diff --git a/app/Platform/Mail/Http/Admin/MailConfigurationController.php b/app/Platform/Mail/Http/Admin/MailConfigurationController.php
new file mode 100755
index 00000000..c7078f2f
--- /dev/null
+++ b/app/Platform/Mail/Http/Admin/MailConfigurationController.php
@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Platform\Mail\Http\Admin;
+
+use App\Platform\Http\Controller;
+use App\Platform\Mail\Application\MailConfigurationService;
+use App\Platform\Mail\Http\Requests\MailEnvironmentRequest;
+use App\Platform\Mail\Mailables\TestMail;
+use App\Platform\Operations\Models\Setting;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+
+/**
+ * Installation-wide mail transport: which driver the app sends through, the
+ * credentials behind it, and a throwaway probe message to prove it works.
+ */
+class MailConfigurationController extends Controller
+{
+    /**
+     * Gate ability guarding every endpoint on this controller.
+     */
+    private const ABILITY = 'manage email config';
+
+    /**
+     * Onboarding wizard step recorded once a transport has been stored.
+     */
+    private const WIZARD_STEP = 4;
+
+    public function __construct(
+        private readonly MailConfigurationService $mailConfigurationService
+    ) {}
+
+    /**
+     * Store the submitted transport settings. An installation that has not yet
+     * finished onboarding is nudged forward to the mail step of the wizard.
+     */
+    public function saveMailEnvironment(MailEnvironmentRequest $request): JsonResponse
+    {
+        $this->authorize(self::ABILITY);
+
+        $profileState = Setting::getSetting('profile_complete');
+
+        $this->mailConfigurationService->saveGlobalConfig(
+            $request->validated()
+        );
+
+        if ($profileState !== 'COMPLETED') {
+            Setting::setSetting('profile_complete', self::WIZARD_STEP);
+        }
+
+        return response()->json(['success' => 'mail_variables_save_successfully']);
+    }
+
+    /**
+     * Read back the stored installation-wide transport settings.
+     */
+    public function getMailEnvironment(): JsonResponse
+    {
+        $this->authorize(self::ABILITY);
+
+        return response()->json(
+            $this->mailConfigurationService->getGlobalConfig()
+        );
+    }
+
+    /**
+     * List the transports this installation is actually able to send through.
+     */
+    public function getMailDrivers(): JsonResponse
+    {
+        $this->authorize(self::ABILITY);
+
+        return response()->json(
+            $this->mailConfigurationService->getAvailableDrivers()
+        );
+    }
+
+    /**
+     * Deliver a one-off message through the active transport so an admin can
+     * confirm the credentials they just saved really work.
+     */
+    public function testEmailConfig(Request $request): JsonResponse
+    {
+        $this->authorize(self::ABILITY);
+
+        $this->validate($request, [
+            'to' => 'required|email',
+            'subject' => 'required',
+            'message' => 'required',
+        ]);
+
+        $probe = new TestMail($request->subject, $request->message);
+
+        Mail::to($request->to)->send($probe);
+
+        return response()->json(['success' => true]);
+    }
+}
diff --git a/app/Platform/Mail/Http/Requests/MailEnvironmentRequest.php b/app/Platform/Mail/Http/Requests/MailEnvironmentRequest.php
new file mode 100644
index 00000000..b55908c7
--- /dev/null
+++ b/app/Platform/Mail/Http/Requests/MailEnvironmentRequest.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Platform\Mail\Http\Requests;
+
+use App\Platform\Mail\Application\MailConfigurationService;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * Guards an installation-wide mail transport submission, checking it against
+ * the field set of whichever driver the payload names.
+ */
+class MailEnvironmentRequest extends FormRequest
+{
+    /**
+     * Access is gated by the controller's ability check, not here.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Delegate the rule set to the configuration service, which knows which
+     * fields belong to the driver being submitted.
+     */
+    public function rules(): array
+    {
+        $driver = $this->string('mail_driver')->toString();
+
+        return app(MailConfigurationService::class)->validationRules($driver);
+    }
+}
diff --git a/app/Platform/Mail/Mailables/TestMail.php b/app/Platform/Mail/Mailables/TestMail.php
new file mode 100644
index 00000000..9d1830d3
--- /dev/null
+++ b/app/Platform/Mail/Mailables/TestMail.php
@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Platform\Mail\Mailables;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * Throwaway probe an administrator sends at the freshly configured transport
+ * to confirm that mail actually leaves the installation.
+ */
+class TestMail extends Mailable
+{
+    use Queueable;
+    use SerializesModels;
+
+    /**
+     * Subject line supplied by the administrator.
+     *
+     * @var mixed
+     */
+    public $subject;
+
+    /**
+     * Body supplied by the administrator, dropped into the markdown template.
+     *
+     * @var mixed
+     */
+    public $message;
+
+    /**
+     * @param  mixed  $subject
+     * @param  mixed  $message
+     */
+    public function __construct($subject, $message)
+    {
+        $this->subject = $subject;
+        $this->message = $message;
+    }
+
+    /**
+     * @return $this
+     */
+    public function build()
+    {
+        return $this->subject($this->subject)
+            ->markdown('emails.test')
+            ->with(['my_message' => $this->message]);
+    }
+}
diff --git a/app/Platform/Mail/Models/EmailLog.php b/app/Platform/Mail/Models/EmailLog.php
new file mode 100644
index 00000000..fe304326
--- /dev/null
+++ b/app/Platform/Mail/Models/EmailLog.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Platform\Mail\Models;
+
+use App\Domains\Accounts\Models\CompanySetting;
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+/**
+ * One outbound document mail. Its token is the credential handed out in the
+ * public `/…/{token}` links, so this row is what a recipient's access to a
+ * document hangs on.
+ */
+class EmailLog extends Model
+{
+    use HasFactory;
+
+    protected $table = 'email_logs';
+
+    protected $guarded = ['id'];
+
+    /**
+     * The document this mail was sent about, referenced through the model
+     * alias map rather than a class name.
+     */
+    public function mailable(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    /**
+     * Decide whether the public link backed by this row still works.
+     *
+     * A link dies with its document: once the referenced record is gone the
+     * link is treated as expired rather than as an error. Otherwise expiry is
+     * opt-in per company — with `automatically_expire_public_links` switched on,
+     * the link lasts `link_expiry_days` days from the moment this row was
+     * written, compared at whole-day granularity.
