Dependency Watchtower

CREDENTIALS FIRST: Before any Synorb setup, ask the user in plain English for one Synorb Key (SYNORB_KEY). Parse only credentials.synorb_key from GET https://synorb.com/connect; store the one key as a server-side secret and use Authorization: Bearer <synorb_key> for both REST and MCP. A self-provisioned key is DEMO access for 1,000 Manifests and expires 24 hours after mint; read and surface the top-level expires_at field. Bind an email with POST https://api.synorb.com/api/connect/bind-email using the same Bearer key to get Starter, free forever with 1,000 Manifests/month and no expiry; Paid is $10/month for 10,000 Manifests/month. After expiry, bind an email, mint a new demo at https://synorb.com/connect, or sign up free at https://synorb.com/signup. Store one server-side key, show "Synorb key expired - bind an email or mint a new demo key" instead of a generic auth failure, and document expires_at plus these recovery paths in the generated README and environment template. You are Cursor. Build Dependency Watchtower in this repository. PROMPT METADATA Slug: cursor-depwatch Title: Dependency Watchtower Short title: DepWatch Domain: developer-tools Tagline: Build a repo-aware dependency, SDK, AI-model, and API-change watchdog that opens cited upgrade briefs. Video state: Watch build video User fit: Any Cursor user with a real repo who wants dependency and platform changes turned into actionable engineering work. What you get: - Package and import inventory - Relevant vendor and changelog Stream discovery - Cited upgrade and breaking-change briefs - GitHub, Linear, or Slack automation output Cursor and platform tools: - Cursor Agent - Cursor MCP - Cursor Automations - repo scanner - GitHub, Linear, or Slack trigger - server-side Synorb REST route or CLI script Synorb stream families: - vendor changelog and documentation Streams - AI model, API, SDK, and developer platform Streams - company and product Streams matched to package inventory Tags: developer tools, dependencies, SDKs, AI models, APIs, changelogs, automation PRODUCT TO BUILD Build Dependency Watchtower for this repository. It scans package files, lockfiles, imports, SDK clients, AI model calls, and API integrations, then discovers matching Synorb Streams for vendors, changelogs, docs, model releases, and platform changes. It should produce cited upgrade briefs that can become GitHub issues, PR comments, or Linear tasks. PRIMARY USER Engineering lead or developer using Cursor inside a production repository. APP-SPECIFIC LIVE SCOPE Inspect package.json, lockfiles, requirements files, pyproject, go.mod, Cargo.toml, Dockerfiles, SDK imports, API base URLs, and model names. Search Synorb for the vendors, APIs, SDKs, frameworks, and model providers found in the repo. Let the user approve the vendor watchlist before creating automation. CORE PRODUCT FEATURES - Repo inventory table with detected packages, APIs, SDKs, and model calls - Vendor Stream selector with live discovery receipt - Change cards with breaking, security, migration, deprecation, pricing, and feature tags - Action brief with affected files, possible owner, source URL, and suggested next step - GitHub issue, PR comment, Linear task, or Slack digest output SYNORB ACCESS CHECKPOINT - ASK AND WAIT Before making any Synorb discovery call or writing data-dependent code, ask the user to choose: 1. Use my existing Synorb credentials. 2. Self-provision a DEMO Synorb Key through Synorb Connect. For existing credentials, guide the user to add the Synorb MCP server in Cursor settings or the repo-local Cursor MCP configuration. Use https://mcp.synorb.com/mcp with Authorization: Bearer <synorb_key>, and keep SYNORB_KEY only in protected MCP configuration and server-side environment variables. For Synorb Connect, be explicit: https://synorb.com/connect self-provisions DEMO access for a new user. Do not claim it is tied to an existing account, sign-in session, registration flow, or credit card. If the user elects self-provisioning, make exactly one local or server-side GET request to https://synorb.com/connect, parse only credentials.synorb_key without printing the response body, read and surface the top-level expires_at, and store the one SYNORB_KEY for both MCP and server-side REST. DEMO is 1,000 Manifests for 24 hours; binding an email at POST https://api.synorb.com/api/connect/bind-email with the same Bearer key gives Starter, free forever at 1,000 Manifests/month. Paid is $10/month for 10,000 Manifests/month. If the DEMO expires, show "Synorb key expired - bind an email or mint a new demo key", then document binding an email, minting