diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index f85c17cc..a66e3252 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -70,14 +70,6 @@ All server-side query state (progress, rows, status) is held in a module-level `
 
 ---
 
-### Single-file download limit
-
-**File:** `src/lib/storage/download.ts`, `src/lib/components/storage/FileExplorer.svelte`
-
-The Download action is intentionally restricted to a single file at a time. Multi-file or folder downloads (e.g. zipping selected items on the fly) are deferred to a future ticket. Until then, the Download button is disabled whenever more than one item is selected and is always disabled for directories.
-
----
-
 ### Completed query results are ephemeral (default 30-minute TTL)
 
 **File:** `src/lib/server/trino/queries.ts:20`
@@ -122,6 +114,14 @@ Mobile viewport tests (393×851, touch-enabled) are excluded from CI runs to red
 
 ## Infrastructure
 
+### Storage search is a bounded provider scan, not an index
+
+**Files:** `src/lib/server/storage/s3-provider.ts`, `src/routes/(app)/api/storage/search/+server.ts`
+
+Bucket-scoped object search recursively lists provider keys and matches paths in process. The 50-result and 10,000-scanned-key caps, plus request abort support, bound resource use for now but can miss later matches in very large buckets. The long-term fix is an optional, provider-aware search index or asynchronously maintained object catalogue.
+
+---
+
 ### No Content Security Policy headers
 
 No CSP headers are set anywhere. This leaves the app exposed to XSS in ways that a strict CSP would mitigate. Should be added in a SvelteKit hook once the app stabilises.
@@ -136,6 +136,14 @@ The dev server accepts requests from any host. This enables DNS rebinding attack
 
 ---
 
+### Archived downloads are sent without Content-Length
+
+**File:** `src/lib/server/storage/download-manifests.ts`
+
+The exact byte size of a streamed ZIP archive is only known after it has been produced, so the server no longer pre-computes or persists an archive size (`computeZipArchiveSize` and the `archive_size` column were removed). Archive part responses are therefore sent chunked without `Content-Length`; browsers show an indeterminate download size for `.zip` files. The download history UI reports the uncompressed payload total instead. Acceptable now because ZIP archives use the STORE method (no compression) and progress display is not critical. Long-term fix, if size reporting is wanted: compute the exact archive length server-side in a single pass before responding, e.g. by streaming to a temp file, at the cost of doubled I/O.
+
+---
+
 ### Archive browsing downloads entire file before parsing
 
 **File:** `src/lib/server/storage/archive.ts`
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 534e789c..4ca76a94 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -28,7 +28,7 @@ RUN NODEJS_VERSION=$(cat /tmp/.node-version) && \
         *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
     esac && \
     microdnf update -y && \
-    microdnf install -y curl tar gzip && \
+    microdnf install -y curl tar gzip zip && \
     microdnf clean all && \
     curl -fsSL "https://nodejs.org/dist/v${NODEJS_VERSION}/node-v${NODEJS_VERSION}-linux-${NODEJS_ARCH}.tar.gz" \
         | tar -xzf - --strip-components=1 -C /usr/local
diff --git a/e2e/storage/download.spec.ts b/e2e/storage/download.spec.ts
index 5c9f1037..050bd157 100644
--- a/e2e/storage/download.spec.ts
+++ b/e2e/storage/download.spec.ts
@@ -80,4 +80,84 @@ test.describe('Storage S3 — Download', () => {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
   });
+
+  test('downloads up to three selected files individually', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'dl-multiple');
+    const cleanupKeys = ['one.txt', 'two.txt', 'three.txt'].map((name) => `${prefix}${name}`);
+
+    try {
+      await Promise.all(
+        cleanupKeys.map((key) => putTextObject(client, credentials.bucket, key, key))
+      );
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      for (const name of ['one.txt', 'two.txt', 'three.txt']) {
+        await page.getByLabel(`Select ${name}`).check();
+      }
+
+      const downloads: string[] = [];
+      page.on('download', (download) => downloads.push(download.suggestedFilename()));
+      await page.getByRole('button', { name: 'Download', exact: true }).click();
+      await expect.poll(() => downloads.sort()).toEqual(['one.txt', 'three.txt', 'two.txt']);
+      expect(downloads.sort()).toEqual(['one.txt', 'three.txt', 'two.txt']);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('archives a selection larger than three files', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'dl-archive');
+    const cleanupKeys = ['one.txt', 'two.txt', 'three.txt', 'four.txt'].map(
+      (name) => `${prefix}${name}`
+    );
+
+    try {
+      await Promise.all(
+        cleanupKeys.map((key) => putTextObject(client, credentials.bucket, key, key))
+      );
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      for (const name of ['one.txt', 'two.txt', 'three.txt', 'four.txt']) {
+        await page.getByLabel(`Select ${name}`).check();
+      }
+
+      const [download] = await Promise.all([
+        page.waitForEvent('download'),
+        page.getByRole('button', { name: 'Download', exact: true }).click()
+      ]);
+      expect(download.suggestedFilename()).toMatch(/\.zip$/);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('downloads a folder via its context menu when not in selection mode', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'dl-folder');
+    const cleanupKeys = [`${prefix}folder1/one.txt`, `${prefix}folder1/two.txt`];
+
+    try {
+      await Promise.all(
+        cleanupKeys.map((key) => putTextObject(client, credentials.bucket, key, key))
+      );
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'folder1').click({ button: 'right' });
+
+      const downloadBtn = page.getByRole('menuitem', { name: 'Download' });
+      await expect(downloadBtn).not.toHaveAttribute('disabled');
+
+      const [download] = await Promise.all([page.waitForEvent('download'), downloadBtn.click()]);
+      expect(download.suggestedFilename()).toMatch(/\.zip$/);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
 });
diff --git a/e2e/storage/file-operations.spec.ts b/e2e/storage/file-operations.spec.ts
index 383bbc8d..ed313167 100644
--- a/e2e/storage/file-operations.spec.ts
+++ b/e2e/storage/file-operations.spec.ts
@@ -353,7 +353,8 @@ test.describe('Storage S3 — File Operations', () => {
     const prefix = uniquePrefix(testInfo, 'kb-cut-paste');
     const srcKey = `${prefix}cutsrc/`;
     const srcFile = `${srcKey}cut-kb.txt`;
-    const cleanupKeys = [srcFile];
+    const destFile = `${prefix}cut-kb.txt`;
+    const cleanupKeys = [srcFile, destFile];
 
     try {
       await putDirectoryMarker(client, credentials.bucket, srcKey);
@@ -379,7 +380,7 @@ test.describe('Storage S3 — File Operations', () => {
       await page.waitForTimeout(1000);
 
