@sellable/mcp 0.1.26 → 0.1.28

package/README.md

@@ -33,7 +33,7 @@ command.
 For Claude Code and Codex CLI:
 
 ```bash
-npx -y @sellable/install --host all --token skt_live_your_token_here --workspace-id your_workspace_id
+npx -y @sellable/install@latest --host all --token skt_live_your_token_here --workspace-id your_workspace_id
 ```
 
 Agent-readable install instructions are available at:
@@ -52,6 +52,24 @@ sh /tmp/sellable-install.sh
 Phase 112 v1 uses package stdio MCP through `@sellable/mcp`. Hosted HTTP
 MCP is a future/advanced mode until the hosted endpoint exists.
 
+Package-mode installs launch `@sellable/mcp@latest`, so each fresh host MCP
+start resolves the newest stable npm release. The MCP server also runs a cached
+startup/auth update check and tells the agent to run
+`npx -y @sellable/install@latest` when the installed runtime is behind npm.
+
+### Publishing `@sellable/mcp`
+
+Publish from the repo root with:
+
+```bash
+npm run mcp:publish
+```
+
+The script loads `.env` and `prod.env`, builds `mcp/sellable`, verifies npm auth,
+and publishes with a temporary npm config file. Prefer `NPM_TOKEN=<npm token>` in
+`prod.env`; `NODE_AUTH_TOKEN`, `SELLABLE_NPM_TOKEN`, and `NPM_PUBLISH_TOKEN` are
+also supported.
+
 ### 2. Generate API Token
 
 1. Go to https://app.sellable.dev/settings
@@ -63,7 +81,7 @@ MCP is a future/advanced mode until the hosted endpoint exists.
 Install MCP server:
 
 ```bash
-claude mcp add --transport stdio sellable -- npx -y @sellable/mcp
+claude mcp add --transport stdio sellable -- npx -y @sellable/mcp@latest
 ```
 
 Create auth config at `~/.sellable/config.json`:
@@ -83,14 +101,14 @@ The token is provided when you generate it. Use `list_workspaces` +
 For customer/package installs, use the public installer:
 
 ```bash
-npx -y @sellable/install@0.1.26 --host codex --token skt_live_your_token_here --workspace-id your_workspace_id
+npx -y @sellable/install@latest --host codex --token skt_live_your_token_here --workspace-id your_workspace_id
 ```
 
 If you already have `~/.sellable/config.json`, rerun/verify without rewriting
 auth:
 
 ```bash
-npx -y @sellable/install@0.1.26 --host codex
+npx -y @sellable/install@latest --host codex
 sellable --verify-only --host codex
 ```
 

package/dist/server.js

@@ -1,7 +1,7 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
-import { getSkillByName, listSkills, stripFrontmatter } from "./skills.js";
+import { getSkillByName, listSkills } from "./skills.js";
 import { authToolDefinitions, getAuthStatus } from "./tools/auth.js";
 import { blueprintCommitToolDefinitions, handleAddColumn, handleCommitBlueprint, } from "./tools/blueprint-commit.js";
 import { bootstrapCreateCampaign, bootstrapToolDefinitions, } from "./tools/bootstrap.js";
@@ -29,6 +29,7 @@ import { attachRecommendedSequence, attachSequence, createWorkflowTable, sequenc
 import { listTables, tableToolDefinitions } from "./tools/tables.js";
 import { handleVerifyTableRow, verifyRowToolDefinitions, } from "./tools/verify-row.js";
 import { addTeammate, createWorkspace, getActiveWorkspace, listWorkspaces, setActiveWorkspace, workspaceToolDefinitions, } from "./tools/workspaces.js";
+import { checkForUpdates, logUpdateNotice } from "./update-check.js";
 const server = new Server({
     name: "sellable-mcp",
     version: "1.0.0",
@@ -67,6 +68,35 @@ const allTools = [
     ...blueprintCommitToolDefinitions,
     ...verifyRowToolDefinitions,
 ];
+function parseOptionalNumber(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value === "string" && value.trim() !== "") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+function formatSubskillPromptText(result) {
+    const header = result.chunkCount && result.chunkCount > 1
+        ? [
+            `# ${result.name} prompt chunk ${result.chunkIndex} of ${result.chunkCount}`,
+            "",
+            `Prompt length: ${result.promptLength} characters.`,
+            result.chunkingInstructions ?? "",
+            "",
+        ].join("\n")
+        : "";
+    const footer = result.hasMore && result.nextOffset !== null
+        ? [
+            "",
+            "---",
+            `Continue with offset ${result.nextOffset} and limit ${result.limit}.`,
+        ].join("\n")
+        : "";
+    return `${header}${result.prompt}${footer}`;
+}
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: allTools,
 }));
@@ -447,16 +477,29 @@ server.setRequestHandler(ListPromptsRequestSchema, async () => ({
     prompts: listSkills("public").map((skill) => ({
         name: skill.name,
         description: skill.description,
+        arguments: [
+            {
+                name: "offset",
+                description: "Optional character offset for chunked prompt reads.",
+                required: false,
+            },
+            {
+                name: "limit",
+                description: "Optional max characters to return for chunked prompt reads.",
+                required: false,
+            },
+        ],
     })),
 }));
 // Get prompt content
 server.setRequestHandler(GetPromptRequestSchema, async (request) => {
     const { name } = request.params;
+    const args = request.params.arguments ?? {};
     const skill = getSkillByName(name);
     if (!skill) {
         throw new Error(`Unknown prompt: ${name}`);
     }
-    const content = stripFrontmatter(skill.content);
+    const content = getSubskillPrompt(name, parseOptionalNumber(args.offset), parseOptionalNumber(args.limit));
     return {
         description: skill.description,
         messages: [
@@ -464,7 +507,7 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
                 role: "user",
                 content: {
                     type: "text",
-                    text: content,
+                    text: formatSubskillPromptText(content),
                 },
             },
         ],
@@ -473,6 +516,11 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
 async function main() {
     const startTime = Date.now();
     console.error(`[sellable-mcp] pid=${process.pid} starting...`);
+    void checkForUpdates()
+        .then(logUpdateNotice)
+        .catch(() => {
+        // Update checks are advisory and must never block MCP startup.
+    });
     const transport = new StdioServerTransport();
     // Exit cleanly when parent disconnects stdin (Claude Code closed/reconnected)
     process.stdin.on("end", () => {