+     */
+    public function isExpired(): bool
+    {
+        $document = $this->mailable;
+
+        if (! $document) {
+            return true;
+        }
+
+        $lifespanInDays = (int) CompanySetting::getSetting('link_expiry_days', $document->company_id);
+        $expiryEnabled = CompanySetting::getSetting('automatically_expire_public_links', $document->company_id);
+
+        $lastValidDay = $this->created_at->addDays($lifespanInDays);
+
+        return $expiryEnabled == 'YES'
+            && Carbon::now()->format('Y-m-d') > $lastValidDay->format('Y-m-d');
+    }
+}
diff --git a/app/Platform/Pdf/Concerns/GeneratesPdf.php b/app/Platform/Pdf/Concerns/GeneratesPdf.php
new file mode 100644
index 00000000..d6fd88ae
--- /dev/null
+++ b/app/Platform/Pdf/Concerns/GeneratesPdf.php
@@ -0,0 +1,254 @@
+<?php
+
+namespace App\Platform\Pdf\Concerns;
+
+use App\Domains\Accounts\Models\CompanySetting;
+use App\Domains\Contacts\Models\Address;
+use App\Platform\Operations\Models\Setting;
+use App\Platform\Pdf\Application\FontService;
+use App\Platform\Pdf\Rendering\PdfHtmlSanitizer;
+use App\Platform\Storage\Models\FileDisk;
+use Carbon\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\App;
+use Illuminate\Support\Facades\Storage;
+
+/**
+ * PDF behaviour shared by the documents that can be rendered and archived:
+ * invoices, estimates and payment receipts.
+ *
+ * The host model supplies getPDFData() and getExtraFields(), owns the media
+ * collection an archive is filed under, and answers to a "<collection>_number"
+ * attribute. Everything here is written against that contract.
+ */
+trait GeneratesPdf
+{
+    /**
+     * Answer with the archived PDF when one is reachable, otherwise render a
+     * fresh copy. Either way the document is served inline, so a browser shows
+     * it rather than downloading it.
+     */
+    public function getGeneratedPDFOrStream($collection_name)
+    {
+        $archived = $this->getGeneratedPDF($collection_name);
+
+        // file_exists() only answers for real filesystem paths, so an archive
+        // held on a remote disk — for which getGeneratedPDF hands back a signed
+        // URL — never satisfies this check and is rendered again instead.
+        if ($archived && file_exists($archived['path'])) {
+            $body = file_get_contents($archived['path']);
+            $file_name = $archived['file_name'];
+        } else {
+            $language = CompanySetting::getSetting('language', $this->company_id);
+
+            App::setLocale($language);
+            app(FontService::class)->ensureFontsForLocale($language);
+
+            // output(), never stream(): the drivers' stream() already hands back
+            // a Response, and nesting one response inside another casts it to a
+            // string, gluing the "HTTP/1.0 200 OK" preamble in front of the
+            // file. Viewers only sniff the opening kilobyte for %PDF so this
+            // looked healthy, while anything that validates the bytes (PDF/A
+            // conformance, text extraction) choked on them.
+            $body = $this->getPDFData()->output();
+            $file_name = $this->{$collection_name.'_number'}.'.pdf';
+        }
+
+        return response($body, 200)
+            ->header('Content-Type', 'application/pdf')
+            ->header('Content-Disposition', sprintf('inline; filename="%s"', $file_name));
+    }
+
+    /**
+     * Locate the archived PDF filed under a media collection.
+     *
+     * A local disk yields a filesystem path; every other driver yields a URL
+     * that stays valid for five minutes. Anything that goes wrong on the way —
+     * a media row whose disk record has since been deleted included — is
+     * reported as "nothing archived" rather than raised.
+     *
+     * @return Collection|false
+     */
+    public function getGeneratedPDF($collection_name)
+    {
+        try {
+            $archive = $this->getMedia($collection_name)->first();
+
+            if (! $archive) {
+                return false;
+            }
+
+            $file_disk = FileDisk::find($archive->custom_properties['file_disk_id']);
+
+            if (! $file_disk) {
+                return false;
+            }
+
+            $file_disk->setConfig();
+
+            return collect([
+                'path' => $file_disk->driver == 'local'
+                    ? $archive->getPath()
+                    : $archive->getTemporaryUrl(Carbon::now()->addMinutes(5)),
+                'file_name' => $archive->file_name,
+            ]);
+        } catch (\Exception) {
+            return false;
+        }
+    }
+
+    /**
+     * Render the document and file the result under a media collection.
+     *
+     * Archiving is opt-in installation-wide; switched off, this is a no-op
+     * reporting zero. Otherwise the render lands in the local temp area first,
+     * is handed to the media library on the default disk, and the temp copy is
+     * swept up afterwards.
+     *
+     * @return true|int|string true once filed, 0 when archiving is off, or the
+     *                         failure message when the media library refused it
+     */
+    public function generatePDF($collection_name, $file_name, $deleteExistingFile = false)
+    {
+        if ((Setting::getSetting('save_pdf_to_disk') ?? 'NO') == 'NO') {
+            return 0;
+        }
+
+        $language = CompanySetting::getSetting('language', $this->company_id);
+
+        App::setLocale($language);
+        app(FontService::class)->ensureFontsForLocale($language);
+
+        $pdf = $this->getPDFData();
+
+        $temp_directory = 'temp/'.$collection_name.'/'.$this->id;
+        $temp_file = $temp_directory.'/temp.pdf';
+
+        Storage::disk('local')->put($temp_file, $pdf->output());
+
+        if ($deleteExistingFile) {
+            // Note: the document id is handed over where a collection name
+            // belongs, so this empties a collection nobody files anything
+            // under, and the superseded archive survives. Left as it stands.
+            $this->clearMediaCollection($this->id);
+        }
+
+        $default_disk = FileDisk::whereSetAsDefault(true)->first();
+
+        if ($default_disk) {
+            $default_disk->setConfig();
+        }
+
+        $temp_path = Storage::disk('local')->path($temp_file);
+
+        try {
+            $this->addMedia($temp_path)
+                ->withCustomProperties(['file_disk_id' => $default_disk->id])
+                ->usingFileName($file_name.'.pdf')
+                ->toMediaCollection($collection_name, config('filesystems.default'));
+
+            Storage::disk('local')->deleteDirectory($temp_directory);
+
+            return true;
+        } catch (\Exception $e) {
+            return $e->getMessage();
+        }
+    }
+
+    /**
+     * The placeholder map every document shares: the customer's two addresses,
+     * the company and its address, the contact details, and one token per
+     * custom-field slug carried by the document and by its customer.