       // File should exist at destination
-      expect(await objectExists(client, credentials.bucket, `${prefix}cut-kb.txt`)).toBe(true);
+      expect(await objectExists(client, credentials.bucket, destFile)).toBe(true);
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 0feb1a15..b1d6a855 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -159,6 +159,7 @@ export async function connectAndOpenPrefix(
  */
 export async function waitForObjectsLoaded(page: Page) {
   await waitForHydration(page);
+  await page.getByLabel('Loading…').waitFor({ state: 'hidden', timeout: 15_000 });
   await page
     .locator('tbody tr')
     .or(page.getByText('This bucket is empty'))
diff --git a/e2e/storage/search.spec.ts b/e2e/storage/search.spec.ts
new file mode 100644
index 00000000..195f9643
--- /dev/null
+++ b/e2e/storage/search.spec.ts
@@ -0,0 +1,178 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  bucketRoute,
+  connectAndOpenPrefix,
+  connectToStorage,
+  deleteKnownKeys,
+  putDirectoryMarker,
+  putTextObject,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage Search', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('searches the current bucket, runs parallel sessions, and opens matching results', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'search');
+    const directory = `${prefix}reports/`;
+    const file = `${directory}final-report.txt`;
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, directory);
+      await putTextObject(client, credentials.bucket, file, 'search preview');
+      await connectToStorage(page, credentials);
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByLabel('Search query').fill('report');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+
+      await expect(page.getByText(/2 results/)).toBeVisible();
+      await page.getByRole('button', { name: /reports.*\/reports\// }).click();
+      await expect(page).toHaveURL(bucketRoute(credentials.bucket, directory));
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByRole('button', { name: 'Parallel search' }).click();
+      await expect(page.getByRole('navigation', { name: 'Search sessions' })).toBeVisible();
+      await page.getByLabel('Search query').fill('final-report');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+      await page
+        .getByRole('button', { name: /final-report\.txt.*\/reports\/final-report\.txt/ })
+        .click();
+      const previewDialog = page.getByRole('dialog').filter({ hasText: 'final-report.txt' });
+      await expect(previewDialog).toContainText('final-report.txt');
+      await previewDialog.getByLabel('Close', { exact: true }).click();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [directory, file]);
+    }
+  });
+
+  test('searches all buckets from the landing page', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'landing-search');
+    const file = `${prefix}landing-report.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, file, 'landing search');
+      await connectToStorage(page, credentials);
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByLabel('Search query').fill('landing-report');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+
+      await expect(page.getByRole('button', { name: 'landing-report.txt' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [file]);
+    }
+  });
+
+  test('paginates search results', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'paginate-search');
+    const keys: string[] = [];
+
+    try {
+      for (let index = 1; index <= 30; index += 1) {
+        const key = `${prefix}report-${String(index).padStart(2, '0')}.txt`;
+        keys.push(key);
+        await putTextObject(client, credentials.bucket, key, `report ${index}`);
+      }
+      await connectToStorage(page, credentials);
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByLabel('Search query').fill('report-');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+      await page.getByLabel('Items per page').selectOption('25');
+
+      await expect(page.getByText('Page 1', { exact: true })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'report-01.txt' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'report-26.txt' })).not.toBeVisible();
+
+      await page.getByRole('button', { name: 'Next page' }).click();
+      await expect(page.getByText('Page 2', { exact: true })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'report-26.txt' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'report-01.txt' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, keys);
+    }
+  });
+
+  test('filters and selects buckets via the bucket dropdown', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'bucket-scope');
+    const file = `${prefix}scoped-report.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, file, 'scoped search');
+      await connectToStorage(page, credentials);
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+
+      const trigger = page.getByRole('button', { name: 'all buckets', exact: true });
+      await expect(trigger).toBeVisible();
+      await trigger.click();
+
+      await page.getByLabel('Filter buckets').fill(credentials.bucket);
+      await page
+        .getByRole('button', { name: `Include ${credentials.bucket} in search`, exact: true })
+        .click();
+      await expect(
+        page.getByRole('button', { name: credentials.bucket, exact: true })
+      ).toBeVisible();
+
+      await page.getByLabel('Search query').fill('scoped-report');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+      await expect(page.getByRole('button', { name: 'scoped-report.txt' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [file]);
+    }
+  });
+
+  test('shows recent searches in the recent view and reuses one', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'recent');
+    const file = `${prefix}recent-report.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, file, 'recent search');
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByLabel('Search query').fill('recent-report');
+      await page.getByRole('button', { name: 'Search', exact: true }).click();
+      await expect(page.getByRole('button', { name: 'recent-report.txt' }).first()).toBeVisible();
+
+      await page.getByRole('button', { name: 'Close search' }).click();
+      await page.getByRole('button', { name: 'Open search' }).first().click();
+      await page.getByRole('tab', { name: 'Recent', exact: true }).click();
+      await expect(page.getByRole('button', { name: /recent-report/ }).first()).toBeVisible();
+
+      await page
+        .getByRole('button', { name: /recent-report/ })
+        .first()
+        .click();
+      await expect(page.getByLabel('Search query')).toHaveValue('recent-report');
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [file]);
+    }
+  });
+});
diff --git a/eslint.config.js b/eslint.config.js
index 543938a6..12b85c09 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -62,7 +62,8 @@ export default ts.config(
             'menu-disabled',
             'tab-active',
             'tab-strip',
-            'preview-scroll'
+            'preview-scroll',
+            'modal-top-search'
           ]
         }
       ]
diff --git a/messages/de.json b/messages/de.json
index 26b678a7..b0fec1ed 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -253,6 +253,7 @@
   "storage_paste": "{count} Element einfügen",
   "storage_paste_plural": "{count} Elemente einfügen",
   "storage_selected": "{count} ausgewählt",
+  "storage_selected_files_size": "Ausgewählte Dateien: {size}",
   "storage_action_preview": "Vorschau",
   "storage_action_actions_for": "Aktionen für {name}",
   "storage_action_refresh": "Aktualisieren",
@@ -310,6 +311,17 @@
   "storage_download_error_server_error": "Beim Herunterladen der Datei ist ein Serverfehler aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_error_unknown": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_dismiss": "Schließen",
+  "storage_download_history_title": "Download-Verlauf",
+  "storage_download_history_empty": "Keine Downloads in den letzten 30 Tagen.",
+  "storage_download_history_file_count": "{count} Dateien",
+  "storage_download_history_zip": "ZIP",
+  "storage_download_history_direct": "Einzelne Dateien",
+  "storage_download_history_show_details": "Details anzeigen",
+  "storage_download_history_hide_details": "Details ausblenden",
+  "storage_download_history_file_not_found": "Fehlgeschlagen: Datei \"{path}\" wurde nicht gefunden",
+  "storage_download_history_selected_count": "{count} ausgewählt",
+  "storage_download_history_download_selected": "Ausgewählte herunterladen",
+  "storage_download_history_download_all": "Alle herunterladen",
   "storage_delete_confirm_title_one": "„{name}“ löschen?",
   "storage_delete_confirm_title_many": "{count} Elemente löschen?",
   "storage_delete_confirm_message": "Diese Aktion kann nicht rückgängig gemacht werden.",
@@ -668,6 +680,87 @@
   "storage_rename_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung zum Umbenennen.",
   "storage_rename_error_not_found": "Das Element wurde nicht gefunden. Es wurde möglicherweise verschoben oder gelöscht.",
   "storage_rename_error_conflict": "Eine Datei oder ein Ordner namens \"{name}\" ist an diesem Ort bereits vorhanden.",
+  "storage_search_open": "Suche öffnen",
+  "storage_search_title": "Speicher durchsuchen",
+  "storage_search_close": "Suche schließen",
+  "storage_search_query_label": "Suchbegriff",
+  "storage_search_query_placeholder": "Dateien und Verzeichnisse durchsuchen",
+  "storage_search_scope_label": "Bucket",
+  "storage_search_submit": "Suchen",
+  "storage_search_cancel": "Abbrechen",
+  "storage_search_recent_heading": "Letzte Suchen",
+  "storage_search_recent_empty": "Ihre letzten Suchen erscheinen hier.",
+  "storage_search_recent_clear": "Letzte Suchen löschen",
+  "storage_search_recent_clear_confirm_title": "Letzte Suchen löschen?",
+  "storage_search_recent_clear_confirm_message": "Dadurch werden alle letzten Suchen für diese Verbindung entfernt. Diese Aktion kann nicht rückgängig gemacht werden.",
+  "storage_search_recent_clear_cancel": "Abbrechen",
+  "storage_search_recent_clear_confirm": "Löschen",
+  "storage_search_view_label": "Suchansicht",
+  "storage_search_tab_search": "Suchen",
+  "storage_search_tab_recent": "Letzte",
+  "storage_search_no_results": "Keine Ergebnisse gefunden.",
+  "storage_search_failure_access_denied": "Der Zugriff auf einen oder mehrere ausgewählte Buckets wurde verweigert.",
+  "storage_search_failure_generic": "Ein oder mehrere ausgewählte Buckets konnten nicht durchsucht werden. Bitte versuchen Sie es erneut.",
+  "storage_search_session_label": "Suche {number}",
+  "storage_search_running": "{count} aktiv",
+  "storage_search_completed": "{count} abgeschlossen",
+  "storage_search_partial_count": "{count} teilweise",
+  "storage_search_add_session": "Parallele Suche",
+  "storage_search_sessions_label": "Suchsitzungen",
+  "storage_search_remove_session": "{name} entfernen",
+  "storage_search_status_running": "Aktiv",
+  "storage_search_status_done": "Fertig",
+  "storage_search_status_partial": "Teilweise",
+  "storage_search_status_error": "Fehler",
+  "storage_search_regex_placeholder": "Regulärer Ausdruck",
+  "storage_search_regex_badge": ".*",
+  "storage_search_regex_invalid": "Dieser reguläre Ausdruck ist ungültig oder verwendet nicht unterstützte Konstrukte.",
+  "storage_search_all_buckets": "alle Buckets",
+  "storage_search_scope_all": "Alle Buckets",
+  "storage_search_scope_filter_label": "Buckets filtern",
+  "storage_search_scope_filter_placeholder": "Buckets durchsuchen",
+  "storage_search_scope_no_results": "Keine Buckets gefunden",
+  "storage_search_scope_toggle": "{bucket} in die Suche einbeziehen",
+  "storage_search_recent_bucket_count": "{count} Buckets",
+  "storage_search_recent_more_buckets": "{count} weitere Buckets",
+  "storage_search_recent_toggle_buckets": "Buckets auswählen",
+  "storage_search_recent_bucket_all": "Alle Buckets",
+  "storage_search_recent_bucket_toggle": "{bucket} in diese Suche einbeziehen",
+  "storage_search_recent_use_selected": "Ausgewählte Buckets durchsuchen",
+  "storage_search_advanced_options": "Erweiterte Optionen",
+  "storage_search_regex_label": "Suche mit regulärem Ausdruck",
+  "storage_search_exclude_patterns": "Ausschlussmuster",
+  "storage_search_exclude_placeholder": "z. B. _temp",
+  "storage_search_remove_exclude": "{pattern} entfernen",
+  "storage_search_filters_label": "Filter",
+  "storage_search_filter_add": "Filter hinzufügen",
+  "storage_search_path_prefix": "Suchpfad-Präfix",
+  "storage_search_path_placeholder": "z. B. events/2024/",
+  "storage_search_max_depth": "Maximale Ordnertiefe",
+  "storage_search_depth_placeholder": "unbegrenzt",
+  "storage_search_searching": "Suche läuft...",
+  "storage_search_results_elapsed": "{count} Ergebnisse · {elapsed} ms",
+  "storage_search_result_type": "Typ",
+  "storage_search_keyboard_hint": "Eingabe: suchen · Strg/Cmd+T: neue Sitzung · Esc: schließen",
+  "storage_search_key_enter": "Eingabe",
+  "storage_search_key_escape": "Esc",
+  "storage_search_shortcut_search": "suchen",
+  "storage_search_shortcut_close": "schließen",
+  "storage_search_filter_field_label": "Filterfeld",
+  "storage_search_filter_date": "Datum",
+  "storage_search_filter_size": "Größe",
+  "storage_search_filter_invalid": "Geben Sie einen gültigen Filterwert ein",
+  "storage_search_filter_operator": "Filteroperator",
+  "storage_search_filter_value_size": "Größenfilterwert",
+  "storage_search_filter_size_placeholder": "z. B. 10 MB",
+  "storage_search_filter_value_date": "Datumsfilterwert",
+  "storage_search_filter_date_placeholder": "z. B. 2024-01-31",
+  "storage_search_filter_remove": "Filter entfernen",
+  "datepicker_open": "Datumsauswahl öffnen",
+  "datepicker_label": "Datumsauswahl",
+  "datepicker_previous_month": "Vorheriger Monat",
+  "datepicker_next_month": "Nächster Monat",
+  "datepicker_day_select": "{date} auswählen",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
diff --git a/messages/en.json b/messages/en.json
index 9f0592c9..35c9847f 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -253,6 +253,7 @@
   "storage_paste": "Paste {count} item",
   "storage_paste_plural": "Paste {count} items",
   "storage_selected": "{count} selected",
+  "storage_selected_files_size": "Selected files: {size}",
   "storage_action_preview": "Preview",
   "storage_action_actions_for": "Actions for {name}",
   "storage_action_refresh": "Refresh",
@@ -310,6 +311,17 @@
   "storage_download_error_server_error": "A server error occurred while downloading the file. Please try again.",
   "storage_download_error_unknown": "An unexpected error occurred. Please try again.",
   "storage_download_dismiss": "Dismiss",
+  "storage_download_history_title": "Download history",
+  "storage_download_history_empty": "No downloads in the last 30 days.",
+  "storage_download_history_file_count": "{count} files",
+  "storage_download_history_zip": "ZIP",
+  "storage_download_history_direct": "Individual files",
+  "storage_download_history_show_details": "Show details",
+  "storage_download_history_hide_details": "Hide details",
+  "storage_download_history_file_not_found": "Failed: File \"{path}\" cannot be found",
+  "storage_download_history_selected_count": "{count} selected",
+  "storage_download_history_download_selected": "Download selected",
+  "storage_download_history_download_all": "Download all",
   "storage_delete_confirm_title_one": "Delete \"{name}\"?",
   "storage_delete_confirm_title_many": "Delete {count} items?",
   "storage_delete_confirm_message": "This action cannot be undone.",
@@ -668,6 +680,87 @@
   "storage_rename_error_access_denied": "Access denied. You do not have permission to rename.",
   "storage_rename_error_not_found": "The item could not be found. It may have been moved or deleted.",
   "storage_rename_error_conflict": "A file or folder named \"{name}\" already exists in this location.",
+  "storage_search_open": "Open search",
+  "storage_search_title": "Search storage",
+  "storage_search_close": "Close search",
+  "storage_search_query_label": "Search query",
+  "storage_search_query_placeholder": "Search files and directories",
+  "storage_search_scope_label": "Bucket",
+  "storage_search_submit": "Search",
+  "storage_search_cancel": "Cancel",
+  "storage_search_recent_heading": "Recent searches",
+  "storage_search_recent_empty": "Your recent searches will appear here.",
+  "storage_search_recent_clear": "Clear recent searches",
+  "storage_search_recent_clear_confirm_title": "Clear recent searches?",
+  "storage_search_recent_clear_confirm_message": "This will remove all recent searches for this connection. This action cannot be undone.",
+  "storage_search_recent_clear_cancel": "Cancel",
+  "storage_search_recent_clear_confirm": "Clear",
+  "storage_search_view_label": "Search view",
+  "storage_search_tab_search": "Search",
+  "storage_search_tab_recent": "Recent",
+  "storage_search_no_results": "No results found.",
+  "storage_search_failure_access_denied": "Access to one or more selected buckets was denied.",
+  "storage_search_failure_generic": "One or more selected buckets could not be searched. Please try again.",
+  "storage_search_session_label": "Search {number}",
+  "storage_search_running": "{count} running",
+  "storage_search_completed": "{count} completed",
+  "storage_search_partial_count": "{count} partial",
+  "storage_search_add_session": "Parallel search",
+  "storage_search_sessions_label": "Search sessions",
+  "storage_search_remove_session": "Remove {name}",
+  "storage_search_status_running": "Running",
+  "storage_search_status_done": "Done",
+  "storage_search_status_partial": "Partial",
+  "storage_search_status_error": "Error",
+  "storage_search_regex_placeholder": "Regular expression",
+  "storage_search_regex_badge": ".*",
+  "storage_search_regex_invalid": "This regular expression is invalid or uses unsupported constructs.",
+  "storage_search_all_buckets": "all buckets",
+  "storage_search_scope_all": "All buckets",
+  "storage_search_scope_filter_label": "Filter buckets",
+  "storage_search_scope_filter_placeholder": "Search buckets",
+  "storage_search_scope_no_results": "No buckets found",
+  "storage_search_scope_toggle": "Include {bucket} in search",
+  "storage_search_recent_bucket_count": "{count} buckets",
+  "storage_search_recent_more_buckets": "{count} more buckets",
+  "storage_search_recent_toggle_buckets": "Choose buckets",
+  "storage_search_recent_bucket_all": "All buckets",
+  "storage_search_recent_bucket_toggle": "Include {bucket} in this search",
+  "storage_search_recent_use_selected": "Search selected buckets",
+  "storage_search_advanced_options": "Advanced options",
+  "storage_search_regex_label": "Regular expression search",
+  "storage_search_exclude_patterns": "Exclude patterns",
+  "storage_search_exclude_placeholder": "e.g. _temp",
+  "storage_search_remove_exclude": "Remove {pattern}",
+  "storage_search_filters_label": "Filters",
+  "storage_search_filter_add": "Add filter",
+  "storage_search_path_prefix": "Search path prefix",
+  "storage_search_path_placeholder": "e.g. events/2024/",
+  "storage_search_max_depth": "Max folder depth",
+  "storage_search_depth_placeholder": "unlimited",
+  "storage_search_searching": "Searching...",
+  "storage_search_results_elapsed": "{count} results · {elapsed}ms",
+  "storage_search_result_type": "Type",
+  "storage_search_keyboard_hint": "Enter: search · Ctrl/Cmd+T: new session · Esc: close",
+  "storage_search_key_enter": "Enter",
+  "storage_search_key_escape": "Esc",
+  "storage_search_shortcut_search": "search",
+  "storage_search_shortcut_close": "close",
+  "storage_search_filter_field_label": "Filter field",
+  "storage_search_filter_date": "Date",
+  "storage_search_filter_size": "Size",
+  "storage_search_filter_invalid": "Enter a valid filter value",
+  "storage_search_filter_operator": "Filter operator",
+  "storage_search_filter_value_size": "Size filter value",
+  "storage_search_filter_size_placeholder": "e.g. 10 MB",
+  "storage_search_filter_value_date": "Date filter value",
+  "storage_search_filter_date_placeholder": "e.g. 2024-01-31",
+  "storage_search_filter_remove": "Remove filter",
+  "datepicker_open": "Open date picker",
+  "datepicker_label": "Date picker",
+  "datepicker_previous_month": "Previous month",
+  "datepicker_next_month": "Next month",
+  "datepicker_day_select": "Select {date}",
   "timestamp_just_now": "just now",
   "timestamp_minutes_ago": [
     {
diff --git a/package-lock.json b/package-lock.json
index 042815d3..c0f93269 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -27,6 +27,7 @@
         "pino": "^10.3.1",
         "pretty-bytes": "^7.1.0",
         "prom-client": "^15.1.3",
+        "regexpp": "^3.2.0",
         "tar-stream": "^3.2.0",
         "undici": "^7.24.4"
       },
@@ -4355,6 +4356,8 @@
     },
     "node_modules/archiver": {
       "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/archiver/-/archiver-7.0.1.tgz",
+      "integrity": "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9773,6 +9776,18 @@
         "regexp-tree": "bin/regexp-tree"
       }
     },
+    "node_modules/regexpp": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
+      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      }
+    },
     "node_modules/require-dir": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/require-dir/-/require-dir-1.2.0.tgz",
diff --git a/package.json b/package.json
index aa72cf0c..c14c0786 100644
--- a/package.json
+++ b/package.json
@@ -96,6 +96,7 @@
     "pino": "^10.3.1",
     "pretty-bytes": "^7.1.0",
     "prom-client": "^15.1.3",
+    "regexpp": "^3.2.0",
     "tar-stream": "^3.2.0",
     "undici": "^7.24.4"
   },
diff --git a/src/app.css b/src/app.css
index cda5b74d..fe7c028a 100644
--- a/src/app.css
+++ b/src/app.css
@@ -61,11 +61,10 @@ progress.progress.progress-smooth::-moz-progress-bar {
   background-color: color-mix(in oklch, currentColor 50%, transparent);
 }
 
