feat(cli): Sim CLI with AWS-style profiles and a platform key exchange

.github/workflows/publish-sim-cli.yml

@@ -0,0 +1,149 @@
+name: Publish Sim API CLI Package
+
+on:
+  push:
+    branches: [main, staging, dev]
+    paths:
+      - 'packages/sim-cli/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-sim-cli-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  publish-npm:
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: '20'
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+            **/node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Verify npm authentication
+        env:
+          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: bun pm whoami
+
+      - name: Run tests
+        working-directory: packages/sim-cli
+        run: bun run test
+
+      - name: Type-check package
+        working-directory: packages/sim-cli
+        run: bun run type-check
+
+      - name: Build package
+        working-directory: packages/sim-cli
+        run: bun run build
+
+      - name: Resolve release channel
+        id: release
+        working-directory: packages/sim-cli
+        env:
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          BASE_VERSION="$(bun -p "require('./package.json').version")"
+          if [[ ! "$BASE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Package version must be a stable X.Y.Z base, got '$BASE_VERSION'." >&2
+            exit 1
+          fi
+
+          case "$BRANCH" in
+            dev)
+              VERSION="${BASE_VERSION}-dev.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}"
+              TAG="dev"
+              ;;
+            staging)
+              VERSION="${BASE_VERSION}-preview.${GITHUB_RUN_NUMBER}.${GITHUB_RUN_ATTEMPT}"
+              TAG="staging"
+              ;;
+            main)
+              VERSION="$BASE_VERSION"
+              TAG="latest"
+              ;;
+            *)
+              echo "Unsupported release branch '$BRANCH'." >&2
+              exit 1
+              ;;
+          esac
+
+          bun pm pkg set "version=$VERSION"
+          RESOLVED_VERSION="$(bun -p "require('./package.json').version")"
+          if [ "$RESOLVED_VERSION" != "$VERSION" ]; then
+            echo "Version injection mismatch: wanted '$VERSION', got '$RESOLVED_VERSION'." >&2
+            exit 1
+          fi
+
+          {
+            echo "version=$VERSION"
+            echo "tag=$TAG"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Smoke-test packed Node bundle
+        working-directory: packages/sim-cli
+        run: |
+          set -euo pipefail
+          SMOKE_DIR="$(mktemp -d "$RUNNER_TEMP/sim-cli-smoke.XXXXXX")"
+          PACKAGE_PATH="$SMOKE_DIR/sim-cli.tgz"
+          bun pm pack --ignore-scripts --filename "$PACKAGE_PATH" --quiet
+          tar -xzf "$PACKAGE_PATH" -C "$SMOKE_DIR"
+          "$SMOKE_DIR/package/dist/index.js" --version
+
+      - name: Check if version already exists
+        id: version_check
+        working-directory: packages/sim-cli
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          if bun pm view "sim@$VERSION" version > /dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to npm
+        if: steps.version_check.outputs.exists == 'false'
+        working-directory: packages/sim-cli
+        env:
+          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ steps.release.outputs.tag }}
+        run: bun publish --access public --tag "$NPM_TAG" --no-save
+
+      - name: Summarize release
+        if: steps.version_check.outputs.exists == 'false'
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          NPM_TAG: ${{ steps.release.outputs.tag }}
+        run: echo "Published sim@$VERSION with the '$NPM_TAG' tag."
+
+      - name: Summarize skipped release
+        if: steps.version_check.outputs.exists == 'true'
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+        run: echo "Skipped sim@$VERSION because that version is already published."

.github/workflows/test-build.yml

@@ -264,4 +264,4 @@ jobs:
           AWS_REGION: 'us-west-2'
           ENCRYPTION_KEY: '7cf672e460e430c1fba707575c2b0e2ad5a99dddf9b7b7e3b5646e630861db1c' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
-        run: bunx turbo run build --filter=sim
+        run: bunx turbo run build --filter=@sim/app

apps/docs/content/docs/en/api-reference/(generated)/execution/meta.json

@@ -0,0 +1,3 @@
+{
+  "pages": ["executeWorkflow", "getWorkflowExecution", "cancelExecution", "getJobStatus"]
+}