+     *
+     * Where a document and its customer answer to the same slug, the customer's
+     * answer is the one that survives. Every value is HTML-escaped, since the
+     * result is substituted straight into markup.
+     */
+    public function getFieldsArray()
+    {
+        $customer = $this->customer;
+        $shipping_address = $customer->shippingAddress ?? new Address;
+        $billing_address = $customer->billingAddress ?? new Address;
+        $company_address = $this->company->address ?? new Address;
+
+        // Token suffix => the address attribute answering it. Shared by all
+        // three address blocks; the name line is asked of the customer's only.
+        $address_tokens = [
+            'COUNTRY' => 'country_name',
+            'STATE' => 'state',
+            'CITY' => 'city',
+            'ADDRESS_STREET_1' => 'address_street_1',
+            'ADDRESS_STREET_2' => 'address_street_2',
+            'PHONE' => 'phone',
+            'ZIP_CODE' => 'zip',
+        ];
+
+        $fields = [];
+
+        foreach (['SHIPPING' => $shipping_address, 'BILLING' => $billing_address] as $prefix => $address) {
+            $fields['{'.$prefix.'_ADDRESS_NAME}'] = $address->name;
+
+            foreach ($address_tokens as $token => $attribute) {
+                $fields['{'.$prefix.'_'.$token.'}'] = $address->{$attribute};
+            }
+        }
+
+        $fields['{COMPANY_NAME}'] = $this->company->name;
+
+        foreach ($address_tokens as $token => $attribute) {
+            $fields['{COMPANY_'.$token.'}'] = $company_address->{$attribute};
+        }
+
+        $fields['{COMPANY_VAT}'] = $this->company->vat_id;
+        $fields['{COMPANY_TAX}'] = $this->company->tax_id;
+        $fields['{CONTACT_DISPLAY_NAME}'] = $customer->name;
+        $fields['{PRIMARY_CONTACT_NAME}'] = $customer->contact_name;
+        $fields['{CONTACT_EMAIL}'] = $customer->email;
+        $fields['{CONTACT_PHONE}'] = $customer->phone;
+        $fields['{CONTACT_WEBSITE}'] = $customer->website;
+
+        // The tax id token carries its own label, so a template printing it
+        // does not have to translate one.
+        $fields['{CONTACT_TAX_ID}'] = __('pdf_tax_id').': '.$customer->tax_id;
+
+        foreach ([$this->fields, $customer->fields] as $answers) {
+            foreach ($answers as $answer) {
+                $fields['{'.$answer->customField->slug.'}'] = $answer->defaultAnswer;
+            }
+        }
+
+        // The cast keeps a never-filled address line, custom field or tax id —
+        // which arrives as null — out of htmlspecialchars(), where null is
+        // deprecated on PHP 8.4 and fatal on 9. Every render used to emit those.
+        return array_map(
+            fn ($value) => htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8'),
+            $fields
+        );
+    }
+
+    /**
+     * Resolve the placeholders in a stored format string — a note, an address
+     * layout, an email body — and hand back PDF-ready markup.
+     *
+     * Tokens nothing answered to are dropped, along with the now-empty element
+     * pairs they leave behind, and paragraphs are flattened to line breaks. The
+     * result is sanitised, which also covers notes, since they arrive here too.
+     */
+    public function getFormattedString($format)
+    {
+        $placeholders = array_merge($this->getFieldsArray(), $this->getExtraFields());
+
+        $markup = nl2br(strtr((string) $format, $placeholders));
+
+        $markup = preg_replace('/{(.*?)}/', '', $markup);
+
+        $markup = preg_replace("/<[^\/>]*>([\s]?)*<\/[^>]*>/", '', $markup);
+
+        $markup = str_replace(['<p>', '</p>'], ['', '<br />'], $markup);
+
+        // Sanitising here strips the SSRF vectors that can ride in on
+        // user-supplied address fields, customer names and custom-field
+        // answers, without every caller needing a wrapper of its own.
+        return PdfHtmlSanitizer::sanitize($markup);
+    }
+}
diff --git a/app/Platform/Pdf/Http/Middleware/PdfMiddleware.php b/app/Platform/Pdf/Http/Middleware/PdfMiddleware.php
new file mode 100644
index 00000000..9063b445
--- /dev/null
+++ b/app/Platform/Pdf/Http/Middleware/PdfMiddleware.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Platform\Pdf\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Gate for the web-served PDF routes.
+ *
+ * A PDF is reachable by staff in the admin session, by an API token, and by a
+ * customer signed into the portal, so any one of the three guards is enough.
+ * Nobody recognised is sent to the login page rather than refused outright,
+ * since these URLs are typically opened straight from a browser.
+ */
+class PdfMiddleware
+{
+    /**
+     * Let the request through as soon as one of the guards recognises it.
+     *
+     * @param  Closure(Request): Response  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        foreach (['web', 'sanctum', 'customer'] as $guard) {
+            if (Auth::guard($guard)->check()) {
+                return $next($request);
+            }
+        }
+
+        return redirect('/login');
+    }
+}
diff --git a/app/Platform/Storage/Http/BackupsController.php b/app/Platform/Storage/Http/BackupsController.php
new file mode 100644
index 00000000..94291ff6
--- /dev/null
+++ b/app/Platform/Storage/Http/BackupsController.php
@@ -0,0 +1,175 @@
+<?php
+
+namespace App\Platform\Storage\Http;
+
+use App\Platform\Http\Controller;
+use App\Platform\Storage\Application\BackupService;
+use App\Platform\Storage\Jobs\CreateBackupJob;
+use App\Platform\Storage\Rules\PathToZip;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Spatie\Backup\BackupDestination\Backup;
+use Spatie\Backup\Helpers\Format;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+/**
+ * The archives kept on a storage target.
+ *
+ * Which target is a per-request decision: `file_disk_id` selects one, and
+ * without it the backup purpose setting decides, falling back to the default
+ * disk. Every action re-resolves it, so a caller may list one disk and delete
+ * from another in the same session.
+ *
+ * An archive is addressed by its path on that disk, and a path is only ever
+ * accepted if it names a zip -- the one thing standing between these endpoints
+ * and an arbitrary file on the storage target.
+ */
+class BackupsController extends Controller
+{
+    public function __construct(
+        private readonly BackupService $backupService,
+    ) {}
+
+    /**
+     * What is currently stored on the selected disk, newest-first only insofar
+     * as the destination hands them back that way.