-@keyframes nav-progress-slide {
-  0% {
-    transform: translateX(-110%);
-  }
-  100% {
-    transform: translateX(350%);
-  }
+/* Align a modal to the top of the viewport like a command palette while
+   keeping it horizontally centred. DaisyUI's .modal uses a grid with
+   place-items:center, so only the vertical alignment and top inset change. */
+dialog.modal-top-search {
+  align-items: start;
+  padding-top: 2vh;
 }
diff --git a/src/architecture/i18n-compliance.spec.ts b/src/architecture/i18n-compliance.spec.ts
index 8a1b7de3..d00f43d6 100644
--- a/src/architecture/i18n-compliance.spec.ts
+++ b/src/architecture/i18n-compliance.spec.ts
@@ -10,12 +10,100 @@
  *      same top-level keys — missing translations break the German locale.
  *   b) Svelte components must not use hardcoded English strings in static
  *      aria-label="..." attributes (dynamic bindings are allowed).
+ *   c) Every message key must be referenced somewhere in `src/` so dead keys
+ *      are caught at CI time rather than accumulating in the locale files.
+ *      Pre-existing unused keys are tracked in KNOWN_UNUSED_KEYS; remove an
+ *      entry from that list as soon as the key is used or deleted.
  */
 
 import { readFileSync } from 'node:fs';
 import { describe, expect, it } from 'vitest';
 import { findFiles } from './helpers';
 
+/**
+ * Keys present in messages/*.json but not referenced anywhere in src/.
+ * These predate the unused-key rule and belong to planned features or
+ * removed UI. As keys are used or removed, delete them from this list — it
+ * must never grow.
+ */
+const KNOWN_UNUSED_KEYS = [
+  'nav_badge_soon',
+  'trino_first_page',
+  'trino_prev_page',
+  'trino_next_page',
+  'trino_last_page',
+  'trino_connection_error',
+  'trino_catalog_label',
+  'trino_schema_label',
+  'storage_connect_reconnecting',
+  'storage_connect_timeout',
+  'storage_connect_cancel',
+  'storage_connect_forget_confirm',
+  'storage_connect_forget_cancel',
+  'storage_connect_name',
+  'storage_connect_name_placeholder',
+  'storage_connect_additional_buckets',
+  'storage_connect_additional_buckets_hint',
+  'storage_connect_duplicate_warning',
+  'storage_connect_delete_label',
+  'storage_connect_delete_confirm_title',
+  'storage_connect_delete_confirm_message',
+  'storage_connect_delete_confirm_button',
+  'storage_connect_delete_cancel',
+  'storage_connect_add_new',
+  'storage_connect_testing',
+  'storage_connection_edit_success',
+  'storage_connection_edit_not_found',
+  'storage_folders',
+  'storage_paste',
+  'storage_paste_plural',
+  'storage_danger_zone',
+  'storage_download_error_title',
+  'storage_preview_fetch_more',
+  'storage_preview_csv_columns',
+  'storage_preview_pdf_too_large',
+  'storage_upload_selected',
+  'storage_upload_uploading',
+  'storage_upload_success',
+  'storage_upload_overwrite_title',
+  'storage_upload_overwrite_message',
+  'storage_upload_overwrite_replace',
+  'storage_upload_overwrite_rename',
+  'storage_upload_rename_confirm',
+  'storage_upload_retry',
+  'storage_preview_parquet_row_group',
+  'storage_archive_exit',
+  'storage_details_title',
+  'storage_details_property',
+  'storage_details_value',
+  'storage_details_tree_visualization',
+  'storage_details_lifecycle_rule_id',
+  'storage_details_lifecycle_status',
+  'storage_details_error_not_connected',
+  'storage_details_error_fetch_file',
+  'storage_details_error_fetch_bucket',
+  'storage_details_error_fetch_dir_meta',
+  'storage_details_tab_overview',
+  'storage_details_tab_lifecycle',
+  'storage_details_bucket_name',
+  'storage_details_object_lock',
+  'storage_action_move_error_not_connected',
+  'storage_action_move_error_access_denied',
+  'storage_operations_progress',
+  'storage_operations_error_generic',
+  'storage_rename_error_not_connected'
+];
+
+/** Every message key referenced as `m.<key>(...)` in src/** (excluding the generated paraglide output). */
+function collectUsedKeys(): Set<string> {
+  const used = new Set<string>();
+  for (const file of findFiles('src', /\.(ts|svelte)$/, [/paraglide/])) {
+    const content = readFileSync(file, 'utf-8');
+    for (const match of content.matchAll(/\bm\.([a-zA-Z0-9_]+)\b/g)) used.add(match[1]);
+  }
+  return used;
+}
+
 describe('i18n Compliance', () => {
   it('messages/en.json and messages/de.json must have the same top-level keys', () => {
     const en: Record<string, unknown> = JSON.parse(readFileSync('messages/en.json', 'utf-8'));
@@ -31,6 +119,18 @@ describe('i18n Compliance', () => {
     expect(missingInEn).toStrictEqual([]);
   });
 
