chore: release @solana/pay-kit 0.5.0 and deprecate @solana/mpp

[EfeDurmaz16]

Summary

Bumps @solana/pay-kit to 0.5.0 for release and deprecates @solana/mpp in
favor of it. No wire or runtime behavior changes: this is a version string, a
deprecation README, and a publish-workflow tweak.

Read order

1. typescript/packages/pay-kit/package.json — the bump, 0.4.0 to 0.5.0. One line.
2. typescript/packages/mpp/README.md — new deprecation notice. Check the
   migration path (@solana/mpp to @solana/pay-kit) and the note that the
   final release carries the fix(mpp): close concurrent-signature-replay TOCTOU in TS charge verify #211 TOCTOU fix.
3. .github/workflows/npm-publish.yml — the mpp pack step no longer copies the
   root pay-kit README over the package one, so the deprecation notice ships;
   the mpp job and the workflow input are marked deprecated. Confirm the pack
   step still yields a valid tarball with dist/.

Generated vs handwritten

• Skim (mechanical): package.json version bump, 1 line.
• Review (handwritten): mpp/README.md (24 lines of docs) and
  npm-publish.yml (about 6 net logic lines plus comments). Roughly 30
  handwritten lines, all docs and CI config. No product code changes.

Test plan

No product build needed (version + docs + CI). To confirm the mpp tarball ships
the deprecation README instead of the root one:

cd typescript && pnpm install --frozen-lockfile && pnpm build
pnpm --dir packages/mpp pack --pack-destination /tmp/mpp-pack
tar -tzf /tmp/mpp-pack/*.tgz | grep -E 'package/README.md'
head -3 <(tar -xzOf /tmp/mpp-pack/*.tgz package/README.md)   # should say "deprecated"

Workflow stays valid YAML: python3 -c "import yaml; yaml.safe_load(open('.github/workflows/npm-publish.yml'))".

Reviewer note

One deliberate judgment call, and the place to be skeptical: I did not remove
the @solana/mpp publish job. The #211 security fix lives in @solana/mpp
(server/Charge.ts, server/keyLock.ts) and published mpp latest (0.6.0)
does not have it, so the job is kept, marked deprecated, to cut one final
@solana/mpp@0.7.0 that carries the fix before npm deprecate. If you would
rather strip the job in this PR, the final mpp release has to be cut from
pre-merge main first. Publish sequence is spelled out in the PR description.

Also: the deprecation README ships even though it is not in the package files
array, because npm always includes README.md.

Fable 5 self-review

Verdict: Approve. Small, self-contained, no code paths touched; the version bump
picks up #211 through pay-kit's mpp dist dependency, which is the intended flow.

If this were someone else's PR I would flag two things: (1) keeping the mpp
publish job is a conscious deviation from "remove mpp from publish" and depends
on the maintainer running the final mpp release then npm deprecate in order, so
the sequencing is the real risk, not the code; (2) I did not run a local
pnpm build since nothing compiles differently here, so the tarball-README
assertion in the test plan is reasoned, not executed. CI covers the build.

Fable 5 self-review

[greptile-apps]

Greptile Summary

This PR bumps @solana/pay-kit from 0.4.0 to 0.5.0, adds a deprecation README.md to @solana/mpp, and updates the publish workflow so the mpp tarball ships the new deprecation notice instead of the root pay-kit README.

• Version bump (pay-kit/package.json): single-line change, 0.4.0 → 0.5.0.
• Deprecation notice (mpp/README.md): new file that correctly references the TOCTOU fix from fix(mpp): close concurrent-signature-replay TOCTOU in TS charge verify #211 and provides a migration path; shipped automatically by npm because README.md is always included regardless of the files field.
• Workflow update (npm-publish.yml): removes the temporary cp/rm pattern that previously overwrote the mpp README with the root one; updates the mpp GitHub release body from installation instructions to a migration/deprecation notice; adds inline comments marking the mpp job as deprecated pending its final release and npm deprecate run.

Confidence Score: 5/5

Safe to merge — only a version bump, a new docs file, and a CI comment/copy-step removal with no runtime or build logic changes.

All three changed files are non-code: a one-line version bump, a new markdown deprecation notice, and workflow comments plus the removal of a temporary file-copy pattern. The workflow change is mechanical — it stops overwriting the mpp README before pack, which is exactly what's needed for the new permanent deprecation file to ship. No product code paths are touched.

No files require special attention. The workflow change is straightforward; the sequencing risk (publish mpp, then run npm deprecate) is a process concern spelled out in the PR description rather than a code defect.

Important Files Changed

Filename	Overview
typescript/packages/pay-kit/package.json	Single-line version bump from 0.4.0 to 0.5.0; no other fields changed.
typescript/packages/mpp/README.md	New deprecation notice correctly references the TOCTOU fix from #211 and provides migration steps; uses npm rather than pnpm in the install snippet, unlike the release body.
.github/workflows/npm-publish.yml	Removes the temporary README overwrite for the mpp pack step (now uses the permanent deprecation README), updates the GitHub release body with a migration notice, and adds deprecation comments throughout the mpp job.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[workflow_dispatch\npackage: pay-kit or mpp or all] --> B{package input}

    B -- pay-kit or all --> C[publish-pay-kit job]
    B -- mpp or all --> D[publish job DEPRECATED]

    C --> C1[Build]
    C1 --> C2[cp root README to pay-kit dir]
    C2 --> C3[pnpm pack pay-kit]
    C3 --> C4[rm pay-kit README]
    C4 --> C5[Guards: no workspace deps\ndist artifacts present]
    C5 --> C6[npm publish\n@solana/pay-kit v0.5.0\n+ GitHub release]

    D --> D1[Build]
    D1 --> D2[pnpm pack mpp\nuses mpp/README.md\ndeprecation notice ships]
    D2 --> D3[Guards: no workspace deps\ndist artifacts present]
    D3 --> D4[npm publish\n@solana/mpp v0.7.0 FINAL\nrelease body shows migration]
    D4 --> D5[Manual step:\nnpm deprecate @solana/mpp]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[workflow_dispatch\npackage: pay-kit or mpp or all] --> B{package input}

    B -- pay-kit or all --> C[publish-pay-kit job]
    B -- mpp or all --> D[publish job DEPRECATED]

    C --> C1[Build]
    C1 --> C2[cp root README to pay-kit dir]
    C2 --> C3[pnpm pack pay-kit]
    C3 --> C4[rm pay-kit README]
    C4 --> C5[Guards: no workspace deps\ndist artifacts present]
    C5 --> C6[npm publish\n@solana/pay-kit v0.5.0\n+ GitHub release]

    D --> D1[Build]
    D1 --> D2[pnpm pack mpp\nuses mpp/README.md\ndeprecation notice ships]
    D2 --> D3[Guards: no workspace deps\ndist artifacts present]
    D3 --> D4[npm publish\n@solana/mpp v0.7.0 FINAL\nrelease body shows migration]
    D4 --> D5[Manual step:\nnpm deprecate @solana/mpp]

Loading

_{Reviews (2): Last reviewed commit: "chore(mpp): add deprecation notice to th..." | Re-trigger Greptile}