package/dist/tools/auth.d.ts

@@ -1,3 +1,4 @@
+import { type SellableUpdateStatus } from "../update-check.js";
 export type AuthStatus = {
     ok: boolean;
     configPath: string;
@@ -10,6 +11,7 @@ export type AuthStatus = {
     checkedAt: string;
     /** Short message the LLM MUST show the user after auth succeeds. */
     _userNotice: string | null;
+    update: SellableUpdateStatus | null;
     error: null | {
         type: "config" | "auth" | "workspace" | "api";
         status?: number;

package/dist/tools/auth.js

@@ -1,14 +1,28 @@
 import { getApi, SellableApiError } from "../api.js";
 import { getConfig, getConfigPath } from "../auth.js";
+import { checkForUpdates } from "../update-check.js";
 function maskToken(token) {
     if (token.length <= 10)
         return `${token.slice(0, 4)}...`;
     return `${token.slice(0, 8)}...${token.slice(-2)}`;
 }
+async function getUpdateStatus() {
+    try {
+        return await checkForUpdates();
+    }
+    catch {
+        return null;
+    }
+}
+function appendUpdateNotice(notice, update) {
+    if (!update?._userNotice)
+        return notice;
+    return notice ? `${notice}\n${update._userNotice}` : update._userNotice;
+}
 export const authToolDefinitions = [
     {
         name: "get_auth_status",
-        description: "Verify Sellable authentication early. Call this before any campaign work. Returns ok=false with clear guidance when the token is missing, revoked, or the active workspace is not set. IMPORTANT: When auth succeeds, ALWAYS tell the user the _userNotice message so they know which workspace is active.",
+        description: "Verify Sellable authentication early. Call this before any campaign work. Also performs a cached Sellable package update check. Returns ok=false with clear guidance when the token is missing, revoked, or the active workspace is not set. IMPORTANT: When auth succeeds, ALWAYS tell the user the _userNotice message so they know which workspace is active and whether an update is available.",
         inputSchema: {
             type: "object",
             properties: {},
@@ -20,6 +34,7 @@ export const authToolDefinitions = [
 export async function getAuthStatus() {
     const configPath = getConfigPath();
     const checkedAt = new Date().toISOString();
+    const update = await getUpdateStatus();
     const base = {
         ok: false,
         configPath,
@@ -29,7 +44,8 @@ export async function getAuthStatus() {
         activeWorkspaceName: null,
         tokenPrefix: null,
         workspacesCount: null,
-        _userNotice: null,
+        _userNotice: appendUpdateNotice(null, update),
+        update,
         checkedAt,
     };
     try {
@@ -87,7 +103,8 @@ export async function getAuthStatus() {
             activeWorkspaceName: workspaceName,
             tokenPrefix: maskToken(config.token),
             workspacesCount: workspaces.length,
-            _userNotice: notice,
+            _userNotice: appendUpdateNotice(notice, update),
+            update,
             checkedAt,
             error: null,
         };

package/dist/tools/bootstrap.d.ts

@@ -9,7 +9,7 @@ type BootstrapCreateCampaignInput = {
     refreshContext?: boolean;
 };
 type BootstrapCheck = {
-    key: "auth" | "framework" | "resume_context" | "subskill_catalog" | "create_campaign_subskill";
+    key: "auth" | "update" | "framework" | "resume_context" | "subskill_catalog" | "create_campaign_subskill";
     ok: boolean;
     blocking: boolean;
     detail: string;