+     *
+     * Anything that goes wrong while reading -- credentials the remote rejects,
+     * a bucket that is not there, a network that is not either -- is answered
+     * with 200 and an empty list carrying an error marker beside it, rather
+     * than a failure status. The screen renders "no backups yet" plus the
+     * driver's own words about why. Preserved: the SPA switches on the marker,
+     * not on the status code.
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorize('manage backups');
+
+        try {
+            $target = $this->backupService->getDestination($request->file_disk_id);
+
+            $archives = $target
+                ->backups()
+                ->map(function (Backup $archive) {
+                    return [
+                        'path' => $archive->path(),
+                        'created_at' => $archive->date()->format('Y-m-d H:i:s'),
+                        'size' => Format::humanReadableSize($archive->sizeInBytes()),
+                    ];
+                })
+                ->toArray();
+
+            return response()->json([
+                'backups' => $archives,
+            ]);
+        } catch (\Exception $failure) {
+            return response()->json([
+                'backups' => [],
+                'error' => 'invalid_disk_credentials',
+                'error_message' => $failure->getMessage(),
+            ]);
+        }
+    }
+
+    /**
+     * Queue an archive run and answer immediately.
+     *
+     * The whole body is handed to the job untouched -- `option` (everything,
+     * database only, or files only) and the disk selection are read there, and
+     * the reply says nothing about whether the run later succeeded. Nothing is
+     * validated at this end, so an unrecognised option is a job-time problem,
+     * not a request-time one.
+     */
+    public function store(Request $request): JsonResponse
+    {
+        $this->authorize('manage backups');
+
+        $payload = $request->all();
+
+        dispatch(new CreateBackupJob($payload))->onQueue(config('backup.queue.name'));
+
+        return response()->json(['success' => true]);
+    }
+
+    /**
+     * Remove one archive from the selected disk.
+     *
+     * The route carries a `{backup}` segment because the endpoint is registered
+     * as part of a resource, but nothing reads it -- the archive is identified
+     * by the `path` in the body, and the segment can be any value at all.
+     *
+     * KNOWN DEFECT: a path that names no archive on the disk leaves the search
+     * empty and the delete is attempted on nothing, which is a 500 rather than
+     * a 404. Reproduced as found.
+     */
+    public function destroy($disk, Request $request): JsonResponse
+    {
+        $this->authorize('manage backups');
+
+        $path = $this->requireArchivePath($request);
+
+        $target = $this->backupService->getDestination($request->file_disk_id);
+
+        $target
+            ->backups()
+            ->first(function (Backup $archive) use ($path) {
+                return $archive->path() === $path;
+            })
+            ->delete();
+
+        return response()->json(['success' => true]);
+    }
+
+    /**
+     * Stream one archive back as a download.
+     *
+     * Sent as a stream rather than a file response because the archive may live
+     * on a remote disk and is never staged locally. The length is taken from
+     * the destination's own metadata, so the browser gets a progress bar; the
+     * no-cache headers keep an intermediary from holding on to a database dump.
+     *
+     * A path that names nothing is 422 with a bare sentence -- plain text, not
+     * the JSON envelope the rest of the controller answers with. Preserved.
+     */
+    public function download(Request $request): Response|StreamedResponse
+    {
+        $this->authorize('manage backups');
+
+        $path = $this->requireArchivePath($request);
+
+        $target = $this->backupService->getDestination($request->file_disk_id);
+
+        $archive = $target->backups()->first(function (Backup $candidate) use ($path) {
+            return $candidate->path() === $path;
+        });
+
+        if (! $archive) {
+            return response('Backup not found', 422);
+        }
+
+        $name = pathinfo($archive->path(), PATHINFO_BASENAME);
+
+        return response()->stream(function () use ($archive) {
+            $stream = $archive->stream();
+            fpassthru($stream);
+            if (is_resource($stream)) {
+                fclose($stream);
+            }
+        }, 200, [
+            'Cache-Control' => 'must-revalidate, post-check=0, pre-check=0',
+            'Content-Type' => 'application/zip',
+            'Content-Length' => $archive->sizeInBytes(),
+            'Content-Disposition' => 'attachment; filename="'.$name.'"',
+            'Pragma' => 'public',
+        ]);
+    }
+
+    /**
+     * The archive path both write endpoints work from: required, and a zip.
+     */
+    private function requireArchivePath(Request $request): string
+    {
+        return $request->validate(['path' => ['required', new PathToZip]])['path'];
+    }
+}
diff --git a/app/Platform/Storage/Http/DiskController.php b/app/Platform/Storage/Http/DiskController.php
new file mode 100644
index 00000000..04a2dc64
--- /dev/null
+++ b/app/Platform/Storage/Http/DiskController.php
@@ -0,0 +1,334 @@
+<?php
+
+namespace App\Platform\Storage\Http;
+
+use App\Platform\Http\Controller;
+use App\Platform\Operations\Models\Setting;
+use App\Platform\Storage\Application\FileDiskService;
+use App\Platform\Storage\Http\Requests\DiskEnvironmentRequest;
+use App\Platform\Storage\Http\Resources\FileDiskResource;
+use App\Platform\Storage\Models\FileDisk;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * The registry of storage targets, and the three jobs they can be put to.
+ *
+ * A disk is a name, a driver, and a credential blob. Two of them are seeded and
+ * marked as system disks -- the public and the private local trees -- and are
+ * treated as furniture: their credentials are never revalidated and never
+ * rewritten, and they cannot be deleted. Everything else is something an
+ * operator added.
+ *
+ * Credentials are not taken on trust. Before a disk is written or rewritten the
+ * blob is exercised against the driver for real -- a temporary disk is built
+ * from it, a marker file written, read back and removed -- and a blob that
+ * fails that round trip is refused with `invalid_credentials`. A custom
+ * endpoint is checked for public reachability earlier still, in the form
+ * request, so an endpoint aimed at the loopback interface or a metadata service
+ * never reaches the point where the server would sign a request to it.
+ *
+ * Every endpoint here is gated on the same ability.
+ */
+class DiskController extends Controller
+{
+    public function __construct(
+        private readonly FileDiskService $fileDiskService,
+    ) {}
+
+    /**
+     * A page of registered disks, newest first.
+     *
+     * The raw input goes to the filter scope untouched, so `search` (matched
+     * against both the name and the driver), the date range and the order pair
+     * are all read there. A `limit` of "all" makes the pagination scope hand
+     * back the whole collection instead of a paginator; with no `limit` a page
+     * holds five.