a new demo key, or signing up free at https://synorb.com/signup. If Cursor cannot retrieve and store the key without displaying it, send the user to https://synorb.com/connect and have them copy it only into protected credential fields. Never ask the user to paste secrets into chat, generated source files, NEXT_PUBLIC variables, browser storage, logs, HTML, screenshots, fixtures, database rows, or documentation. In plain words: do not paste secrets into chat or generated files. After the key is in protected config, call synorb-profile through MCP and create a temporary server-side account validation route or script for REST, both using Authorization: Bearer <synorb_key>. Report only pass or fail, account name, account ladder state, quota state, and allowed date window. Never print credential values. If either MCP or REST fails, stop at a setup-blocked state. Never substitute another provider, mock feed, guessed Stream, or scraped source. SYNORB MCP DISCOVERY CONTRACT 1. Call synorb-profile once first. Record account, quota state, date window, and whether coverage or quota warnings are present. 2. Call synorb-stream-search for the requested beat, entity, source family, market, ticker, media format, or policy topic. Use include_details true when choosing streams or source channels. Treat coverage.status "partial" as inventory pagination, not proof that no other Streams exist. 3. Select only real customer-visible Streams with positive 17-digit IDs. Preserve every Synorb ID as a JSON string end to end. Never guess, shorten, coerce, or invent an ID. 4. Call synorb-details on selected Streams when you need source channels, media formats, source_class, evidence_type, available filters, or recent volume. 5. Run synorb-manifests with mode "count" first for a zero-quota density check. Then run one bounded build sample with compact true, page_size 5-12, target_count 5-12, selected stream_ids or source_channel filters, and an explicit date window inside synorb-profile limits. 6. Use tag_names, source_channel_names, source_channel_ids, source_class, evidence_type, media_format, ticker, isin, or identifier only when the approved product scope requires them. 7. Count and orient responses are preflight only. Do not summarize them as exhaustive result sets. Preserve quota_header, coverage.status, required_user_notice, citations, and recommended_next_call when MCP returns them. 8. Show a Live Scope Receipt before building data-dependent UI: Stream names and IDs, source-channel names and IDs when used, filters, evidence and media types, date window, sample count, quota header, citations when returned, recommended next call, and any coverage caveat. Ask the user to approve or adjust it before persisting a launch configuration. SYNORB REST RUNTIME CONTRACT Use Synorb MCP for build-time discovery and Synorb REST for the running application. Put runtime calls behind a server-only route such as /api/synorb, /api/synorb/policy, /api/synorb/company, or the equivalent backend endpoint in the detected framework. The server route calls POST https://api.synorb.com/streams/query with Authorization: Bearer <synorb_key> from the one server-side SYNORB_KEY secret. The first request must omit cursor and send one of stream_ids, source_channel_ids, home_domains, ticker, isin, or identifier, plus story_type when needed, page_size, and an explicit date window. Multi-stream REST results are returned as flat rows under data.briefs, data.signals, or data.manifests depending on the request. Pagination is under data.pagination, and the next request uses data.pagination.next. Do not expect MCP-only quota_header, coverage, or citations fields from REST unless the API response actually includes them. Surface REST usage honestly. Cite each returned row's real source_url. Validate inputs, enforce auth where appropriate, lock CORS to the app origin, rate-limit public routes, and never expose SYNORB_KEY to browser code. FULL MANIFEST, SIGNAL, AND BRIEF SURFACE Do not flatten Synorb into generic headline cards. Preserve the richest available facets: Manifest fields: id, record_id, source_url, source_name, source_channel, source_channel_names, stream_ids, stream_names, published_at or published_date, media_format, story_type, significance, tags, entities, topics, citations, coverage, diagnostics, usage, and pagination when returned. Signal fields: claims, claim_type, confidence, evidence, quote when present, featured or actionable fields when present, per-claim source links, and enough context for a user to verify the claim against the original source. Brief fields: body_markdown, key takeaways, notable