package/dist/tools/bootstrap.js

@@ -10,6 +10,9 @@ function toGuidance(check, message) {
     if (check === "auth") {
         return "Run get_auth_status and fix auth/workspace setup before continuing.";
     }
+    if (check === "update") {
+        return "Run npx -y @sellable/install@latest, then restart Claude Code/Codex so Sellable reloads.";
+    }
     if (check === "framework") {
         return "Fix framework files and rerun bootstrap_create_campaign.";
     }
@@ -101,6 +104,22 @@ export async function bootstrapCreateCampaign(input = {}) {
         if (!ok) {
             pushBlockingError(blockingErrors, "auth", authCheck.status.error?.message || "Authentication check failed.");
         }
+        const update = authCheck.status.update;
+        if (update && !update.disabled) {
+            requiredChecks.push({
+                key: "update",
+                ok: !update.blocking,
+                blocking: update.blocking,
+                detail: update.updateAvailable
+                    ? update._userNotice || "A newer Sellable MCP package is available."
+                    : update.mcp.latestVersion
+                        ? `Sellable MCP is current (${update.mcp.currentVersion ?? "unknown"}).`
+                        : "Sellable MCP update check completed without latest-version data.",
+            });
+            if (update.blocking) {
+                pushBlockingError(blockingErrors, "update", update._userNotice || "Sellable MCP update required.");
+            }
+        }
     }
     catch (error) {
         const message = toErrorMessage(error);
@@ -215,10 +234,10 @@ export async function bootstrapCreateCampaign(input = {}) {
         : "";
     const nextStep = safeToProceed
         ? resumeDetected
-            ? `Bootstrap complete.${workspaceNotice} Resume using campaign context, then load ${createCampaignSubskill?.name ?? "create-campaign"} instructions with get_subskill_prompt({ subskillName: "${createCampaignSubskill?.name ?? "create-campaign"}" }).`
+            ? `Bootstrap complete.${workspaceNotice} Resume using campaign context, then load ${createCampaignSubskill?.name ?? "create-campaign"} instructions with get_subskill_prompt({ subskillName: "${createCampaignSubskill?.name ?? "create-campaign"}" }); if the response has hasMore=true, continue with nextOffset until hasMore=false.`
             : flowVersion === "v2"
-                ? `Bootstrap complete.${workspaceNotice} Load create-campaign-v2 instructions with get_subskill_prompt({ subskillName: "create-campaign-v2" }), then start with the create-campaign-brief interview stage. Do not call create_campaign until the v2 approval gate returns approve.`
-                : `Bootstrap complete.${workspaceNotice} Load ${createCampaignSubskill?.name ?? "create-campaign"} instructions with get_subskill_prompt({ subskillName: "${createCampaignSubskill?.name ?? "create-campaign"}" }) and follow that flow before calling create_campaign.`
+                ? `Bootstrap complete.${workspaceNotice} Load create-campaign-v2 instructions with get_subskill_prompt({ subskillName: "create-campaign-v2" }); if the response has hasMore=true, continue with nextOffset until hasMore=false. Then start with the create-campaign-brief interview stage. Do not call create_campaign until the v2 approval gate returns approve.`
+                : `Bootstrap complete.${workspaceNotice} Load ${createCampaignSubskill?.name ?? "create-campaign"} instructions with get_subskill_prompt({ subskillName: "${createCampaignSubskill?.name ?? "create-campaign"}" }); if the response has hasMore=true, continue with nextOffset until hasMore=false. Follow that flow before calling create_campaign.`
         : "Bootstrap incomplete. Resolve blockingErrors and rerun bootstrap_create_campaign before provider/search/import tools.";
     // Strip prompt body from createCampaignSubskill — it's loaded via the host
     // skill prompt. Only return metadata to save context tokens.

package/dist/tools/leads.js

@@ -2205,10 +2205,18 @@ export async function confirmLeadList(input) {
         ...(shouldSetCurrentStep ? { currentStep: effectiveCurrentStep } : {}),
     });
     const campaignTableId = importResult.workflowTableId ?? importResult.campaignTableId;
-    if (campaignTableId) {
+    // Persist currentStep if the caller asked for it. Do NOT touch
+    // selectedLeadListId here: the campaign table id is already saved to
+    // CampaignOffer.workflowTableId by /api/v3/campaign-builder/import-leads,
+    // and selectedLeadListId must remain pointing at the source lead list
+    // (config.type === "lead_list") so the UI's Continue handler — which feeds
+    // selectedLeadListId back into /api/v3/campaign-builder/import-leads as
+    // sourceLeadListId — can find a valid lead list. Overwriting it with the
+    // campaign table id makes that endpoint 404 with "Lead list not found"
+    // and silently breaks the Leads → Filter Continue button.
+    if (shouldSetCurrentStep) {
         await api.put(`/api/v2/campaign-offers/${campaignOfferId}`, {
-            selectedLeadListId: campaignTableId,
-            ...(shouldSetCurrentStep ? { currentStep: effectiveCurrentStep } : {}),
+            currentStep: effectiveCurrentStep,
         });
     }
     return {