+     *
+     * KNOWN DEFECT, same shape as the tax-type listing: asking for an order
+     * without naming a field falls back to a `sequence_number` column this
+     * table does not have. The safe-ordering helper drops the clause instead of
+     * failing, so the request succeeds in whatever order the database chose.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('manage file disk');
+
+        $perPage = $request->has('limit') ? $request->limit : 5;
+
+        $page = FileDisk::applyFilters($request->all())
+            ->latest()
+            ->paginateData($perPage);
+
+        return FileDiskResource::collection($page);
+    }
+
+    /**
+     * Register a new disk, once its credentials have been proven to work.
+     *
+     * The live check runs before anything is written, so a disk row only ever
+     * exists for credentials that succeeded at least once. Asking for the new
+     * disk to be the default clears the flag everywhere else first -- exactly
+     * one row carries it at any moment.
+     *
+     * The reply is 201 with the row as it was created, which means `type` reads
+     * as null: the column's default is filled in by the database and the
+     * in-memory model is not refreshed to see it.
+     */
+    public function store(DiskEnvironmentRequest $request): JsonResponse|FileDiskResource
+    {
+        $this->authorize('manage file disk');
+
+        if (! $this->fileDiskService->validateCredentials($request->credentials, $request->driver)) {
+            return respondJson('invalid_credentials', 'Invalid Credentials.');
+        }
+
+        $disk = $this->fileDiskService->create($request);
+
+        return new FileDiskResource($disk);
+    }
+
+    /**
+     * Rewrite a disk, or just hand it the default flag.
+     *
+     * Which of those happens is decided by what the body carries. Credentials
+     * and a driver together mean a rewrite, and the new blob is proven live
+     * first. Without both, the only thing this endpoint will do is move the
+     * default flag -- and it does that only when the body asks for it.
+     *
+     * System disks never take the first branch whatever the body says: their
+     * credentials point at the two built-in local trees and rewriting them
+     * would strand every file already stored there. They fall through to the
+     * flag, which is the one thing about them that is allowed to change.
+     *
+     * The payload is built from the model as it stands in memory. On the
+     * set-default branch that is the saved state; on a no-op call it is simply
+     * the row as loaded. This is not validated input -- no form request stands
+     * in front of this route -- so a rewrite accepts whatever name, driver and
+     * credential shape the caller sent, and the live check is the only filter.
+     */
+    public function update(FileDisk $disk, Request $request): JsonResponse|FileDiskResource
+    {
+        $this->authorize('manage file disk');
+
+        $credentials = $request->credentials;
+        $driver = $request->driver;
+
+        if ($credentials && $driver && ! $disk->isSystem()) {
+            if (! $this->fileDiskService->validateCredentials($credentials, $driver)) {
+                return respondJson('invalid_credentials', 'Invalid Credentials.');
+            }
+
+            $this->fileDiskService->update($disk, $request);
+        } elseif ($request->set_as_default) {
+            $this->fileDiskService->setAsDefault($disk);
+        }
+
+        return new FileDiskResource($disk);
+    }
+
+    /**
+     * The empty credential form for a driver -- field names in the order the
+     * edit screen should draw them, every value blank.
+     *
+     * The route segment is the driver name, not a disk id: nothing is loaded
+     * and nothing existing is read. A driver nobody wrote a form for answers
+     * with an empty JSON array rather than an empty object.
+     *
+     * KNOWN DEFECT: the S3-compatible arm has no break, so a request for it
+     * falls through and is answered with the DigitalOcean Spaces form. The two
+     * carry the same field names in a different order, so the screen still
+     * works and the endpoint-first ordering written for the compatible driver
+     * never reaches a client. Reproduced as found.
+     */
+    public function show($disk): JsonResponse
+    {
+        $this->authorize('manage file disk');
+
+        $template = [];
+
+        switch ($disk) {
+            case 'local':
+                // Relative to storage/app -- "backups" lands in
+                // storage/app/backups once the disk is registered at runtime.
+                $template = [
+                    'root' => '',
+                ];
+
+                break;
+
+            case 's3':
+                $template = [
+                    'key' => '',
+                    'secret' => '',
+                    'region' => '',
+                    'bucket' => '',
+                    'root' => '',
+                ];
+
+                break;
+
+            case 's3compat':
+                $template = [
+                    'endpoint' => '',
+                    'key' => '',
+                    'secret' => '',
+                    'region' => '',
+                    'bucket' => '',
+                    'root' => '',
+                ];
+
+                // Falls through -- see the note above.
+
+            case 'doSpaces':
+                $template = [
+                    'key' => '',
+                    'secret' => '',
+                    'region' => '',
+                    'bucket' => '',
+                    'endpoint' => '',
+                    'root' => '',
+                ];
+
+                break;
+
+            case 'dropbox':
+                $template = [
+                    'token' => '',
+                    'key' => '',
+                    'secret' => '',
+                    'app' => '',
+                    'root' => '',
+                ];
+
+                break;
+        }
+
+        return response()->json(array_merge($template));
+    }
+
+    /**
+     * Unregister a disk, if nothing depends on it.
+     *
+     * Three refusals, in order: the two seeded system disks are permanent; the
+     * disk new uploads currently land on has to be replaced before it can go;
+     * and a disk that still holds media would leave those files unreachable, so
+     * the count is reported back and the operator is sent to migrate them
+     * first.
+     *
+     * The media check looks under two names, because files were written under
+     * the dynamic-prefix scheme in one era and under the bare driver name in
+     * another. Note what that means: it counts by *driver*, not by disk, so two
+     * local disks are indistinguishable here and files on either one block
+     * deleting the other.
+     */
+    public function destroy(FileDisk $disk): JsonResponse
+    {
+        $this->authorize('manage file disk');
+
+        if ($disk->isSystem()) {
+            return respondJson('not_allowed', 'System disks cannot be deleted.');
+        }
+
+        // Reads the flag despite the name -- it is an accessor, not a setter.
+        if ($disk->setAsDefault()) {
+            return respondJson('not_allowed', 'The default disk cannot be deleted.');
+        }
+
+        $dynamicName = env('DYNAMIC_DISK_PREFIX', 'temp_').$disk->driver;
+
+        $fileCount = DB::table('media')->where('disk', $dynamicName)->orWhere('disk', $disk->driver)->count();
+
+        if ($fileCount > 0) {
+            return respondJson('disk_has_files', 'Cannot delete this disk — it contains '.$fileCount.' file(s). Migrate files first.');
+        }
+
+        $disk->delete();
+
+        return response()->json([
+            'success' => true,
+        ]);
+    }
+
+    /**
+     * The drivers the disk form offers, plus which one the current default disk
+     * uses so the form can preselect it. Falls back to the local driver when no
+     * disk is flagged as default.
