feature(cli): Use a new R2 upload mechanism for publishing packages

[artemyarulin]

Switches wasmer-cli upload to use new R2 method for uploading files. Added also integration tests which ensures uploading works, but I've left it disabled as it requires valid token/dev registry access.

Resolves: #6057

[Copilot]

Pull request overview

This PR switches the Wasmer CLI upload mechanism from Google Cloud Storage resumable uploads to R2 direct uploads for publishing packages. The changes add an UploadMethod enum with an R2 variant and thread this parameter through the GraphQL API layer.

Changes:

• Added UploadMethod enum to specify R2 as the upload method
• Updated GraphQL schema and query/mutation functions to accept optional method parameter
• Modified CLI upload flow to use direct PUT requests instead of resumable uploads
• Added integration test for R2 upload functionality

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/backend-api/src/query.rs	Added UploadMethod enum and updated functions to accept method parameter
lib/backend-api/src/types.rs	Updated GraphQL types to include method field in variables and payload
lib/backend-api/schema.graphql	Updated GraphQL schema to accept method parameter in queries/mutations
lib/cli/src/commands/package/common/mod.rs	Removed old resumable upload logic, switched to direct PUT, added R2 test
lib/sdk/src/package/publish.rs	Added UploadMethod::R2 parameter to API call (incomplete migration)
lib/sdk/src/app/deploy_remote_build.rs	Added UploadMethod::R2 parameter and uses direct PUT upload

Comments suppressed due to low confidence (2)

lib/sdk/src/package/publish.rs:243

• The SDK publish function still uses the old Google Cloud Storage resumable upload protocol (POST with x-goog-resumable header followed by PUT to session URL) even though it now requests R2 upload method at line 204. This is inconsistent with the CLI implementation which uses a direct PUT request to the signed URL. The upload logic should be updated to use a direct PUT request like the CLI does, removing the POST request and session URL extraction.

        let resp = http
            .post(&signed_url)
            .header(reqwest::header::CONTENT_LENGTH, "0")
            .header(reqwest::header::CONTENT_TYPE, "application/octet-stream")
            .header("x-goog-resumable", "start")
            .send()
            .await
            .map_err(|e| PackagePublishError::Api(e.into()))?
            .error_for_status()
            .map_err(|e| PackagePublishError::Api(e.into()))?;

        let session_url = resp
            .headers()
            .get(reqwest::header::LOCATION)
            .ok_or_else(|| {
                PackagePublishError::Api(anyhow::anyhow!(
                    "upload server did not provide session URL"
                ))
            })?
            .to_str()
            .map_err(|e| PackagePublishError::Api(e.into()))?
            .to_string();

        progress(PublishProgress::Uploading { uploaded: 0, total });
        let res = http
            .put(&session_url)

lib/backend-api/src/query.rs:906

• The GenerateUploadUrlPayload includes a method field (line 625 in types.rs) that indicates which upload method the backend provided, but this function only returns the signed_url and discards the method field. If the backend can return different upload methods, callers need this information to determine how to upload (e.g., direct PUT for R2 vs resumable upload for GCS). Consider returning the entire payload or at least both the URL and method.

    let payload = client
        .run_graphql_strict(types::GenerateUploadUrl::build(
            GenerateUploadUrlVariables {
                expires_after_seconds,
                filename,
                name,
                version,
                method: method.map(|m| m.as_str()),
            },
        ))
        .await
        .and_then(|res| {
            res.generate_upload_url
                .context("generateUploadUrl mutation did not return data")
        })?;

    Ok(payload.signed_url)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.