package/dist/tools/prompts.d.ts

@@ -20,6 +20,9 @@ export interface SubskillPromptResponse {
     limit?: number;
     hasMore?: boolean;
     nextOffset?: number | null;
+    chunkIndex?: number;
+    chunkCount?: number;
+    chunkingInstructions?: string;
 }
 export interface ListSubskillPromptsResponse {
     total: number;
@@ -44,6 +47,8 @@ export interface CompleteSenderResearchInput {
     credibilitySignalsFound?: number;
     notes?: string;
 }
+export declare const DEFAULT_SUBSKILL_PROMPT_CHUNK_CHARS = 24000;
+export declare const MAX_SUBSKILL_PROMPT_CHUNK_CHARS = 24000;
 export declare const promptToolDefinitions: ({
     name: string;
     description: string;
@@ -65,6 +70,7 @@ export declare const promptToolDefinitions: ({
         required: never[];
         additionalProperties?: undefined;
     };
+    _meta?: undefined;
 } | {
     name: string;
     description: string;
@@ -95,9 +101,13 @@ export declare const promptToolDefinitions: ({
         required: never[];
         additionalProperties: boolean;
     };
+    _meta?: undefined;
 } | {
     name: string;
     description: string;
+    _meta: {
+        "anthropic/maxResultSizeChars": number;
+    };
     inputSchema: {
         type: string;
         properties: {
@@ -158,6 +168,7 @@ export declare const promptToolDefinitions: ({
         required: string[];
         additionalProperties: boolean;
     };
+    _meta?: undefined;
 } | {
     name: string;
     description: string;
@@ -195,6 +206,7 @@ export declare const promptToolDefinitions: ({
         additionalProperties: boolean;
         required?: undefined;
     };
+    _meta?: undefined;
 })[];
 export declare function getMessagePrompt(): Promise<PromptResponse>;
 export declare function listSubskillPrompts(limit?: number, includePublic?: boolean, includeInternal?: boolean): ListSubskillPromptsResponse;

package/dist/tools/prompts.js

@@ -1,6 +1,8 @@
 import { getApi } from "../api.js";
 import { getSkillByName, listSkills, stripFrontmatter } from "../skills.js";
 import { markCreateCampaignPromptLoaded, markResearchPromptLoaded, markSenderResearchCompleted, } from "./flow-preflight.js";
+export const DEFAULT_SUBSKILL_PROMPT_CHUNK_CHARS = 24_000;
+export const MAX_SUBSKILL_PROMPT_CHUNK_CHARS = 24_000;
 export const promptToolDefinitions = [
     {
         name: "get_message_prompt",
@@ -36,7 +38,10 @@ export const promptToolDefinitions = [
     },
     {
         name: "get_subskill_prompt",
-        description: "Load a Sellable subskill prompt by name. Internal subskills are not listed in prompts/list; use search_subskill_prompts when you are unsure of the exact name.",
+        description: "Load a Sellable subskill prompt by name. Large prompts are returned in portable chunks by default; continue with nextOffset until hasMore is false. Internal subskills are not listed in prompts/list; use search_subskill_prompts when you are unsure of the exact name.",
+        _meta: {
+            "anthropic/maxResultSizeChars": 200_000,
+        },
         inputSchema: {
             type: "object",
             properties: {
@@ -50,7 +55,7 @@ export const promptToolDefinitions = [
                 },
                 limit: {
                     type: "number",
-                    description: "Optional max characters to return for chunked prompt reads. Use a bounded value for very large prompts.",
+                    description: `Optional max characters to return for chunked prompt reads. Defaults to ${DEFAULT_SUBSKILL_PROMPT_CHUNK_CHARS} for large prompts and is capped at ${MAX_SUBSKILL_PROMPT_CHUNK_CHARS}.`,
                 },
             },
             required: ["subskillName"],
@@ -141,11 +146,7 @@ export function listSubskillPrompts(limit, includePublic, includeInternal) {
         })),
     };
 }
-export function getSubskillPrompt(subskillName, offset, limit) {
-    const skill = getSkillByName(subskillName);
-    if (!skill) {
-        throw new Error(`Unknown subskill prompt: ${subskillName}`);
-    }
+function markSubskillPromptLoaded(subskillName) {
     if (subskillName === "create-campaign") {
         markCreateCampaignPromptLoaded();
     }
@@ -158,17 +159,37 @@ export function getSubskillPrompt(subskillName, offset, limit) {
     if (subskillName === "research-prospect") {
         markResearchPromptLoaded("prospect", "research-prospect");
     }
+}
+export function getSubskillPrompt(subskillName, offset, limit) {
+    const skill = getSkillByName(subskillName);
+    if (!skill) {
+        throw new Error(`Unknown subskill prompt: ${subskillName}`);
+    }
+    markSubskillPromptLoaded(subskillName);
     const fullPrompt = stripFrontmatter(skill.content);
     const safeOffset = Math.min(Math.max(Number.isFinite(offset) ? Math.floor(offset ?? 0) : 0, 0), fullPrompt.length);
-    const safeLimit = Number.isFinite(limit) && limit !== undefined
+    const requestedLimit = Number.isFinite(limit) && limit !== undefined
         ? Math.max(Math.floor(limit), 1)
         : null;
+    const defaultChunkLimit = fullPrompt.length > DEFAULT_SUBSKILL_PROMPT_CHUNK_CHARS
+        ? DEFAULT_SUBSKILL_PROMPT_CHUNK_CHARS
+        : null;
+    const safeLimit = requestedLimit === null
+        ? defaultChunkLimit
+        : Math.min(requestedLimit, MAX_SUBSKILL_PROMPT_CHUNK_CHARS);
     const prompt = safeLimit === null
         ? fullPrompt
         : fullPrompt.slice(safeOffset, safeOffset + safeLimit);
     const nextOffset = safeLimit === null
         ? null
         : Math.min(safeOffset + safeLimit, fullPrompt.length);
+    const hasMore = nextOffset !== null && nextOffset < fullPrompt.length;
+    const chunkCount = safeLimit === null
+        ? 1
+        : Math.max(Math.ceil(fullPrompt.length / safeLimit), 1);
+    const chunkIndex = safeLimit === null
+        ? 1
+        : Math.min(Math.floor(safeOffset / safeLimit) + 1, chunkCount);
     return {
         name: skill.name,
         description: skill.description,
@@ -177,8 +198,13 @@ export function getSubskillPrompt(subskillName, offset, limit) {
         promptLength: fullPrompt.length,
         offset: safeOffset,
         limit: safeLimit ?? undefined,
-        hasMore: nextOffset !== null && nextOffset < fullPrompt.length,
-        nextOffset: nextOffset !== null && nextOffset < fullPrompt.length ? nextOffset : null,
+        hasMore,
+        nextOffset: hasMore ? nextOffset : null,
+        chunkIndex,
+        chunkCount,
+        chunkingInstructions: hasMore
+            ? `Continue this same prompt load with get_subskill_prompt({ subskillName: "${skill.name}", offset: ${nextOffset}, limit: ${safeLimit} }) until hasMore is false. Treat all chunks as one prompt load; do not use saved local tool-output files or machine-specific paths.`
+            : undefined,
     };
 }
 export function completeSenderResearch(input) {