+     */
+    public function getDiskDrivers(): JsonResponse
+    {
+        $this->authorize('manage file disk');
+
+        $drivers = [
+            ['name' => 'Local', 'value' => 'local'],
+            ['name' => 'Amazon S3', 'value' => 's3'],
+            ['name' => 'S3 Compatible Storage', 'value' => 's3compat'],
+            ['name' => 'Digital Ocean Spaces', 'value' => 'doSpaces'],
+            ['name' => 'Dropbox', 'value' => 'dropbox'],
+        ];
+
+        return response()->json([
+            'drivers' => $drivers,
+            'default' => $this->defaultDisk()?->driver ?? 'local',
+        ]);
+    }
+
+    /**
+     * Which disk each of the three jobs currently uses: new media, generated
+     * PDFs, and backups.
+     *
+     * A job with no setting of its own reads as the default disk, so the screen
+     * shows what would actually be used rather than a blank. A stored setting
+     * comes back as the string it was saved as, while the fallback is the
+     * numeric id off the model -- so the three keys are not uniformly typed.
+     */
+    public function getDiskPurposes(): JsonResponse
+    {
+        $this->authorize('manage file disk');
+
+        $fallback = $this->defaultDisk()?->id;
+
+        return response()->json([
+            'media_disk_id' => Setting::getSetting('media_disk_id') ?? $fallback,
+            'pdf_disk_id' => Setting::getSetting('pdf_disk_id') ?? $fallback,
+            'backup_disk_id' => Setting::getSetting('backup_disk_id') ?? $fallback,
+        ]);
+    }
+
+    /**
+     * Point one or more of those jobs at a different disk.
+     *
+     * Each key is written only if the body mentions it, so a caller may move
+     * one job without disturbing the others; a key sent as null clears the
+     * setting, which puts that job back on the default disk. Ids are checked
+     * against the table, but nothing checks that the chosen disk is a sensible
+     * home for the job -- pointing backups at a disk the backup subsystem does
+     * not know surfaces only when a run is attempted.
+     */
+    public function updateDiskPurposes(Request $request): JsonResponse
+    {
+        $this->authorize('manage file disk');
+
+        $purposes = ['media_disk_id', 'pdf_disk_id', 'backup_disk_id'];
+
+        $request->validate(array_fill_keys($purposes, ['nullable', 'exists:file_disks,id']));
+
+        foreach ($purposes as $purpose) {
+            if ($request->has($purpose)) {
+                Setting::setSetting($purpose, $request->input($purpose));
+            }
+        }
+
+        return response()->json(['success' => true]);
+    }
+
+    /**
+     * The single disk carrying the default flag, if there is one.
+     */
+    private function defaultDisk(): ?FileDisk
+    {
+        return FileDisk::query()->where('set_as_default', true)->first();
+    }
+}
diff --git a/app/Platform/Storage/Http/Middleware/ConfigMiddleware.php b/app/Platform/Storage/Http/Middleware/ConfigMiddleware.php
new file mode 100644
index 00000000..f2e68f38
--- /dev/null
+++ b/app/Platform/Storage/Http/Middleware/ConfigMiddleware.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Platform\Storage\Http\Middleware;
+
+use App\Platform\Operations\Installation\Application\InstallationState;
+use App\Platform\Storage\Models\FileDisk;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Lets a request name the storage target it wants to work against.
+ *
+ * A `file_disk_id` anywhere in the input -- query string or body -- points at a
+ * registered disk, and that disk's credentials are pushed into the runtime
+ * filesystem configuration before the route runs. It is what makes the backup
+ * endpoints able to list, fetch and delete archives on a disk other than the
+ * default one without any of them configuring anything themselves.
+ *
+ * Two silences are deliberate. An id that matches no row is ignored rather than
+ * refused, so the request carries on against whatever disk was already
+ * configured; and the whole step is skipped until the installer has built the
+ * schema, because there is no table to read a disk from before that. Nothing
+ * happens here for a request that names no disk either -- the default disk is
+ * registered once during application bootstrap.
+ *
+ * The switch is global: this runs on every request the application handles, not
+ * just the storage routes.
+ */
+class ConfigMiddleware
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (InstallationState::isDbCreated() && $request->has('file_disk_id')) {
+            $requested = FileDisk::find($request->file_disk_id);
+
+            $requested?->setConfig();
+        }
+
+        return $next($request);
+    }
+}
diff --git a/app/Platform/Storage/Http/Requests/DiskEnvironmentRequest.php b/app/Platform/Storage/Http/Requests/DiskEnvironmentRequest.php
new file mode 100644
index 00000000..5977763f
--- /dev/null
+++ b/app/Platform/Storage/Http/Requests/DiskEnvironmentRequest.php
@@ -0,0 +1,111 @@
+<?php
+
+namespace App\Platform\Storage\Http\Requests;
+
+use App\Rules\PublicHttpUrl;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * Shapes the body that registers a new storage target.
+ *
+ * Only the label and the driver are asked of every caller. What a driver needs
+ * beyond that varies, so the credential rules are picked from the driver named
+ * in the body and merged underneath the two common ones -- which also means a
+ * driver nobody wrote rules for sails through with whatever credential blob it
+ * was handed, and is caught later (if at all) by the live credential check the
+ * controller runs.
+ *
+ * Where a driver takes a custom endpoint the server will later sign requests
+ * against, the value has to be a URL that resolves somewhere publicly routable:
+ * these credentials are supplied by an administrator and exercised server-side,
+ * so an endpoint pointed at the loopback interface or a cloud metadata address
+ * would turn disk registration into a request forgery primitive.
+ *
+ * KNOWN GAP: the S3-compatible driver takes an endpoint too and has no rules
+ * here at all, so its endpoint reaches the live check unguarded. Preserved as
+ * found.
+ */
+class DiskEnvironmentRequest extends FormRequest
+{
+    /**
+     * Gatekeeping happens in the controller, so let every caller through here.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    public function rules(): array
+    {
+        $credentials = [];
+
+        switch ($this->get('driver')) {
+            case 's3':
+                $credentials = $this->amazonRules();
+
+                break;
+
+            case 'doSpaces':
+                $credentials = $this->spacesRules();
+
+                break;
+
+            case 'dropbox':
+                $credentials = $this->dropboxRules();
+
+                break;
+        }
+
+        return array_merge($credentials, [
+            'name' => ['required'],
+            'driver' => ['required'],
+        ]);
+    }
+
+    /**
+     * Amazon S3 proper. The endpoint is optional here -- leaving it out means
+     * the region alone decides which host the SDK talks to.
