstantopoulos, #389)
• Add a Charge-only payment provider backed by the canonical Tempo Accounts
• store.json, with lazy access-key selection and no separate signing mode. (by @GeorgiosKonstantopoulos, #389)
• Add separate non-mutating charge validation and terminal broadcast APIs, retaining verification as a compatibility alias and falling back to legacy method implementations. Add TempoRelayConfig and TempoBuilder::relay for delegating Tempo charge credential validation and finalization to Tempo API or a compatible MPP relay. Relay requests normalize the echoed challenge request, derive deterministic broadcast idempotency keys, validate returned receipts, and hide private relay failures. Add an Axum charge-relay example dogfooded against Tempo Moderato. (by @GeorgiosKonstantopoulos, #389)

Patch Changes

• Return a fresh body-bound payment challenge when request-body credential verification fails. (by @GeorgiosKonstantopoulos, #389)
• Pinned the Tempo dependency to the coordinated 7690815 revision. (by @GeorgiosKonstantopoulos, #389)
• Use the SDK-independent mpp_ prefix for Stripe PaymentIntent idempotency keys. (by @GeorgiosKonstantopoulos, #389)
• Continue retrying distinct charge challenges within the configured payment
• retry limit, matching MPPx and allowing sponsored servers to rotate challenges
• that were rejected before settlement. (by @GeorgiosKonstantopoulos, #389)
• Match MPPx and Tempo fee sponsorship by encoding P-256 charge and TIP-1034 management credentials as sender-signed 0x78 envelopes. (by @GeorgiosKonstantopoulos, #389)
• Authorize canonical application WebSockets with their advertised opening amount,
• and provide a top-up-aware authorization path for full reusable channels. (by @GeorgiosKonstantopoulos, #389)
• Reject payment challenges containing malformed RFC 3339 expires timestamps during header parsing. (by @GeorgiosKonstantopoulos, #389)
• Pinned an updated Tempo dependency revision and reworked the one-time authorization test to sign the key authorization with a real root signer. (by @GeorgiosKonstantopoulos, #389)
• Preserve method-specific receipt fields when parsing and serializing payment receipts. (by @GeorgiosKonstantopoulos, #389)
• Mark successful body-bound payment responses as private while preserving existing
• Cache-Control directives, preventing shared caches from storing payment receipts. (by @GeorgiosKonstantopoulos, #389)
• Updated the pinned tempo-alloy git revision. (by @GeorgiosKonstantopoulos, #389)
• Reject payment challenges whose method identifier contains characters other
• than lowercase ASCII letters. Reject payment challenges reached through a
• cross-origin redirect before a credential can be created or sent. (by @GeorgiosKonstantopoulos, #389)
• Reject Payment challenges containing an unterminated quoted-string parameter. (by @GeorgiosKonstantopoulos, #389)
• Resolve persisted Tempo Wallet key authorizations against the Account Keychain before signing. Already-authorized access keys now omit the one-time authorization instead of failing fresh charge or session transactions with KeyAlreadyExists. (by @GeorgiosKonstantopoulos, #389)
• Update the Tempo SDK revision so fee-payer relays can select the transaction fee token. (by @GeorgiosKonstantopoulos, #389)
• Load pending Accounts SDK key authorizations from the shared Tempo Wallet store so native Rust clients can provision a fresh access key with their first transaction. Open a fresh session after access-key rotation instead of trying to reuse a channel bound to the previous voucher signer. (by @GeorgiosKonstantopoulos, #389)