package/dist/update-check.d.ts

@@ -0,0 +1,25 @@
+export type PackageUpdateStatus = {
+    packageName: string;
+    currentVersion: string | null;
+    latestVersion: string | null;
+    outdated: boolean;
+    error?: string;
+};
+export type SellableUpdateStatus = {
+    checkedAt: string;
+    cachePath: string;
+    fromCache: boolean;
+    disabled: boolean;
+    mcp: PackageUpdateStatus;
+    installer: PackageUpdateStatus;
+    updateAvailable: boolean;
+    blocking: boolean;
+    guidance: string | null;
+    _userNotice: string | null;
+};
+export declare function checkForUpdates(options?: {
+    force?: boolean;
+    timeoutMs?: number;
+    ttlMs?: number;
+}): Promise<SellableUpdateStatus>;
+export declare function logUpdateNotice(status: SellableUpdateStatus): void;

package/dist/update-check.js

@@ -0,0 +1,210 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+const MCP_PACKAGE = "@sellable/mcp";
+const INSTALL_PACKAGE = "@sellable/install";
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_TIMEOUT_MS = 1500;
+function cachePath() {
+    return path.join(os.homedir(), ".sellable", "update-check.json");
+}
+function readCurrentVersion() {
+    const entrypointDir = process.argv[1]
+        ? path.dirname(path.resolve(process.argv[1]))
+        : process.cwd();
+    const candidates = [
+        path.resolve(entrypointDir, "..", "package.json"),
+        path.resolve(process.cwd(), "mcp/sellable/package.json"),
+    ];
+    for (const pkgPath of candidates) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            if (pkg.name === MCP_PACKAGE && typeof pkg.version === "string") {
+                return pkg.version;
+            }
+        }
+        catch {
+            // Keep looking; version detection is advisory only.
+        }
+    }
+    return null;
+}
+function registryPackagePath(packageName) {
+    return encodeURIComponent(packageName);
+}
+async function fetchLatestVersion(packageName, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(`https://registry.npmjs.org/${registryPackagePath(packageName)}/latest`, {
+            signal: controller.signal,
+            headers: {
+                Accept: "application/json",
+                "User-Agent": "sellable-mcp-update-check",
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`npm registry returned ${response.status}`);
+        }
+        const body = (await response.json());
+        if (typeof body.version !== "string" || !body.version) {
+            throw new Error("npm registry response did not include a version");
+        }
+        return body.version;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function parseVersion(version) {
+    if (!version)
+        return null;
+    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/);
+    if (!match)
+        return null;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isVersionOutdated(currentVersion, latestVersion) {
+    const current = parseVersion(currentVersion);
+    const latest = parseVersion(latestVersion);
+    if (!current || !latest)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (current[i] < latest[i])
+            return true;
+        if (current[i] > latest[i])
+            return false;
+    }
+    return false;
+}
+function readCache(ttlMs) {
+    const file = cachePath();
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!raw.checkedAtMs || Date.now() - raw.checkedAtMs > ttlMs)
+            return null;
+        return {
+            ...raw,
+            cachePath: file,
+            fromCache: true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(status) {
+    const file = cachePath();
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        const { fromCache: _fromCache, ...cacheableStatus } = status;
+        const cache = {
+            ...cacheableStatus,
+            cachePath: file,
+            checkedAtMs: Date.now(),
+        };
+        fs.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, {
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Update checks must never break MCP startup or tool execution.
+    }
+}
+function disabledStatus(currentVersion) {
+    return {
+        checkedAt: new Date().toISOString(),
+        cachePath: cachePath(),
+        fromCache: false,
+        disabled: true,
+        mcp: {
+            packageName: MCP_PACKAGE,
+            currentVersion,
+            latestVersion: null,
+            outdated: false,
+        },
+        installer: {
+            packageName: INSTALL_PACKAGE,
+            currentVersion: null,
+            latestVersion: null,
+            outdated: false,
+        },
+        updateAvailable: false,
+        blocking: false,
+        guidance: null,
+        _userNotice: null,
+    };
+}
+function buildNotice(mcp, installer) {
+    if (!mcp.outdated)
+        return null;
+    const versions = mcp.currentVersion && mcp.latestVersion
+        ? `${mcp.currentVersion} -> ${mcp.latestVersion}`
+        : "a newer version is available";
+    const installerVersion = installer.latestVersion
+        ? ` The latest installer is ${installer.latestVersion}.`
+        : "";
+    return `Sellable update available: ${versions}. Run: npx -y @sellable/install@latest.${installerVersion}`;
+}
+export async function checkForUpdates(options) {
+    const currentVersion = readCurrentVersion();
+    const ttlMs = options?.ttlMs ??
+        (Number(process.env.SELLABLE_UPDATE_CHECK_TTL_MS || "") || DEFAULT_TTL_MS);
+    const timeoutMs = options?.timeoutMs ??
+        (Number(process.env.SELLABLE_UPDATE_CHECK_TIMEOUT_MS || "") ||
+            DEFAULT_TIMEOUT_MS);
+    if (process.env.SELLABLE_UPDATE_CHECK_DISABLED === "1") {
+        return disabledStatus(currentVersion);
+    }
+    if (!options?.force) {
+        const cached = readCache(ttlMs);
+        if (cached)
+            return cached;
+    }
+    const [mcpResult, installerResult] = await Promise.allSettled([
+        fetchLatestVersion(MCP_PACKAGE, timeoutMs),
+        fetchLatestVersion(INSTALL_PACKAGE, timeoutMs),
+    ]);
+    const mcpLatest = mcpResult.status === "fulfilled" ? mcpResult.value : null;
+    const installerLatest = installerResult.status === "fulfilled" ? installerResult.value : null;
+    const mcp = {
+        packageName: MCP_PACKAGE,
+        currentVersion,
+        latestVersion: mcpLatest,
+        outdated: isVersionOutdated(currentVersion, mcpLatest),
+        ...(mcpResult.status === "rejected"
+            ? { error: mcpResult.reason?.message || String(mcpResult.reason) }
+            : {}),
+    };
+    const installer = {
+        packageName: INSTALL_PACKAGE,
+        currentVersion: null,
+        latestVersion: installerLatest,
+        outdated: false,
+        ...(installerResult.status === "rejected"
+            ? {
+                error: installerResult.reason?.message || String(installerResult.reason),
+            }
+            : {}),
+    };
+    const notice = buildNotice(mcp, installer);
+    const status = {
+        checkedAt: new Date().toISOString(),
+        cachePath: cachePath(),
+        fromCache: false,
+        disabled: false,
+        mcp,
+        installer,
+        updateAvailable: mcp.outdated,
+        blocking: false,
+        guidance: notice ? "Run npx -y @sellable/install@latest" : null,
+        _userNotice: notice,
+    };
+    writeCache(status);
+    return status;
+}
+export function logUpdateNotice(status) {
+    if (status._userNotice) {
+        console.error(`[sellable-mcp] ${status._userNotice}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "type": "module",
   "description": "Sellable MCP server for Claude Code and Codex campaign workflows",
   "main": "dist/index.js",