+  it('every message key must be referenced in the source code', () => {
+    const en: Record<string, unknown> = JSON.parse(readFileSync('messages/en.json', 'utf-8'));
+    const used = collectUsedKeys();
+
+    const unused = Object.keys(en)
+      .filter((key) => !key.startsWith('$'))
+      .filter((key) => !used.has(key));
+
+    const newUnused = unused.filter((key) => !KNOWN_UNUSED_KEYS.includes(key));
+    expect(newUnused).toStrictEqual([]);
+  });
+
   it('Svelte components must not use static English strings in aria-label attributes', () => {
     const KNOWN_VIOLATIONS = [
       'ToastHost.svelte',
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 731f4d06..a8f44920 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -89,13 +89,14 @@ const handleStorageConnection: Handle = async ({ event, resolve }) => {
     event.locals.storageConfig = null;
   }
   // The connections management endpoint itself does not require a connection header —
-  // it is used to list/create connections before one is selected.
-  // The copy/job polling endpoint also does not require a connection header —
-  // it reads job status from the server-side job store.
+  // it is used to list/create connections before one is selected. Manifest stream and
+  // re-download routes load the manifest's owned connection at request time instead.
   const requiresConnectionHeader =
     event.route.id?.startsWith('/(app)/api/storage/') &&
     !event.route.id?.startsWith('/(app)/api/storage/connections') &&
-    !event.route.id?.startsWith('/(app)/api/storage/copy/job/');
+    !event.route.id?.startsWith('/(app)/api/storage/copy/job/') &&
+    !event.route.id?.startsWith('/(app)/api/storage/download/manifests/[manifestId]/') &&
+    event.route.id !== '/(app)/api/storage/download/manifests';
   if (event.locals.storageConfig === null && requiresConnectionHeader) {
     throw error(401, 'No storage connection configured');
   }
diff --git a/src/lib/components/DateTimePicker.svelte b/src/lib/components/DateTimePicker.svelte
new file mode 100644
index 00000000..fb87b58a
--- /dev/null
+++ b/src/lib/components/DateTimePicker.svelte
@@ -0,0 +1,200 @@
+<script lang="ts">
+  import { DateFormatter } from '@internationalized/date';
+  import { getLocale } from '$lib/paraglide/runtime.js';
+  import * as m from '$lib/paraglide/messages.js';
+  import { formatDateValue, parseDateInput } from '$lib/storage/search-filter.js';
+  import {
+    positionPopoverRelativeToTrigger,
+    supportsAnchorPositioning
+  } from '$lib/components/popover-position.js';
+  import IconCalendar from 'virtual:icons/material-symbols/calendar-today';
+  import IconChevronLeft from 'virtual:icons/material-symbols/chevron-left';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
+
+  interface Props {
+    /** Raw, user-editable date text. Writes back ISO (YYYY-MM-DD) on pick. */
+    value?: string;
+    /** The id of the text input, for label association. */
+    id?: string;
+    placeholder?: string;
+    /** Marks the control as invalid so it can be styled by the parent. */
+    invalid?: boolean;
+    class?: string;
+    onchange?: (value: string) => void;
+  }
+
+  let {
+    value = $bindable(''),
+    id,
+    placeholder,
+    invalid = false,
+    class: className = '',
+    onchange
+  }: Props = $props();
+
+  const uid = $props.id();
+  const popoverId = `${uid}-calendar`;
+  const anchorName = `--datepicker-${uid}`;
+
+  const locale = $derived(getLocale());
+  const startDay = $derived(locale === 'de' ? 1 : 0);
+
+  const monthYearFormatter = $derived(
+    new DateFormatter(locale, { month: 'long', year: 'numeric' })
+  );
+  const weekdayFormatter = $derived(new DateFormatter(locale, { weekday: 'short' }));
+  const dayFormatter = $derived(
+    new DateFormatter(locale, { day: 'numeric', month: 'long', year: 'numeric' })
+  );
+
+  // Weekday names indexed by Date#getDay() (0 = Sunday), then rotated so the
+  // grid starts on the locale-appropriate day.
+  const weekdayNames = $derived.by(() => {
+    const byDay = Array.from({ length: 7 }, (_, index) =>
+      weekdayFormatter.format(new Date(2024, 8, 1 + index))
+    );
+    return Array.from({ length: 7 }, (_, index) => byDay[(startDay + index) % 7]);
+  });
+
+  const parsedDate = $derived(parseDateInput(value));
+  const selectedIso = $derived(parsedDate ? formatDateValue(parsedDate) : '');
+
+  let popoverEl = $state<HTMLDivElement>();
+  let triggerEl = $state<HTMLButtonElement>();
+  let open = $state(false);
+  let viewYear = $state(0);
+  let viewMonth = $state(0);
+
+  const monthLabel = $derived(monthYearFormatter.format(new Date(viewYear, viewMonth, 1)));
+
+  const weeks = $derived.by(() => {
+    if (viewYear === 0) return [];
+    const firstOfMonth = new Date(viewYear, viewMonth, 1);
+    const offset = (firstOfMonth.getDay() - startDay + 7) % 7;
+    const daysInMonth = new Date(viewYear, viewMonth + 1, 0).getDate();
+    const cells: Array<{ key: string; date: Date | null }> = [];
+    for (let index = 0; index < offset; index += 1)
+      cells.push({ key: `blank-${index}`, date: null });
+    for (let day = 1; day <= daysInMonth; day += 1) {
+      const date = new Date(viewYear, viewMonth, day);
+      cells.push({ key: String(date.getTime()), date });
+    }
+    for (let trailing = cells.length; trailing % 7 !== 0; trailing += 1) {
+      cells.push({ key: `trailing-${trailing}`, date: null });
+    }
+    return cells;
+  });
+
+  const todayIso = $derived(formatDateValue(new Date()));
+
+  function handleToggle(event: Event): void {
+    const newState = (event as Event & { newState: 'open' | 'closed' }).newState;
+    open = newState === 'open';
+    if (open) {
+      const base = parsedDate ?? new Date();
+      viewYear = base.getFullYear();
+      viewMonth = base.getMonth();
+      if (!supportsAnchorPositioning() && triggerEl && popoverEl) {
+        positionPopoverRelativeToTrigger(triggerEl, popoverEl, { align: 'end' });
+      }
+    }
+  }
+
+  function shiftMonth(delta: number): void {
+    viewMonth += delta;
+    if (viewMonth < 0) {
+      viewMonth = 11;
+      viewYear -= 1;
+    } else if (viewMonth > 11) {
+      viewMonth = 0;
+      viewYear += 1;
+    }
+  }
+
+  function selectDate(date: Date): void {
+    value = formatDateValue(date);
+    onchange?.(value);
+    popoverEl?.hidePopover();
+  }
+</script>
+
+<div class={`flex min-w-0 items-center ${className}`}>
+  <input
+    {id}
+    class="h-8 min-w-0 grow bg-transparent px-1 text-sm focus:outline-none"
+    type="text"
+    inputmode="text"
+    autocomplete="off"
+    spellcheck="false"
+    {value}
+    oninput={(event) => {
+      value = event.currentTarget.value;
+      onchange?.(value);
+    }}
+    aria-invalid={invalid || undefined}
+    {placeholder}
+  />
+  <button
+    type="button"
+    class="btn btn-ghost btn-xs btn-square shrink-0"
+    bind:this={triggerEl}
+    style={`anchor-name:${anchorName}`}
+    popovertarget={popoverId}
+    aria-haspopup="dialog"
+    aria-expanded={open}
+    aria-label={m.datepicker_open()}
+    title={m.datepicker_open()}><IconCalendar class="size-4" aria-hidden="true" /></button
+  >
+</div>
+
+<div
+  id={popoverId}
+  popover
+  bind:this={popoverEl}
+  role="dialog"
+  aria-label={m.datepicker_label()}
+  class="dropdown dropdown-end border-base-300 bg-base-100 w-72 rounded-lg border p-3 shadow-lg"
+  style={`position-anchor:${anchorName}`}
+  ontoggle={handleToggle}
+>
+  <div class="mb-2 flex items-center justify-between">
+    <button
+      type="button"
+      class="btn btn-ghost btn-xs btn-square"
+      aria-label={m.datepicker_previous_month()}
+      title={m.datepicker_previous_month()}
+      onclick={() => shiftMonth(-1)}><IconChevronLeft class="size-4" aria-hidden="true" /></button
+    >
+    <span class="text-sm font-medium">{monthLabel}</span>
+    <button
+      type="button"
+      class="btn btn-ghost btn-xs btn-square"
+      aria-label={m.datepicker_next_month()}
+      title={m.datepicker_next_month()}
+      onclick={() => shiftMonth(1)}><IconChevronRight class="size-4" aria-hidden="true" /></button
+    >
+  </div>
+  <div class="grid grid-cols-7 gap-1">
+    {#each weekdayNames as weekday (weekday)}
+      <span
+        class="text-base-content/50 px-0.5 py-1 text-center text-xs font-medium"
+        aria-hidden="true">{weekday}</span
+      >
+    {/each}
+    {#each weeks as cell (cell.key)}
+      {#if cell.date}
+        {@const iso = formatDateValue(cell.date)}
+        {@const selected = iso === selectedIso}
+        <button
+          type="button"
+          class="btn btn-ghost btn-sm h-8 min-h-0 w-8 rounded p-0 text-xs {selected
+            ? 'btn-primary'
+            : ''} {iso === todayIso ? 'bg-primary/10' : ''}"
+          aria-pressed={selected}
+          aria-current={iso === todayIso ? 'date' : undefined}
+          aria-label={m.datepicker_day_select({ date: dayFormatter.format(cell.date) })}
+          onclick={() => selectDate(cell.date!)}>{cell.date.getDate()}</button
+        >{:else}<span class="h-8" aria-hidden="true"></span>{/if}
+    {/each}
+  </div>
+</div>
diff --git a/src/lib/components/Modal.svelte b/src/lib/components/Modal.svelte
index 111d81de..423d7ef6 100644
--- a/src/lib/components/Modal.svelte
+++ b/src/lib/components/Modal.svelte
@@ -3,12 +3,14 @@
     open = $bindable(false),
     children,
     class: className = '',
-    closeguard
+    closeguard,
+    ...restProps
   }: {
     open: boolean;
     children: import('svelte').Snippet;
     class?: string;
     closeguard?: () => boolean;
+    [key: string]: unknown;
   } = $props();
 
