feat(cli): add deepnote publish --streamlit - #466

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- blocks.ts: CRUD client for /v2/blocks and /v2/notebooks endpoints
- block-spec.ts: convert .deepnote blocks to API-ready BlockSpec
- sync-notebook-content.ts: diff local vs remote blocks, plan minimal
  mutations using longest-increasing-subsequence for reorder moves
- push-to-cloud.ts: CLI orchestration for --push flag
- Wire up exports from @deepnote/cloud and @deepnote/local-runner

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Two review fixes:

1. pushLocalNotebook now passes the pre-computed plan to syncNotebookContent
   instead of letting it re-plan. This ensures the applied changes match what
   the user approved and avoids duplicate API reads.

2. A remote-only integration (local spec has no integrationId) is no longer
   flagged as "integration changed" on every push — the PATCH cannot clear it
   anyway, so the comparison now requires the local spec to explicitly define
   a different integrationId before triggering an update.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ssing or re-fetches fail

result.success now reflects commandSucceeded (execution + artifact delivery),
not raw run status. A successful run with no snapshot exits 1 instead of
silently reporting success. When all snapshot re-fetch attempts fail (e.g. API
outage), the last error is thrown so the CLI reports artifactStatus: unavailable
rather than not_produced.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a known no-op run has re-fetch failures, the no-op snapshot synthesis
should still produce a valid result. Move the lastRetryError throw to after
the synthesis check so it only fires when content remains null.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…efault

serveStatic exposed two run routes, POST /api/run for a local kernel and POST
/api/run-cloud for Deepnote, so every app built on it needed two buttons, two
response shapes to render, and a decision from the user about where a run
should happen before anything could run at all.

Collapse them into one POST /api/run whose destination is a server setting.
It defaults to 'cloud', so an app runs on Deepnote without being configured
for it; runTarget: 'local' runs in a local Python kernel instead. The response
reports which one ran via `target`, and GET /api/info reports runTarget up
front, so a page can label its Run button without being told separately.

The cross-origin guard stays tied to what it protects rather than to a route
name: a cloud run spends the token and can create project content, so it keeps
the guard; a local run does neither and keeps the looser rule it had on its own
route. Local responses now state success: true rather than implying it, so one
field works for both targets.

run-app drops its second button and reads the destination from the server.
serve.mjs takes RUN_TARGET=local to demonstrate the option; without it the
example now runs in Deepnote Cloud and needs DEEPNOTE_TOKEN rather than
OPENAI_API_KEY.

BREAKING CHANGE: POST /api/run-cloud is gone. Callers that ran in the cloud
now POST to /api/run against a server configured with the default runTarget;
callers that ran locally pass runTarget: 'local'.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

serveStatic kept two runner seams, `runner` for a local kernel and
`cloudRunner` for Deepnote, each with its own signature and its own result
type. That forced the run route to branch: two calls, two response builders,
and two shapes for a page to render.

Merge them into one `RunnerFn` — `(input, inputs, options) => Promise<RunResult>`
— covering both ends. `RunOptions` carries what either needs (pythonEnv,
persistSnapshot, token) and `RunResult` describes either outcome: `outputs`
and `success` are the fields every run has, while `runId`, `status`, `created`,
and `viewUrl` describe a cloud run and are simply absent from a local one,
dropping out of the JSON rather than being sent as nulls.

The Deepnote API is the default and the only thing that overrides it is a
local Deepnote kernel to point at, named by `runTarget: 'local'`. Both ends
are adapted to the shared signature where the runner is resolved, so the route
itself no longer branches at all — one call, one response.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Stating success: true for every local run that resolved was wrong. A local
kernel does not throw on a failing block — it returns normally and reports
the failure as summary.failedBlocks > 0 — so the response asserted success
for runs that had actually failed, and a page reading that one field would
present a broken run as a good one.

Derive it instead: a cloud run states success outright, and a local one says
the same thing through failedBlocks. Regression test covers a run returning
failedBlocks: 1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Every existing test injects `runner`, so the defaults — the adapters mapping
RunOptions onto runWithInputs and runInCloud — never executed. codecov flagged
exactly those two lines. They are also the lines where a mistake is invisible:
dropping `token` would break every real cloud run while the suite stayed green.

Mock both modules and assert the mapping, rather than leaving it to integration.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ontent as absent

A snapshot synthesized from the local source for a no-op run now reports
artifactStatus: 'synthesized' (not 'saved') and human output says so, so
machine consumers and users can tell it apart from an API-produced artifact.
Empty snapshot content from the API is treated as not-yet-attached in
waitForRunSnapshot instead of being written out as an empty file.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…t synthesized status

The docs claimed success described notebook execution alone and that a
no-snapshot run exits 0 — the code fails the command (exit 1) whenever a
successful run's snapshot is not delivered. Also documents the new
artifactStatus: 'synthesized' value and empty-content handling.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…g, pin review fixes with tests

toBlockSpec now strips execution bookkeeping (execution_start,
execution_millis, execution_context_id, source_hash, last_* function keys)
before the spec is compared or created, so pushing an exported file after a
run no longer plans a delete+create of every executed block — which would
give them new ids and drop their comments. Locked in with a fixture test
over examples/housing_price_prediction.deepnote.

Also pins two earlier review fixes with tests: syncNotebookContent receives
the exact plan the user approved, and a remote-only integration does not
trigger an update.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…e deadline has passed

A failed status check for an existing app was reported as "the project
machine is not running" with exit code 0; it is now an error with exit
code 1. The wait loop checks the deadline before each request, so a
`timeoutMs` that has already elapsed throws instead of sending one more
request.

…ce a test's stdout

… narrow the hosted API access caveat

Deleting an entrypoint removes its app, and `deepnote sync` replaces a changed file with a delete and
an upload, so pushing an edited entrypoint currently removes the app too. Hosted API calls need the
project owner's opt-in and a signed-in viewer with direct project access. The public publish page
gains a Streamlit section that reuses the reference wording.

They import deepnote_toolkit.streamlit, which is not in a released toolkit yet, so their test script
fails against PyPI. The CLI and cloud client changes do not depend on them.