+     */
+    private function amazonRules(): array
+    {
+        return [
+            'credentials.key' => ['required', 'string'],
+            'credentials.secret' => ['required', 'string'],
+            'credentials.region' => ['required', 'string'],
+            'credentials.bucket' => ['required', 'string'],
+            'credentials.endpoint' => ['nullable', 'string', 'url', new PublicHttpUrl],
+            'credentials.root' => ['required', 'string'],
+        ];
+    }
+
+    /**
+     * DigitalOcean Spaces speaks the S3 protocol but always against its own
+     * host, so the endpoint is mandatory rather than optional.
+     */
+    private function spacesRules(): array
+    {
+        return [
+            'credentials.key' => ['required', 'string'],
+            'credentials.secret' => ['required', 'string'],
+            'credentials.region' => ['required', 'string'],
+            'credentials.bucket' => ['required', 'string'],
+            'credentials.endpoint' => ['required', 'string', 'url', new PublicHttpUrl],
+            'credentials.root' => ['required', 'string'],
+        ];
+    }
+
+    /**
+     * Dropbox: an access token plus the app identity it was issued for. No
+     * endpoint, so nothing for the reachability rule to inspect.
+     */
+    private function dropboxRules(): array
+    {
+        return [
+            'credentials.token' => ['required', 'string'],
+            'credentials.key' => ['required', 'string'],
+            'credentials.secret' => ['required', 'string'],
+            'credentials.app' => ['required', 'string'],
+            'credentials.root' => ['required', 'string'],
+        ];
+    }
+}
diff --git a/app/Platform/Storage/Http/Resources/FileDiskCollection.php b/app/Platform/Storage/Http/Resources/FileDiskCollection.php
new file mode 100644
index 00000000..4a39e637
--- /dev/null
+++ b/app/Platform/Storage/Http/Resources/FileDiskCollection.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Platform\Storage\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+/**
+ * A page of storage targets.
+ *
+ * Named after its member resource, so rows would be published through
+ * FileDiskResource and the pagination envelope would come from the framework.
+ * Nothing constructs it today -- the listing endpoint calls
+ * FileDiskResource::collection() and gets the framework's anonymous collection
+ * instead -- so this class is carried for the sake of the pairing every other
+ * resource in the codebase has.
+ */
+class FileDiskCollection extends ResourceCollection
+{
+    /**
+     * @param  Request  $request
+     */
+    public function toArray($request): array
+    {
+        return parent::toArray($request);
+    }
+}
diff --git a/app/Platform/Storage/Http/Resources/FileDiskResource.php b/app/Platform/Storage/Http/Resources/FileDiskResource.php
new file mode 100644
index 00000000..d89c3d50
--- /dev/null
+++ b/app/Platform/Storage/Http/Resources/FileDiskResource.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Platform\Storage\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * A registered storage target as the admin API publishes it.
+ *
+ * Everything the disks screen needs to draw a row and reopen the edit form:
+ * the label an operator picked, whether the row is one of the two seeded
+ * system disks or one they added, which driver backs it, and whether it is the
+ * one new uploads currently land on.
+ *
+ * `credentials` travels as the raw column value -- a JSON string, not a decoded
+ * object -- so secrets such as an S3 secret key or a Dropbox token are handed
+ * back verbatim to anyone allowed to read the listing. That is the established
+ * payload and the edit form depends on it, so it is kept; the ability gate in
+ * front of every endpoint is the only thing keeping those values in.
+ *
+ * `company_id` is stamped from the request header at creation time and is never
+ * used to narrow anything afterwards, which is why a disk created inside one
+ * workspace still shows up for every other one.
+ */
+class FileDiskResource extends JsonResource
+{
+    /**
+     * @param  Request  $request
+     */
+    public function toArray($request): array
+    {
+        $fileDisk = $this->resource;
+
+        return [
+            'id' => $fileDisk->id,
+            'name' => $fileDisk->name,
+            'type' => $fileDisk->type,
+            'driver' => $fileDisk->driver,
+            'set_as_default' => $fileDisk->set_as_default,
+            'credentials' => $fileDisk->credentials,
+            'company_id' => $fileDisk->company_id,
+        ];
+    }
+}
diff --git a/app/Platform/Storage/Jobs/CreateBackupJob.php b/app/Platform/Storage/Jobs/CreateBackupJob.php
new file mode 100644
index 00000000..7735f8bd
--- /dev/null
+++ b/app/Platform/Storage/Jobs/CreateBackupJob.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Platform\Storage\Jobs;
+
+use App\Platform\Storage\Application\BackupConfigurationFactory;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Spatie\Backup\Tasks\Backup\BackupJobFactory;
+
+/**
+ * Runs one backup against the disk named in the request payload.
+ */
+class CreateBackupJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    protected $data;
+
+    public function __construct($data = [])
+    {
+        $this->data = $data;
+    }
+
+    /**
+     * Assemble the backup task, narrow it to the requested option and run it.
+     */
+    public function handle(): void
+    {
+        $job = BackupJobFactory::createFromConfig(
+            BackupConfigurationFactory::make($this->data)
+        );
+
+        if (! defined('SIGINT')) {
+            $job->disableSignals();
+        }
+
+        $option = $this->data['option'];
+
+        if ($option === 'only-db') {
+            $job->dontBackupFilesystem();
+        }
+
+        if ($option === 'only-files') {
+            $job->dontBackupDatabases();
+        }
+
+        if (! empty($option)) {
+            $job->setFilename(str_replace('_', '-', $option).'-'.date('Y-m-d-H-i-s').'.zip');
+        }
+
+        $job->run();
+    }
+}
diff --git a/app/Platform/Storage/Models/FileDisk.php b/app/Platform/Storage/Models/FileDisk.php
new file mode 100644
index 00000000..c6e7b099
--- /dev/null
+++ b/app/Platform/Storage/Models/FileDisk.php
@@ -0,0 +1,168 @@
+<?php
+
+namespace App\Platform\Storage\Models;
+
+use App\Platform\Storage\Application\FileDiskService;
+use App\Support\SafeOrderBy;
+use Carbon\Carbon;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Collection;
+
+/**
+ * A named storage target: a driver plus the credential blob that configures it.