package/skills/create-campaign-brief/references/examples/briefs/clover.md

@@ -1,6 +1,6 @@
 # Clover Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 4
 

package/skills/create-campaign-brief/references/examples/briefs/galley.md

@@ -1,6 +1,6 @@
 # Galley Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 5
 

package/skills/create-campaign-brief/references/examples/briefs/gelee.md

@@ -1,6 +1,6 @@
 # Gelee Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 1
 

package/skills/create-campaign-brief/references/examples/briefs/hey-digital.md

@@ -1,6 +1,6 @@
 # Hey Digital Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 4
 

package/skills/create-campaign-brief/references/examples/briefs/persona.md

@@ -1,6 +1,6 @@
 # Persona Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 3
 

package/skills/create-campaign-brief/references/examples/briefs/revvix.md

@@ -1,6 +1,6 @@
 # Revvix Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 8
 

package/skills/create-campaign-brief/references/examples/briefs/sellable-dev.md

@@ -1,6 +1,6 @@
 # sellable.dev Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 304
 

package/skills/create-campaign-brief/references/examples/briefs/superposition.md

@@ -1,6 +1,6 @@
 # superposition Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 5
 

package/skills/create-campaign-brief/references/examples/briefs/superpower.md

@@ -1,6 +1,6 @@
 # Superpower Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 3
 

package/skills/create-campaign-brief/references/examples/briefs/westpark-villas.md

@@ -1,6 +1,6 @@
 # westpark villas Campaign Brief + Rubric Archive
 
-Source: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Source: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
 Campaigns captured: 26
 

package/skills/create-campaign-brief/references/phase75-canonical-brief-template.md

@@ -167,7 +167,7 @@ Add only when the campaign truly needs them:
 
 Reference:
 
-- [75-MESSAGE-VARIANT-GENERATION-FLOW.md](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-MESSAGE-VARIANT-GENERATION-FLOW.md)
+- `75-MESSAGE-VARIANT-GENERATION-FLOW.md` in the Phase 75 planning archive.
 
 ## Section Rules
 

package/skills/create-campaign-brief/references/phase75-good-brief-and-messaging-examples.md

@@ -1,10 +1,10 @@
 # Phase 75 Live Brief + Messaging Example Bank
 
-Source of truth: [75-LIVE-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-LIVE-CAMPAIGN-CORPUS.json)
+Source of truth: Phase 75 live campaign corpus used to generate this prompt reference.
 