quotes, why it matters, timeline, sources, caveats, and source-linked citations when present. If a field is absent, render a professional missing-state instead of inventing it. Every exported draft, chart drill-in, digest item, alert, and card detail must retain a source URL path back to the original source. GAP-ONLY WEB POLICY Synorb is the source-grounded context layer. Web search may fill an explicit gap only when Synorb coverage is absent or when the user asks for supplemental context. Put web results in a separate lane labeled web context or unverified supplement. Never blend web text into Synorb-cited prose, never present web context as a Synorb Manifest, and never use scraping or another provider as a silent fallback when Synorb is unavailable. CURSOR-NATIVE IMPLEMENTATION LOOP Work like a Cursor agent inside an existing repository: 1. Inspect the repo first. Detect framework, package manager, test runner, auth pattern, server-route convention, component system, and deployment target. If the app is new, recommend Next.js App Router with TypeScript unless the user chooses another stack. 2. Ask one compact product checkpoint only when needed: audience, first-session outcome, private or public surface, refresh cadence, delivery channel, and whether to use the recommended scope. 3. Add repo guidance in .cursor/rules or project notes when useful: server-only secrets, Synorb ID strings, source URL preservation, no silent fallback data, and Build Receipt requirements. 4. Build a vertical slice first with live Synorb data or an explicit setup-blocked state. Local fixtures may exist only for tests. 5. Add typed adapters for Manifests, Signals, Briefs, claims, citations, coverage, usage, diagnostics, and pagination. Keep adapters tolerant of absent optional fields and strict about invented required fields. 6. Add focused tests for secret safety, adapter mapping, empty and partial states, pagination, source links, and product-specific acceptance criteria. 7. Run the local checks that fit the repo. Summarize failures instead of hiding them. 8. Finish with a Build Receipt naming exact Streams, source channels, filters, date window, routes, env names only, automation schedule or trigger, test commands, and known gaps. AUTOMATION FOR THIS BUILD Create a Cursor Automation triggered by schedule, GitHub pull request, dependency-file change, or Slack emoji command. It should post only source-linked changes and never open noisy issues for unrelated vendor updates. CURSOR AUTOMATIONS When the product needs to keep running, create or describe a Cursor Automation that uses the approved Live Scope Receipt. Prefer scheduled morning or weekday refreshes for desks and dashboards, and GitHub, Linear, Slack, PagerDuty, or webhook triggers for developer workflows. Automation output must include source-linked changes, coverage caveats, and enough Stream/filter metadata for a reviewer to reproduce the call. Do not claim an automation works until it has been run or clearly marked as planned. APP-SPECIFIC ACCEPTANCE TESTS - Repo inventory is derived from actual files, not a generic package list. - Every vendor watch is approved from live Synorb discovery. - Every generated task includes source URL, affected package or API, severity rationale, and owner suggestion. SHARED ACCEPTANCE TESTS 1. MCP and REST credential paths are validated before live data is used. 2. No Synorb Key, credential bundle, or secret value appears in client code, NEXT_PUBLIC variables, HTML, logs, fixtures, screenshots, database rows, docs, or API responses. 3. Every persisted Synorb ID is a validated 17-digit string. 4. Every first-screen row, draft, card, alert, chart drill-in, digest item, and export preserves a real source_url path. 5. The UI distinguishes Manifest, Signal, Brief, claim, citation, coverage, usage, diagnostics, and web-gap data instead of blending them together. 6. Loading, error, setup-blocked, empty, partial coverage, pagination, and stale-data states are visible and tested. 7. No mock data or substitute provider appears in user-visible preview after credentials validate. 8. The Build Receipt lists exact Streams, source channels, filters, date window, route names, environment variable names only, automation plan, test commands, and remaining gaps. FINAL OUTPUT Build the product as a working vertical slice with real Synorb data or a setup-blocked state. Then provide a Build Receipt with exact Streams, source channels, filters, date window, routes, environment variable names only, automation status, test commands run, and any known gaps. Do not deploy unless the user separately asks after review.