   let dialogEl = $state<HTMLDialogElement | undefined>(undefined);
@@ -62,6 +64,7 @@
 <dialog
   bind:this={dialogEl}
   class={className}
+  {...restProps}
   onclose={handleClose}
   oncancel={handleCancel}
   onclick={handleBackdropClick}
diff --git a/src/lib/components/popover-position.ts b/src/lib/components/popover-position.ts
new file mode 100644
index 00000000..2fd2623d
--- /dev/null
+++ b/src/lib/components/popover-position.ts
@@ -0,0 +1,43 @@
+/**
+ * Feature-detects CSS anchor positioning. DaisyUI's dropdown popover styles
+ * rely on `position-area` (formerly `inset-area`); see the
+ * `@supports not (position-area: bottom)` fallback rule in dropdown.css.
+ */
+export function supportsAnchorPositioning(): boolean {
+  return typeof CSS !== 'undefined' && CSS.supports('position-area: bottom');
+}
+
+const GAP = 8;
+
+/**
+ * Positions a popover beneath its trigger, flipping above when there isn't
+ * enough room below and clamping it inside the viewport. Popovers drift to the
+ * top-left corner of the viewport in browsers without anchor-positioning
+ * support, so this replaces the CSS `position-area`/`position-anchor` combo
+ * there and keeps the dropdown anchored to its trigger as expected.
+ */
+export function positionPopoverRelativeToTrigger(
+  trigger: HTMLElement,
+  popover: HTMLElement,
+  options: { align?: 'start' | 'end'; matchWidth?: boolean } = {}
+): void {
+  const { align = 'start', matchWidth = false } = options;
+  const triggerRect = trigger.getBoundingClientRect();
+  const popoverWidth = matchWidth ? triggerRect.width : popover.offsetWidth;
+  const popoverHeight = popover.offsetHeight;
+
+  let top = triggerRect.bottom + GAP;
+  if (top + popoverHeight > window.innerHeight - GAP) {
+    top = Math.max(GAP, triggerRect.top - popoverHeight - GAP);
+  }
+
+  const naturalLeft = align === 'end' ? triggerRect.right - popoverWidth : triggerRect.left;
+  const left = Math.min(Math.max(GAP, naturalLeft), window.innerWidth - popoverWidth - GAP);
+
+  popover.style.position = 'fixed';
+  popover.style.inset = 'auto';
+  popover.style.margin = '0';
+  popover.style.top = `${top}px`;
+  popover.style.left = `${left}px`;
+  if (matchWidth) popover.style.width = `${triggerRect.width}px`;
+}
diff --git a/src/lib/components/storage/BucketSelect.svelte b/src/lib/components/storage/BucketSelect.svelte
new file mode 100644
index 00000000..b5160012
--- /dev/null
+++ b/src/lib/components/storage/BucketSelect.svelte
@@ -0,0 +1,173 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { SearchSession, StorageSearchState } from '$lib/storage/search.svelte.js';
+  import IconArrowDropDown from 'virtual:icons/material-symbols/arrow-drop-down';
+  import IconArrowDropUp from 'virtual:icons/material-symbols/arrow-drop-up';
+  import IconCheck from 'virtual:icons/material-symbols/check';
+  import IconSearch from 'virtual:icons/material-symbols/search';
+
+  interface Props {
+    session: SearchSession;
+    buckets: string[];
+    searchState: StorageSearchState;
+  }
+
+  let { session, buckets, searchState }: Props = $props();
+
+  const uid = $props.id();
+  const popoverId = `${uid}-bucket-scope`;
+  const anchorName = `--bucket-select-${uid}`;
+
+  let popoverEl = $state<HTMLDivElement>();
+  let open = $state(false);
+  let filter = $state('');
+  let filterInput = $state<HTMLInputElement>();
+
+  const selectedCount = $derived(session.selectedBuckets.length);
+  const selectedSummary = $derived(session.selectedBuckets.join(', '));
+  const filteredBuckets = $derived(
+    buckets.filter((bucket) => bucket.toLowerCase().includes(filter.trim().toLowerCase()))
+  );
+
+  function toggle(bucket: string): void {
+    searchState.toggleBucket(bucket);
+  }
+
+  function selectAll(): void {
+    searchState.setBucketScope([]);
+  }
+
+  function onToggle(event: Event): void {
+    const newState = (event as Event & { newState: 'open' | 'closed' }).newState;
+    open = newState === 'open';
+    if (newState === 'open') {
+      filterInput?.focus();
+    } else {
+      filter = '';
+    }
+  }
+
+  function handleTriggerKeydown(event: KeyboardEvent): void {
+    if (open) return;
+    if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+      event.preventDefault();
+      popoverEl?.showPopover();
+    }
+  }
+
+  function handleFilterKeydown(event: KeyboardEvent): void {
+    if (event.key === 'Enter') event.preventDefault();
+    if (event.key === 'Escape') {
+      event.preventDefault();
+      popoverEl?.hidePopover();
+    }
+    if (event.key === 'ArrowDown') {
+      event.preventDefault();
+      (
+        document.getElementById(popoverId)?.querySelector('ul button') as HTMLButtonElement | null
+      )?.focus();
+    }
+  }
+</script>
+
+<div class="relative min-w-0 flex-1">
+  <button
+    type="button"
+    class="input focus:border-primary cursor-pointer gap-2 pe-2 text-left font-normal"
+    popovertarget={popoverId}
+    style={`anchor-name:${anchorName}`}
+    aria-expanded={open}
+    aria-controls={popoverId}
+    onkeydown={handleTriggerKeydown}
+  >
+    {#if selectedCount === 0}
+      <span class="text-base-content/50 min-w-0 flex-1 truncate italic">
+        {m.storage_search_all_buckets()}
+      </span>
+    {:else}
+      <span class="min-w-0 flex-1 truncate">{selectedSummary}</span>
+    {/if}
+    {#if open}
+      <IconArrowDropUp
+        class="text-base-content/60 pointer-events-none size-5 shrink-0"
+        aria-hidden="true"
+      />
+    {:else}
+      <IconArrowDropDown
+        class="text-base-content/60 pointer-events-none size-5 shrink-0"
+        aria-hidden="true"
+      />
+    {/if}
+  </button>
+
+  <div
+    class="dropdown dropdown-end bg-base-100 w-72 rounded shadow-lg"
+    popover
+    bind:this={popoverEl}
+    id={popoverId}
+    style={`position-anchor:${anchorName};width:anchor-size(${anchorName} width)`}
+    ontoggle={onToggle}
+  >
+    <div class="p-1.5 pb-0">
+      <div class="input bg-base-100/50 focus-within:border-primary flex items-center gap-2">
+        <IconSearch class="text-base-content/40 size-4 shrink-0" aria-hidden="true" />
+        <label class="sr-only" for="{uid}-bucket-filter"
+          >{m.storage_search_scope_filter_label()}</label
+        >
+        <input
+          id="{uid}-bucket-filter"
+          bind:this={filterInput}
+          class="min-w-0 grow text-sm"
+          type="search"
+          placeholder={m.storage_search_scope_filter_placeholder()}
+          autocomplete="off"
+          bind:value={filter}
+          onkeydown={handleFilterKeydown}
+        />
+      </div>
+    </div>
+    <ul class="menu max-h-64 w-full flex-nowrap overflow-y-auto p-1">
+      <li>
+        <button
+          type="button"
+          class={selectedCount === 0 ? 'bg-primary/10 text-primary font-medium' : ''}
+          aria-pressed={selectedCount === 0}
+          aria-label={m.storage_search_scope_all()}
+          onclick={selectAll}
+        >
+          <IconCheck
+            class={selectedCount === 0 ? 'size-4' : 'invisible size-4'}
+            aria-hidden="true"
+          />
+          <span>{m.storage_search_scope_all()}</span>
+        </button>
+      </li>
+      <li class="pointer-events-none" role="presentation">
+        <hr class="border-base-300 my-1" aria-hidden="true" />
+      </li>
+      {#if filteredBuckets.length === 0}
+        <li>
+          <span class="text-base-content/40 pointer-events-none block px-3 py-2 text-sm italic"
+            >{m.storage_search_scope_no_results()}</span
+          >
+        </li>
+      {:else}
+        {#each filteredBuckets as bucket (bucket)}
+          {@const selected = session.selectedBuckets.includes(bucket)}
+          <li>
+            <button
+              type="button"
+              class={selected ? 'bg-primary/10 text-primary font-medium' : ''}
+              aria-pressed={selected}
+              aria-label={m.storage_search_scope_toggle({ bucket })}
+              onclick={() => toggle(bucket)}
+            >
+              <IconCheck class={selected ? 'size-4' : 'invisible size-4'} aria-hidden="true" />
+              <span class="font-mono">{bucket}</span>
+            </button>
+          </li>
+        {/each}
+      {/if}
+    </ul>
+  </div>
+</div>
diff --git a/src/lib/components/storage/SearchFilterRow.svelte b/src/lib/components/storage/SearchFilterRow.svelte
new file mode 100644
index 00000000..386e5593
--- /dev/null
+++ b/src/lib/components/storage/SearchFilterRow.svelte
@@ -0,0 +1,107 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import DateTimePicker from '$lib/components/DateTimePicker.svelte';
+  import {
+    FILTER_OPERATORS,
+    parseDateFilterValue,
+    parseSizeFilterValue,
+    type SearchFilter,
+    type SearchFilterField,
+    type SearchFilterOperator
+  } from '$lib/storage/search-filter.js';
+  import IconClose from 'virtual:icons/material-symbols/close';
+
+  interface Props {
+    filter: SearchFilter;
+    onupdate: (patch: Partial<SearchFilter>) => void;
+    onremove: () => void;
+  }
+
+  let { filter, onupdate, onremove }: Props = $props();
+
+  const uid = $props.id();
+
+  const hasError = $derived(
+    filter.value.trim() !== '' &&
+      (filter.field === 'date'
+        ? parseDateFilterValue(filter) === null
+        : parseSizeFilterValue(filter) === null)
+  );
+
+  function setField(field: SearchFilterField): void {
+    onupdate({ field });
+  }
+
+  function setOperator(operator: SearchFilterOperator): void {
+    onupdate({ operator });
+  }
+</script>
+
+<div class="flex items-center gap-2">
+  <div class="shrink-0">
+    <label class="sr-only" for="{uid}-field">{m.storage_search_filter_field_label()}</label>
+    <select
+      id="{uid}-field"
+      class="select select-sm border-base-300 w-28 font-medium"
+      value={filter.field}
+      onchange={(event) => setField(event.currentTarget.value as SearchFilterField)}
+    >
+      <option value="date">{m.storage_search_filter_date()}</option>
+      <option value="size">{m.storage_search_filter_size()}</option>
+    </select>
+  </div>
+
+  <div
+    class="border-base-300 bg-base-100/50 focus-within:border-primary flex min-w-0 flex-1 items-center gap-1.5 rounded-lg border px-1.5 {hasError