+ */
+class FileDisk extends Model
+{
+    use HasFactory;
+
+    public const DISK_TYPE_SYSTEM = 'SYSTEM';
+
+    public const DISK_TYPE_REMOTE = 'REMOTE';
+
+    protected $table = 'file_disks';
+
+    protected $guarded = ['id'];
+
+    protected function casts(): array
+    {
+        return ['set_as_default' => 'boolean'];
+    }
+
+    public function setCredentialsAttribute(mixed $value): void
+    {
+        $this->attributes['credentials'] = json_encode($value);
+    }
+
+    /**
+     * Read the credential blob back as a collection.
+     *
+     * Rows written by older releases hold a JSON string *inside* the JSON
+     * column, so a first decode that yields a string is decoded once more.
+     */
+    public function getDecodedCredentials(): Collection
+    {
+        $payload = json_decode($this->credentials, true);
+
+        if (is_string($payload)) {
+            $payload = json_decode($payload, true);
+        }
+
+        return collect($payload ?? []);
+    }
+
+    public function scopeWhereOrder($query, $orderByField, $orderBy)
+    {
+        SafeOrderBy::apply($query, $orderByField, $orderBy);
+    }
+
+    public function scopeFileDisksBetween($query, $start, $end)
+    {
+        return $query->whereBetween('file_disks.created_at', [
+            $start->format('Y-m-d'),
+            $end->format('Y-m-d'),
+        ]);
+    }
+
+    public function scopeWhereSearch($query, $search)
+    {
+        foreach (explode(' ', $search) as $keyword) {
+            $like = '%'.$keyword.'%';
+
+            $query->where('name', 'LIKE', $like)->orWhere('driver', 'LIKE', $like);
+        }
+    }
+
+    public function scopePaginateData($query, $limit)
+    {
+        return $limit == 'all'
+            ? $query->get()
+            : $query->paginate($limit);
+    }
+
+    public function scopeApplyFilters($query, array $filters)
+    {
+        $criteria = collect($filters);
+
+        if ($criteria->get('search')) {
+            $query->whereSearch($criteria->get('search'));
+        }
+
+        if ($criteria->get('from_date') && $criteria->get('to_date')) {
+            $query->fileDisksBetween(
+                Carbon::createFromFormat('Y-m-d', $criteria->get('from_date')),
+                Carbon::createFromFormat('Y-m-d', $criteria->get('to_date'))
+            );
+        }
+
+        if ($criteria->get('orderByField') || $criteria->get('orderBy')) {
+            $query->whereOrder(
+                $criteria->get('orderByField') ?: 'sequence_number',
+                $criteria->get('orderBy') ?: 'asc'
+            );
+        }
+    }
+
+    /**
+     * Register this disk and point the runtime filesystem default at it.
+     *
+     * @deprecated Reach for FileDiskService::registerDisk(); this variant also
+     * rewrites filesystems.default, which leaks into unrelated storage calls.
+     */
+    public function setConfig(): void
+    {
+        $registered = app(FileDiskService::class)->registerDisk($this);
+
+        config(['filesystems.default' => $registered]);
+    }
+
+    /**
+     * Whether this row is flagged as the installation-wide default disk.
+     */
+    public function setAsDefault(): bool
+    {
+        return $this->set_as_default;
+    }
+
+    /**
+     * Publish a throwaway disk built from the driver's base config overlaid
+     * with the supplied credentials, and select it as the runtime default.
+     *
+     * @deprecated Register a persisted row through FileDiskService instead.
+     */
+    public static function setFilesystem(Collection $credentials, string $driver): void
+    {
+        $target = env('DYNAMIC_DISK_PREFIX', 'temp_').$driver;
+
+        config(['filesystems.default' => $target]);
+
+        $settings = config('filesystems.disks.'.$driver);
+
+        foreach ($settings as $field => $current) {
+            if ($credentials->has($field)) {
+                $settings[$field] = $credentials[$field];
+            }
+        }
+
+        if ($driver === 'local' && isset($settings['root']) && ! str_starts_with($settings['root'], '/')) {
+            $settings['root'] = storage_path('app/'.$settings['root']);
+        }
+
+        config(['filesystems.disks.'.$target => $settings]);
+    }
+
+    public function isSystem(): bool
+    {
+        return $this->hasType(self::DISK_TYPE_SYSTEM);
+    }
+
+    public function isRemote(): bool
+    {
+        return $this->hasType(self::DISK_TYPE_REMOTE);
+    }
+
+    private function hasType(string $expected): bool
+    {
+        return $this->type === $expected;
+    }
+}
diff --git a/app/Platform/Storage/Rules/BackupDisk.php b/app/Platform/Storage/Rules/BackupDisk.php
new file mode 100644
index 00000000..5f925ad9
--- /dev/null
+++ b/app/Platform/Storage/Rules/BackupDisk.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Platform\Storage\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+/**
+ * Accepts only a disk the backup package is configured to write archives to.
+ */
+class BackupDisk implements ValidationRule
+{
+    public function __construct() {}
+
+    /**
+     * Reject anything outside the configured backup destinations.
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        $destinations = config('backup.backup.destination.disks');
+
+        if (! in_array($value, $destinations)) {
+            $fail('This disk is not configured as a backup disk.');
+        }
+    }
+}
diff --git a/app/Platform/Storage/Rules/FilesystemDisks.php b/app/Platform/Storage/Rules/FilesystemDisks.php
new file mode 100644
index 00000000..e234374a
--- /dev/null
+++ b/app/Platform/Storage/Rules/FilesystemDisks.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Platform\Storage\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+/**
+ * Accepts only a disk name that is present in the filesystem configuration.
+ */
+class FilesystemDisks implements ValidationRule
+{
+    public function __construct() {}
+
+    /**
+     * Reject anything that is not a registered filesystem disk.
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        $registered = array_keys(config('filesystems.disks'));
+
+        if (! in_array($value, $registered)) {
+            $fail('This disk is not configured as a filesystem disk.');
+        }
+    }
+}
diff --git a/app/Platform/Storage/Rules/PathToZip.php b/app/Platform/Storage/Rules/PathToZip.php
new file mode 100644
index 00000000..361b2a86
--- /dev/null
+++ b/app/Platform/Storage/Rules/PathToZip.php
@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Platform\Storage\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Support\Str;
+
+/**
+ * Accepts only a path that names a zip archive.
+ */
+class PathToZip implements ValidationRule
+{
+    public function __construct() {}
+
+    /**
+     * Reject any path that does not carry the zip extension.
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (Str::endsWith($value, '.zip')) {
+            return;
+        }
+
+        $fail('The given value must be a path to a zip file.');
+    }
+}