-Full archive of client campaign briefs: [75-ALL-CLIENT-CAMPAIGN-CORPUS.json](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ALL-CLIENT-CAMPAIGN-CORPUS.json)
+Full archive of client campaign briefs: Phase 75 all-client campaign corpus, copied into this prompt reference archive.
 
-Direct copied archive of full campaign brief content + rubrics: [brief-rubric-archive/INDEX.md](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/brief-rubric-archive/INDEX.md)
+Direct copied archive of full campaign brief content + rubrics: `brief-rubric-archive/INDEX.md` in the Phase 75 planning archive.
 
 This file distills the strongest live campaign briefs currently stored in production. The runtime gold set should stay narrow: active clients only, plus the one Hey Digital campaign that clearly performed and still teaches useful structure. The goal is not to preserve every brief shape forever. The goal is to preserve the patterns that consistently show up in the briefs that are actually usable, persuasive, and close to what Sellable has been shipping manually for clients.
 
@@ -20,7 +20,7 @@ Important note:
 
 Runtime gold pack:
 
-- [75-ACTIVE-RUNTIME-MESSAGE-PACK.md](/Users/christianreyes/dev/dittto-fresh/web/.planning/phases/75-canonical-campaign-brief-and-copy-calibration/75-ACTIVE-RUNTIME-MESSAGE-PACK.md)
+- `75-ACTIVE-RUNTIME-MESSAGE-PACK.md` in the Phase 75 planning archive.
 
 ## Winning Campaigns In Scope
 

package/skills/create-campaign-v2/SKILL.md

@@ -118,6 +118,8 @@ Validated draft directory:
   loading, runbooks, local skill files, skill versions, or "Sellable token".
   "Quick question panel" is only acceptable when explaining a Codex/Claude setup
   blocker.
+- Before campaign mint, do not call `check_rubric`; Phase 84 only writes and
+  validates draft artifacts.
 - Never narrate local draft housekeeping to the user. If you create directories,
   save drafts, write artifacts, or persist intermediate state, translate it into
   the campaign benefit: consistent brief, approved lead source, reviewed message,
@@ -394,6 +396,9 @@ should test for this campaign. Those can run in parallel and usually take
 - Before the user chooses `approve`, the mutating live-campaign tools are
   forbidden: `create_campaign`, `save_rubrics`, `import_leads`,
   `confirm_lead_list`, `update_campaign`, `queue_cells`, and `start_campaign`.
+- During pre-approval validation, do not call `check_rubric`; use the
+  campaignless lead-filter artifacts and only use campaign-backed scoring after
+  the approval flow allows it.
 - Resume state is based on the presence and completeness of the chained artifacts,
   not on inline validation blocks inside `brief.md`.
 - Preserve the Phase 83 thesis. Do not rewrite product, ICP, offer, or message
@@ -482,7 +487,9 @@ Sellable lead lists in the main three-option first batch; support them through
 custom/freeform input. If the user pastes up to 100 LinkedIn profile URLs or
 company domains, normalize the paste into a temporary local CSV and continue
 through the matching CSV preview path. Mixed, ambiguous, malformed, or oversized
-pastes should ask for a real CSV file instead of guessing.
+pastes should ask for a real CSV file instead of guessing. Uploaded CSV support
+is larger than paste support: LinkedIn profile CSVs can contain up to 7,500
+rows; domain CSVs can contain up to 7,500 rows but only 1,000 unique domains.
 
 Avoid internal wording like `Which proof points should the message be allowed
 to lean on?` because it describes the artifact, not the founder decision.
@@ -555,6 +562,10 @@ usable leads`.
 - supplied LinkedIn profile CSVs call `load_csv_linkedin_leads` in preview mode
   only before approval; do not pass `confirmed: true`, `campaignOfferId`,
   `currentStep`, `leadListId`, `sourceLeadListId`, or provider-import params
+  during the preview. After approval, this branch is a two-stage batch path:
+  materialize the full supplied CSV into a Sellable lead-list table first, then
+  use the returned `leadListId` as `sourceLeadListId` for the bounded campaign
+  review import
 - supplied company/domain CSVs call `load_csv_domains`; pre-approval
   confirmation is allowed only without `campaignOfferId` or `currentStep` and
   only to produce a standalone `domainFilterId` for campaignless
@@ -766,12 +777,13 @@ Run the `generate-messages` skill in caller-declared `DRY MODE`. Its SKILL.md
 holds the full drafting contract (retrieval, proof inventory, candidates,
 finalizer pass, voice rules, safety). This step only covers orchestration.
 This is not optional: before any write to `message-validation.md`,
-`message-review.md`, `approval-packet.md`, or a commit-gate question, the current run must load the
-full `generate-messages` prompt. In hosted/from-scratch runs, load it with
-chunked `get_subskill_prompt({ subskillName: "generate-messages", offset,
-limit })` calls so every tool result stays small enough for the streamed
-harness. Start with `offset: 0, limit: 12000`, then keep calling with
-`offset: nextOffset` until `hasMore` is false.
+`message-review.md`, `approval-packet.md`, or a commit-gate question, the
+current run must load the full `generate-messages` prompt. In hosted/from-
+scratch runs, load it with chunked `get_subskill_prompt({ subskillName:
+"generate-messages", offset, limit })` calls so every tool result stays small
+enough for the streamed harness. Start with `offset: 0`; the MCP will apply a
+portable default limit when omitted. Keep calling with `offset: nextOffset`
+until `hasMore` is false.
 In Codex-hosted runs, this is a quality gate, not just provenance: if the
 model cannot retrieve the complete prompt or cannot follow the required
 gold-standard deliberation flow, stop at `message-review` and ask for
@@ -1648,9 +1660,9 @@ Message` column's http_request writes those cells via the cascade.
 Load `core/auto-execute.yaml` exactly once at the start of Step 13. All
 subsequent steps read the already-parsed config. Do not re-load mid-run.
 Load each subskill prompt (`create-campaign-v2`, `research-sender`,
-`generate-messages`) at most once per run — if a tool result already
-told you to load a prompt, load it and remember; do not re-request the
-same prompt later.
+`generate-messages`) at most once per run. A multi-call chunk sequence counts
+as one load. If a tool result already told you to load a prompt, load all
+chunks once and remember; do not restart the same prompt from offset 0 later.
 