+      ? 'border-error bg-error/5'
+      : ''}"
+    title={hasError ? m.storage_search_filter_invalid() : undefined}
+  >
+    <label class="sr-only" for="{uid}-operator">{m.storage_search_filter_operator()}</label>
+    <select
+      id="{uid}-operator"
+      class="select select-sm border-base-300/0 h-auto min-h-0 w-14 flex-shrink-0 border-0 ps-2 pe-7 text-center font-mono text-sm"
+      value={filter.operator}
+      onchange={(event) => setOperator(event.currentTarget.value as SearchFilterOperator)}
+    >
+      {#each FILTER_OPERATORS as op (op)}
+        <option value={op}>{op}</option>
+      {/each}
+    </select>
+    <span class="border-base-300 h-5 w-px border-l" aria-hidden="true"></span>
+
+    {#if filter.field === 'size'}
+      <label class="sr-only" for="{uid}-value">{m.storage_search_filter_value_size()}</label>
+      <input
+        id="{uid}-value"
+        class="h-8 min-w-0 grow bg-transparent px-1 text-sm focus:outline-none"
+        type="text"
+        inputmode="decimal"
+        autocomplete="off"
+        spellcheck="false"
+        value={filter.value}
+        oninput={(event) => onupdate({ value: event.currentTarget.value })}
+        placeholder={m.storage_search_filter_size_placeholder()}
+        aria-invalid={hasError || undefined}
+      />
+    {:else}
+      <label class="sr-only" for="{uid}-value">{m.storage_search_filter_value_date()}</label>
+      <DateTimePicker
+        id="{uid}-value"
+        class="grow"
+        placeholder={m.storage_search_filter_date_placeholder()}
+        invalid={hasError}
+        value={filter.value}
+        onchange={(value) => onupdate({ value })}
+      />
+    {/if}
+  </div>
+
+  <button
+    type="button"
+    class="btn btn-ghost btn-square btn-xs shrink-0"
+    aria-label={m.storage_search_filter_remove()}
+    title={m.storage_search_filter_remove()}
+    onclick={onremove}><IconClose class="size-3.5" aria-hidden="true" /></button
+  >
+</div>
diff --git a/src/lib/components/storage/StorageSearch.svelte b/src/lib/components/storage/StorageSearch.svelte
new file mode 100644
index 00000000..d4daab58
--- /dev/null
+++ b/src/lib/components/storage/StorageSearch.svelte
@@ -0,0 +1,189 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import Modal from '$lib/components/Modal.svelte';
+  import StorageSearchForm from '$lib/components/storage/StorageSearchForm.svelte';
+  import StorageSearchHistory from '$lib/components/storage/StorageSearchHistory.svelte';
+  import StorageSearchResults from '$lib/components/storage/StorageSearchResults.svelte';
+  import StorageSearchSessions from '$lib/components/storage/StorageSearchSessions.svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import { StorageSearchState, type SearchResult } from '$lib/storage/search.svelte.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import type { RecentSearchEntry } from '$lib/storage/types.js';
+  import IconAdd from 'virtual:icons/material-symbols/add';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconHistory from 'virtual:icons/material-symbols/history';
+  import IconSearch from 'virtual:icons/material-symbols/search';
+
+  interface Props {
+    currentBucket?: string;
+  }
+
+  const uid = $props.id();
+  const storage = getStorageState();
+  let { currentBucket }: Props = $props();
+  let open = $state(false);
+  let view = $state<'search' | 'recent'>('search');
+  const search = new StorageSearchState({
+    api: storage.api,
+    getBuckets: () => storage.buckets,
+    getCurrentBucket: () => currentBucket
+  });
+
+  function openSearch(): void {
+    view = 'search';
+    open = true;
+    void search.open();
+  }
+
+  function closeSearch(): void {
+    search.close();
+    open = false;
+  }
+
+  function useRecentEntry(entry: RecentSearchEntry, buckets?: string[]): void {
+    search.useRecentEntry(entry, buckets);
+    view = 'search';
+  }
+
+  function locationUrl(bucket: string, prefix: string): string {
+    const encodedPrefix = prefix
+      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+    return resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+      connection: storage.connectionId ?? '',
+      bucket: encodeURIComponent(bucket),
+      prefix: encodedPrefix
+    });
+  }
+
+  function openResult(result: SearchResult): void {
+    const prefix = result.isDirectory
+      ? result.key
+      : result.key.slice(0, result.key.lastIndexOf('/') + 1);
+    if (!result.isDirectory)
+      storage.openModal('preview', { key: result.key, bucket: result.bucket });
+    closeSearch();
+    // eslint-disable-next-line svelte/no-navigation-without-resolve -- path is built with resolve() in locationUrl()
+    void goto(locationUrl(result.bucket, prefix));
+  }
+
+  function handleKeydown(event: KeyboardEvent): void {
+    if ((event.metaKey || event.ctrlKey) && event.key.toLowerCase() === 'k') {
+      event.preventDefault();
+      openSearch();
+    }
+    if (open && (event.metaKey || event.ctrlKey) && event.key.toLowerCase() === 't') {
+      event.preventDefault();
+      search.addSession();
+    }
+  }
+</script>
+
+<svelte:window onkeydown={handleKeydown} />
+
+<button
+  type="button"
+  class="btn btn-ghost btn-xs gap-1 {currentBucket ? 'text-white' : ''}"
+  aria-label={m.storage_search_open()}
+  title={m.storage_search_open()}
+  onclick={openSearch}
+  ><IconSearch class="size-3.5" aria-hidden="true" />{m.storage_search_open()}</button
+>
+
+<Modal bind:open class="modal modal-top-search" aria-labelledby="{uid}-title">
+  <div
+    class="modal-box bg-base-200 flex max-h-[90vh] w-11/12 max-w-4xl flex-col overflow-hidden p-0"
+  >
+    <header
+      class="border-base-300 bg-base-300/50 flex items-center justify-between gap-3 border-b px-5 py-3"
+    >
+      <div class="flex items-center gap-3">
+        <h2 id="{uid}-title" class="text-sm font-semibold">{m.storage_search_title()}</h2>
+        {#if search.runningCount > 0}<span class="badge badge-warning badge-sm gap-1"
+            ><span class="loading loading-spinner loading-xs" aria-hidden="true"
+            ></span>{m.storage_search_running({ count: search.runningCount })}</span
+          >{:else if search.partialCount > 0}<span class="badge badge-warning badge-sm"
+            >{m.storage_search_partial_count({ count: search.partialCount })}</span
+          >{:else if search.completedCount > 0}<span class="badge badge-success badge-sm"
+            >{m.storage_search_completed({ count: search.completedCount })}</span
+          >{/if}
+      </div>
+      <div class="flex items-center gap-1">
+        {#if view === 'search'}
+          <button
+            type="button"
+            class="btn btn-ghost btn-xs gap-1"
+            title={m.storage_search_add_session()}
+            onclick={() => search.addSession()}
+            ><IconAdd class="size-4" aria-hidden="true" />{m.storage_search_add_session()}</button
+          >
+        {/if}<button
+          type="button"
+          class="btn btn-ghost btn-xs btn-square"
+          aria-label={m.storage_search_close()}
+          title={m.storage_search_close()}
+          onclick={closeSearch}><IconClose class="size-4" aria-hidden="true" /></button
+        >
+      </div>
+    </header>
+    <div
+      role="tablist"
+      class="tabs border-base-300 tabs-border bg-base-300/30 mb-0 px-5"
+      aria-label={m.storage_search_view_label()}
+    >
+      <button
+        type="button"
+        role="tab"
+        class="tab gap-1 {view === 'search' ? 'tab-active' : ''}"
+        aria-selected={view === 'search'}
+        onclick={() => (view = 'search')}
+        ><IconSearch class="size-3.5" aria-hidden="true" />{m.storage_search_tab_search()}</button
+      ><button
+        type="button"
+        role="tab"
+        class="tab gap-1 {view === 'recent' ? 'tab-active' : ''}"
+        aria-selected={view === 'recent'}
+        onclick={() => (view = 'recent')}
+        ><IconHistory class="size-3.5" aria-hidden="true" />{m.storage_search_tab_recent()}</button
+      >
+    </div>
+    {#if view === 'search'}
+      <StorageSearchSessions
+        sessions={search.sessions}
+        activeId={search.activeId}
+        onSelect={(id) => (search.activeId = id)}
+        onRemove={(id) => search.removeSession(id)}
+      />
+    {/if}
+    <div class="flex-1 overflow-y-auto p-5">
+      {#if view === 'recent'}
+        <StorageSearchHistory
+          entries={search.history}
+          onUse={useRecentEntry}
+          onClear={() => void search.clearHistory()}
+        />
+      {:else if search.active}
+        <StorageSearchForm
+          id={uid}
+          session={search.active}
+          buckets={storage.buckets}
+          state={search}
+        /><StorageSearchResults session={search.active} onOpen={openResult} />
+      {/if}
+    </div>
+    <footer
+      class="border-base-300 bg-base-300/30 text-base-content/50 flex flex-wrap gap-x-4 gap-y-1 border-t px-5 py-2 text-xs"
+      aria-label={m.storage_search_keyboard_hint()}
+    >
+      <span class="flex items-center gap-1">
+        <kbd class="kbd kbd-xs">{m.storage_search_key_enter()}</kbd
+        >{m.storage_search_shortcut_search()}
+      </span>
+      <span class="flex items-center gap-1"
+        ><kbd class="kbd kbd-xs">{m.storage_search_key_escape()}</kbd
+        >{m.storage_search_shortcut_close()}</span
+      >
+    </footer>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/StorageSearchForm.svelte b/src/lib/components/storage/StorageSearchForm.svelte
new file mode 100644
index 00000000..8d4b5d57
--- /dev/null
+++ b/src/lib/components/storage/StorageSearchForm.svelte
@@ -0,0 +1,238 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { SearchSession, StorageSearchState } from '$lib/storage/search.svelte.js';
+  import {
+    parseDateFilterValue,
+    parseSizeFilterValue,
+    type SearchFilter
+  } from '$lib/storage/search-filter.js';
+  import { createSafeSearchRegex } from '$lib/storage/search-regex.js';
+  import BucketSelect from '$lib/components/storage/BucketSelect.svelte';
+  import SearchFilterRow from '$lib/components/storage/SearchFilterRow.svelte';
+  import IconAdd from 'virtual:icons/material-symbols/add';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconSearch from 'virtual:icons/material-symbols/search';
