storage

Create presigned upload and download URLs for provider-agnostic file storage.

Updated May 7, 2026
One-click install
npx skills add https://github.com/johinsDev/loyalty-app --skill storage-johinsdev
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: storage
Source: https://github.com/johinsDev/loyalty-app/tree/main/.claude/skills/storage
Command: npx skills add https://github.com/johinsDev/loyalty-app --skill storage-johinsdev

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill removes the friction and security risk of uploading user files by providing a consistent, provider-agnostic storage flow that works across memory, local, and R2.

Core Features & Use Cases

  • Presigned upload + safe serve: Creates upload and download URLs so the client can PUT bytes directly (with R2 presigning) while the server never handles file contents.
  • Provider-agnostic disks: Switches between memory, local, and r2 via STORAGE_PROVIDER and disk configuration, with consistent keying and URL generation.
  • Guardrails and validation: Signs local/memory upload tokens with HS256, enforces modes and max sizes, and validates upload paths to prevent traversal.

Quick Start

Use the storage Skill to upload an avatar from the client by calling the tRPC createUploadUrl mutation, PUTting the file body to the returned URL, then storing the resulting key for later retrieval.

Frequently Asked Questions about storage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I upload files directly to Cloudflare R2 using presigned URLs?

Presigned URLs allow clients to PUT file bytes directly to Cloudflare R2, ensuring the server never handles file contents. The storage Skill generates these R2 presigned PUT/GET flows via environment-driven provider selection.

What is the best way to handle user avatar uploads securely in a tRPC monorepo?

Handle user avatar uploads securely in a tRPC monorepo by calling a protected tRPC createUploadUrl mutation, PUTting the file to the returned URL, and storing the resulting key for later retrieval.

Can I switch between local disk and cloud storage without changing my upload logic?

Yes, provider-agnostic disks let you switch between memory, local, and R2 environments via the STORAGE_PROVIDER variable, maintaining consistent keying and URL generation without changing upload logic.

How does HMAC token signing protect local file uploads?

HMAC token signing protects local file uploads by using HS256-signed tokens to enforce upload modes and max sizes, while validating upload paths to prevent directory traversal attacks.

Does the storage provider support server-written files like reports and backups?

Yes, the storage provider supports server-written files like reports and backups. It applies provider-agnostic disks to both user-driven uploads and server-written files across memory, local, and R2 environments.