 After every `update_campaign({ currentStep: ... })` in the tail, narrate
 what changed and orient the user to what the watch link will show next —
@@ -1707,10 +1719,12 @@ atomic mint).
    `import_leads({ campaignOfferId, targetLeadCount: importLimit })`.
    If a manifest exists, branch by `sourceType`:
    - `supplied-linkedin-profiles`: revalidate file metadata and confirmation
-     token, confirm `load_csv_linkedin_leads` only after approval, persist the
-     returned `leadListId`, then call
-     `confirm_lead_list({ sourceLeadListId: leadListId, targetLeadCount:
-importLimit })`.
+     token, confirm `load_csv_linkedin_leads` only after approval to batch the
+     supplied CSV into a Sellable lead list, persist the returned `leadListId`,
+     then call `confirm_lead_list({ sourceLeadListId: leadListId,
+targetLeadCount: importLimit })`. Do not call `import_leads` for this
+     branch; the lead list is the source, and `confirm_lead_list` imports the
+     bounded review batch into the campaign table.
    - `existing-lead-list`: revalidate that the lead list still exists in the
      same workspace, reuse it as `sourceLeadListId`, then call
      `confirm_lead_list({ sourceLeadListId, targetLeadCount: importLimit })`.

package/skills/create-campaign-v2/core/flow.v2.json

@@ -345,7 +345,7 @@
       },
       "optionalRequiredArtifacts": ["lead-source-intake.json"],
       "toolRules": {
-        "suppliedLinkedinProfiles": "Preview only before approval: call load_csv_linkedin_leads without confirmed, campaignOfferId, currentStep, leadListId, sourceLeadListId, or provider-import parameters; skip provider discovery.",
+        "suppliedLinkedinProfiles": "Preview only before approval: call load_csv_linkedin_leads without confirmed, campaignOfferId, currentStep, leadListId, sourceLeadListId, or provider-import parameters; skip provider discovery. After approval, batch/materialize the supplied CSV into a Sellable lead list first, then use the returned leadListId as sourceLeadListId for confirm_lead_list.",
         "suppliedDomains": "May confirm load_csv_domains before approval only without campaignOfferId/currentStep to produce a standalone domainFilterId, then run a campaignless Prospeo sample constrained by domainFilterId.",
         "existingLeadList": "Skip provider discovery and sample existing rows before approval; do not clone/import until after approval.",
         "forbiddenPreApproval": [
@@ -1022,7 +1022,7 @@
           "defaultWhenMissing": "discovered-provider-import",
           "branches": {
             "normal-discovery": "import_leads({ campaignOfferId, targetLeadCount: import.importLimit })",
-            "supplied-linkedin-profiles": "confirm load_csv_linkedin_leads after approval, then confirm_lead_list({ sourceLeadListId, targetLeadCount: import.importLimit })",
+            "supplied-linkedin-profiles": "confirm load_csv_linkedin_leads after approval to batch/materialize the CSV into a lead list, persist returned leadListId, then confirm_lead_list({ sourceLeadListId: leadListId, targetLeadCount: import.importLimit }); do not call import_leads for this branch",
             "existing-lead-list": "confirm_lead_list({ sourceLeadListId: existingLeadListId, targetLeadCount: import.importLimit })",
             "supplied-domains": "reuse or confirm load_csv_domains, run campaign-associated search_prospeo({ campaignOfferId, domainFilterId }), then import_leads({ campaignOfferId, targetLeadCount: import.importLimit })"
           },

package/skills/create-campaign-v2/references/step-13-import-leads.md

@@ -23,8 +23,12 @@ Supported branches:
 
 - **No manifest / normal discovery** — use the existing provider import path.
 - **Supplied LinkedIn profile CSV** — confirm `load_csv_linkedin_leads` only
-  after approval, then import into the campaign table with
-  `confirm_lead_list({ sourceLeadListId, targetLeadCount: importLimit })`.
+  after approval to batch/materialize the full uploaded CSV into a Sellable
+  lead-list table. Persist the returned `leadListId`, then import the bounded
+  review batch into the campaign table with
+  `confirm_lead_list({ sourceLeadListId: leadListId, targetLeadCount: importLimit })`.
+  Do not call `import_leads` for this branch; the materialized lead list is the
+  source.
   Do **not** call `wait_for_lead_list_ready` for this branch; there is no
   provider import job to wait on, and probing readiness can leave the campaign
   in an import-failed state before `confirm_lead_list`.