+  import IconStop from 'virtual:icons/material-symbols/stop';
+
+  interface Props {
+    id: string;
+    session: SearchSession;
+    buckets: string[];
+    state: StorageSearchState;
+  }
+
+  let { id, session, buckets, state }: Props = $props();
+  let queryCycleTerms: string[] = [];
+  let queryCycleIndex = -1;
+
+  function update(patch: Partial<SearchSession>): void {
+    state.updateSession(session.id, patch);
+  }
+
+  function updateFilter(filterId: string, patch: Partial<SearchFilter>): void {
+    state.updateFilter(filterId, patch);
+  }
+
+  function resetQueryCycle(): void {
+    queryCycleTerms = [];
+    queryCycleIndex = -1;
+  }
+
+  function cycleRecentQuery(direction: 1 | -1): void {
+    if (queryCycleTerms.length === 0) {
+      queryCycleTerms = [
+        ...(session.query ? [session.query] : ['']),
+        ...state.history.map((entry) => entry.query)
+      ].filter((query, index, terms) => terms.indexOf(query) === index);
+      queryCycleIndex = queryCycleTerms.indexOf(session.query);
+    }
+    if (queryCycleTerms.length === 0) return;
+
+    const nextIndex = queryCycleIndex + direction;
+    if (nextIndex < 0 || nextIndex >= queryCycleTerms.length) return;
+    queryCycleIndex = nextIndex;
+    update({ query: queryCycleTerms[queryCycleIndex]! });
+  }
+
+  const hasInvalidFilter = $derived(
+    session.filters.some((filter) => {
+      if (filter.value.trim() === '') return false;
+      return filter.field === 'date'
+        ? parseDateFilterValue(filter) === null
+        : parseSizeFilterValue(filter) === null;
+    })
+  );
+
+  const regexValid = $derived(
+    !session.useRegex || session.query.trim() === '' || isSafeRegex(session.query.trim())
+  );
+
+  function isSafeRegex(pattern: string): boolean {
+    try {
+      createSafeSearchRegex(pattern);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+</script>
+
+<form
+  class="flex flex-col gap-4"
+  onsubmit={(event) => {
+    event.preventDefault();
+    void state.run(session.id);
+  }}
+>
+  <div class="flex flex-col gap-2 sm:flex-row">
+    <div class="input bg-base-100/50 focus-within:border-primary flex flex-1 items-center gap-2">
+      <IconSearch class="text-base-content/40 size-4 shrink-0" aria-hidden="true" />
+      <label class="sr-only" for="{id}-query">{m.storage_search_query_label()}</label>
+      <input
+        id="{id}-query"
+        class="min-w-0 grow font-mono text-sm"
+        type="search"
+        value={session.query}
+        oninput={(event) => {
+          resetQueryCycle();
+          update({ query: event.currentTarget.value });
+        }}
+        onkeydown={(event) => {
+          if (event.key !== 'ArrowUp' && event.key !== 'ArrowDown') return;
+          event.preventDefault();
+          cycleRecentQuery(event.key === 'ArrowDown' ? -1 : 1);
+        }}
+        placeholder={session.useRegex
+          ? m.storage_search_regex_placeholder()
+          : m.storage_search_query_placeholder()}
+        autocomplete="off"
+      />
+    </div>
+    <button
+      type="button"
+      class:btn-primary={session.useRegex}
+      class="btn"
+      aria-pressed={session.useRegex}
+      title={m.storage_search_regex_label()}
+      onclick={() => update({ useRegex: !session.useRegex })}
+      >{m.storage_search_regex_badge()}</button
+    >
+    {#if session.status === 'running'}
+      <button type="button" class="btn btn-outline" onclick={() => state.cancel(session.id)}
+        ><IconStop class="size-4" aria-hidden="true" />{m.storage_search_cancel()}</button
+      >
+    {:else}
+      <button
+        type="submit"
+        class="btn btn-primary"
+        disabled={hasInvalidFilter || !regexValid || !session.query.trim()}
+        ><IconSearch class="size-4" aria-hidden="true" />{m.storage_search_submit()}</button
+      >
+    {/if}
+  </div>
+
+  {#if !regexValid}
+    <p class="text-error text-xs" role="alert">{m.storage_search_regex_invalid()}</p>
+  {/if}
+
+  <div class="flex flex-col gap-3">
+    <fieldset class="flex min-w-0 flex-col gap-2 sm:flex-row sm:items-center">
+      <legend class="text-base-content/60 w-24 shrink-0 text-xs font-medium"
+        >{m.storage_search_scope_label()}</legend
+      >
+      <BucketSelect {session} {buckets} searchState={state} />
+    </fieldset>
+  </div>
+
+  <details
+    class="collapse-arrow border-base-300 bg-base-100/30 collapse border"
+    open={state.advancedOpen}
+    ontoggle={(event) => (state.advancedOpen = event.currentTarget.open)}
+  >
+    <summary class="collapse-title text-base-content/60 min-h-0 py-2 text-sm font-medium"
+      >{m.storage_search_advanced_options()}</summary
+    >
+    <div class="collapse-content flex flex-col gap-3 pt-1">
+      <fieldset>
+        <legend class="text-base-content/60 mb-1 block text-xs"
+          >{m.storage_search_filters_label()}</legend
+        >
+        <div class="flex flex-col gap-2">
+          {#each session.filters as filter (filter.id)}
+            <SearchFilterRow
+              {filter}
+              onupdate={(patch) => updateFilter(filter.id, patch)}
+              onremove={() => state.removeFilter(filter.id)}
+            />
+          {/each}
+        </div>
+        <button
+          type="button"
+          class="btn btn-ghost btn-xs mt-2 gap-1"
+          aria-label={m.storage_search_filter_add()}
+          onclick={() => state.addFilter()}
+          ><IconAdd class="size-3.5" aria-hidden="true" />{m.storage_search_filter_add()}</button
+        >
+      </fieldset>
+      <div>
+        <label for="{id}-exclude" class="text-base-content/60 mb-1 block text-xs"
+          >{m.storage_search_exclude_patterns()}</label
+        >
+        <div class="flex flex-wrap gap-1.5">
+          {#each session.excludePatterns as pattern (pattern)}<span
+              class="badge badge-error badge-outline badge-sm gap-1 font-mono"
+              >{pattern}<button
+                type="button"
+                aria-label={m.storage_search_remove_exclude({ pattern })}
+                onclick={() =>
+                  update({
+                    excludePatterns: session.excludePatterns.filter((item) => item !== pattern)
+                  })}><IconClose class="size-3" aria-hidden="true" /></button
+              ></span
+            >{/each}<input
+            id="{id}-exclude"
+            class="input input-xs w-36 border-dashed font-mono"
+            value={state.excludeInput}
+            oninput={(event) => (state.excludeInput = event.currentTarget.value)}
+            placeholder={m.storage_search_exclude_placeholder()}
+            onkeydown={(event) => {
+              if (event.key === 'Enter' || event.key === ',') {
+                event.preventDefault();
+                state.addExcludePattern();
+              }
+            }}
+            onblur={() => state.excludeInput.trim() && state.addExcludePattern()}
+          />
+        </div>
+      </div>
+      <div class="grid gap-3 sm:grid-cols-2">
+        <div>
+          <label for="{id}-prefix" class="text-base-content/60 mb-1 block text-xs"
+            >{m.storage_search_path_prefix()}</label
+          ><input
+            id="{id}-prefix"
+            class="input input-sm w-full font-mono"
+            value={session.searchPath}
+            oninput={(event) => update({ searchPath: event.currentTarget.value })}
+            placeholder={m.storage_search_path_placeholder()}
+          />
+        </div>
+        <div>
+          <label for="{id}-depth" class="text-base-content/60 mb-1 block text-xs"
+            >{m.storage_search_max_depth()}</label
+          ><input
+            id="{id}-depth"
+            class="input input-sm w-full font-mono"
+            type="number"
+            min="1"
+            max="20"
+            value={session.maxDepth ?? ''}
+            oninput={(event) =>
+              update({ maxDepth: event.currentTarget.valueAsNumber || undefined })}
+            placeholder={m.storage_search_depth_placeholder()}
+          />
+        </div>
+      </div>
+    </div>
+  </details>
+</form>
diff --git a/src/lib/components/storage/StorageSearchHistory.svelte b/src/lib/components/storage/StorageSearchHistory.svelte
new file mode 100644
index 00000000..45458907
--- /dev/null
+++ b/src/lib/components/storage/StorageSearchHistory.svelte
@@ -0,0 +1,69 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import StorageSearchHistoryEntry from '$lib/components/storage/StorageSearchHistoryEntry.svelte';
+  import type { RecentSearchEntry } from '$lib/storage/types.js';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
+
+  interface Props {
+    entries: RecentSearchEntry[];
+    onUse: (entry: RecentSearchEntry, buckets: string[]) => void;
+    onClear: () => void;
+  }
+
+  let { entries, onUse, onClear }: Props = $props();
+
+  let confirmOpen = $state(false);
+
+  function confirmClear(): void {
+    confirmOpen = false;
+    onClear();
+  }
+</script>
+
+<section class="flex h-full flex-col" aria-label={m.storage_search_recent_heading()}>
+  <div class="mb-2 flex items-center justify-between gap-3">
+    <h3 class="text-sm font-semibold">{m.storage_search_recent_heading()}</h3>
+    {#if entries.length > 0}
+      <button
+        type="button"
+        class="btn btn-ghost btn-xs hover:bg-error/10 hover:text-error gap-1"
+        onclick={() => (confirmOpen = true)}
+      >
+        <IconDelete class="size-3.5" aria-hidden="true" />
+        {m.storage_search_recent_clear()}
+      </button>
+    {/if}
+  </div>
+
+  {#if entries.length === 0}
+    <p class="text-base-content/50 py-8 text-center text-sm">{m.storage_search_recent_empty()}</p>
+  {:else}
+    <ul class="flex w-full flex-col gap-1 p-0">
+      {#each entries as entry (entry.buckets.join(',') + entry.query + String(entry.useRegex) + entry.excludePatterns.join(',') + entry.searchPath + (entry.maxDepth ?? '') + entry.buckets.length)}
+        <li class="w-full">
+          <StorageSearchHistoryEntry {entry} onUse={(e, buckets) => onUse(e, buckets)} />
+        </li>
+      {/each}
+    </ul>
+  {/if}
+</section>
+
+<Modal bind:open={confirmOpen} class="modal">
+  <div class="modal-box max-w-sm">
+    <h3 class="mb-3 flex items-center gap-2 text-lg font-bold">
+      <IconDelete class="text-error size-5 shrink-0" aria-hidden="true" />
+      {m.storage_search_recent_clear_confirm_title()}
+    </h3>
+    <p class="text-base-content/80 text-sm">{m.storage_search_recent_clear_confirm_message()}</p>
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost" onclick={() => (confirmOpen = false)}>
+        {m.storage_search_recent_clear_cancel()}
+      </button>
+      <button class="btn btn-outline btn-error" onclick={confirmClear}>
+        <IconDelete class="size-4" aria-hidden="true" />
+        {m.storage_search_recent_clear_confirm()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/StorageSearchHistoryEntry.svelte b/src/lib/components/storage/StorageSearchHistoryEntry.svelte
new file mode 100644
index 00000000..2296df6d
--- /dev/null
+++ b/src/lib/components/storage/StorageSearchHistoryEntry.svelte
@@ -0,0 +1,165 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
+  import type { RecentSearchEntry } from '$lib/storage/types.js';
+  import IconExpandLess from 'virtual:icons/material-symbols/expand-less';
+  import IconExpandMore from 'virtual:icons/material-symbols/expand-more';
+  import IconSearch from 'virtual:icons/material-symbols/search';
+
+  interface Props {
+    entry: RecentSearchEntry;
+    onUse: (entry: RecentSearchEntry, buckets: string[]) => void;
+  }
+
+  let { entry, onUse }: Props = $props();
+
+  const uid = $props.id();
+
+  const MAX_SUMMARY_BUCKETS = 3;
+
+  let expanded = $state(false);
+  let selected = $state<string[]>([]);
+
+  const multipleBuckets = $derived(entry.buckets.length > 1);
+  const allSelected = $derived(selected.length === entry.buckets.length);
+  const summary = $derived.by(() => {
+    if (entry.searchPath) return entry.searchPath;
+    const shown = entry.buckets.slice(0, MAX_SUMMARY_BUCKETS);
+    const remaining = entry.buckets.length - shown.length;
+    return remaining > 0
+      ? `${shown.join(', ')}, ${m.storage_search_recent_more_buckets({ count: remaining })}`
+      : shown.join(', ');
+  });
+
+  function toggleBucket(bucket: string): void {
+    selected = selected.includes(bucket)
+      ? selected.filter((item) => item !== bucket)
+      : [...selected, bucket];
+  }
+
+  function toggleAll(): void {
+    selected = allSelected ? [] : [...entry.buckets];
+  }
+
+  function use(): void {
+    if (selected.length === 0) return;
+    onUse(entry, selected);
+  }
+
+  function useAll(): void {
+    onUse(entry, entry.buckets);
+  }
+
+  function toggleExpanded(): void {
+    expanded = !expanded;
+  }
+
+  function handleRowClick(): void {
+    if (multipleBuckets) {
+      toggleExpanded();
+    } else {
+      useAll();
+    }
+  }
+</script>
+
+<div class="border-base-300 bg-base-100/30 hover:bg-base-100 rounded border transition-colors">
+  <div class="flex items-center gap-1">
+    <button
+      type="button"
+      class="min-w-0 flex-1 cursor-pointer items-center gap-2 rounded ps-2 text-start"
+      disabled={entry.buckets.length === 0}
+      aria-expanded={multipleBuckets ? expanded : undefined}
+      aria-controls={multipleBuckets ? `${uid}-buckets` : undefined}
+      onclick={handleRowClick}
+    >
+      <span class="flex min-w-0 items-center gap-2 py-2">
+        <IconSearch class="size-4 shrink-0" aria-hidden="true" />
+        <span class="min-w-0 flex-1">
+          <span class="block truncate font-mono text-sm">{entry.query}</span>
+          <span class="text-base-content/50 block truncate font-mono text-xs">{summary}</span>
+        </span>
+        {#if multipleBuckets}
+          <span class="badge badge-outline badge-sm shrink-0 font-mono"
+            >{m.storage_search_recent_bucket_count({ count: entry.buckets.length })}</span
+          >
+        {:else}
+          <span class="badge badge-outline badge-sm mr-2 shrink-0 font-mono"
+            >{entry.buckets[0]}</span
+          >
+        {/if}
+      </span>
+    </button>
+    {#if multipleBuckets}
+      <TooltipTrigger text={m.storage_search_recent_toggle_buckets()} orientation="up">
+        <button
+          type="button"
+          class="btn btn-ghost btn-xs btn-square mr-2 shrink-0"
+          aria-expanded={expanded}
+          aria-controls="{uid}-buckets"
+          aria-label={m.storage_search_recent_toggle_buckets()}
+          onclick={toggleExpanded}
+        >
+          {#if expanded}
+            <IconExpandLess class="size-4" aria-hidden="true" />
+          {:else}
+            <IconExpandMore class="size-4" aria-hidden="true" />
+          {/if}
+        </button>
+      </TooltipTrigger>
+    {/if}
+  </div>
+  {#if multipleBuckets && expanded}
+    <div
+      id="{uid}-buckets"
+      class="border-base-300 bg-base-100/40 flex flex-col gap-2 border-t px-3 py-2"
+    >
+      <label
+        class="label cursor-pointer justify-start gap-2 py-1"
+        for="{uid}-all"
+        aria-label={m.storage_search_recent_bucket_all()}
+      >
+        <input
+          id="{uid}-all"
+          type="checkbox"
+          class="checkbox checkbox-primary checkbox-xs"
+          checked={allSelected}
+          onchange={toggleAll}
+        />
+        <span class="text-xs font-medium">{m.storage_search_recent_bucket_all()}</span>
+      </label>
+      <ul class="grid gap-x-4 gap-y-0.5 sm:grid-cols-2 lg:grid-cols-3">
+        {#each entry.buckets as bucket (bucket)}
+          {@const checked = selected.includes(bucket)}
+          <li class="min-w-0">
+            <TooltipTrigger text={bucket} orientation="up">
+              <label
+                class="label flex min-w-0 cursor-pointer justify-start gap-2 py-1"
+                for="{uid}-{bucket}"
+                aria-label={m.storage_search_recent_bucket_toggle({ bucket })}
+              >
+                <input
+                  id="{uid}-{bucket}"
+                  type="checkbox"
+                  class="checkbox checkbox-primary checkbox-xs shrink-0"
+                  {checked}
+                  onchange={() => toggleBucket(bucket)}
+                />
+                <span class="min-w-0 truncate font-mono text-xs">{bucket}</span>
+              </label>
+            </TooltipTrigger>
+          </li>
+        {/each}
+      </ul>
+      <button
+        type="button"
+        class="btn btn-primary btn-xs mt-1 gap-1 self-start"
+        disabled={selected.length === 0}
+        onclick={use}
+      >
+        <IconSearch class="size-3.5" aria-hidden="true" />
+        {m.storage_search_recent_use_selected()}
+      </button>
+    </div>
+  {/if}
+</div>
diff --git a/src/lib/components/storage/StorageSearchResults.svelte b/src/lib/components/storage/StorageSearchResults.svelte
new file mode 100644
index 00000000..df374cde
--- /dev/null
+++ b/src/lib/components/storage/StorageSearchResults.svelte
@@ -0,0 +1,235 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import Pagination from '$lib/components/Pagination.svelte';
+  import type { SearchResult, SearchSession } from '$lib/storage/search.svelte.js';
+  import { initPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { keyToName } from '$lib/storage/utils.js';
+  import IconArrowUpward from 'virtual:icons/material-symbols/arrow-upward';
+  import IconArrowDownward from 'virtual:icons/material-symbols/arrow-downward';
+  import IconDescription from 'virtual:icons/material-symbols/description';
+  import IconFolder from 'virtual:icons/material-symbols/folder';
+  import IconUnfoldMore from 'virtual:icons/material-symbols/unfold-more';
+
+  interface Props {
+    session: SearchSession;
+    onOpen: (result: SearchResult) => void;
+  }
+
+  let { session, onOpen }: Props = $props();
+
+  type SortKey = 'name' | 'bucket' | 'size' | 'lastModified';
+  type SortDir = 'asc' | 'desc';
+
+  let sortKey = $state<SortKey>('name');
+  let sortDir = $state<SortDir>('asc');
+  let pageSize = $state<PageSize>(initPageSize('storage_search_page_size'));
+  let currentPage = $state(0);
+  let resultsContainer = $state<HTMLDivElement>();
+  let displayedSessionId = $state(session.id);
+
+  function toggleSort(key: SortKey) {
+    if (sortKey === key) {
+      sortDir = sortDir === 'asc' ? 'desc' : 'asc';
+    } else {
+      sortKey = key;
+      // Default direction: size → desc, everything else → asc
+      sortDir = key === 'size' ? 'desc' : 'asc';
+    }
+    currentPage = 0;
+  }
+
+  function sortAria(key: SortKey): 'ascending' | 'descending' | 'none' {
+    if (sortKey !== key) return 'none';
+    return sortDir === 'asc' ? 'ascending' : 'descending';
+  }
+
+  const sortedResults = $derived.by(() => {
+    return [...session.results].sort((a, b) => {
+      let cmp = 0;
+      if (sortKey === 'name') {
+        cmp = a.key.localeCompare(b.key);
+      } else if (sortKey === 'bucket') {
+        cmp = a.bucket.localeCompare(b.bucket);
+      } else if (sortKey === 'size') {
+        cmp = a.size - b.size;
+      } else {
+        cmp = a.lastModified.getTime() - b.lastModified.getTime();
+      }
+      return sortDir === 'asc' ? cmp : -cmp;
+    });
+  });
+
+  const failureMessage = $derived.by(() => {
+    if (session.failures.length === 0) return undefined;
+    return session.failures.every((failure) => failure.code === 'access_denied')
+      ? m.storage_search_failure_access_denied()
+      : m.storage_search_failure_generic();
+  });
+
+  const totalPages = $derived(Math.ceil(sortedResults.length / pageSize));
+  const paginatedResults = $derived(
+    sortedResults.slice(currentPage * pageSize, (currentPage + 1) * pageSize)
+  );
+
+  $effect(() => {
+    if (displayedSessionId !== session.id) {
+      displayedSessionId = session.id;
+      currentPage = 0;
+    }
+  });
+
+  function changePageSize() {
+    currentPage = 0;
+    scrollResultsToTop();
+  }
+
+  function changePage(page: number) {
+    currentPage = page;
+    scrollResultsToTop();
+  }
+
+  function scrollResultsToTop() {
+    if (resultsContainer) resultsContainer.scrollTop = 0;
+  }
+
+  function formatSize(size: number): string {
+    if (size < 1024) return `${size} B`;
+    if (size < 1024 ** 2) return `${(size / 1024).toFixed(1)} KB`;
+    if (size < 1024 ** 3) return `${(size / 1024 ** 2).toFixed(1)} MB`;
+    return `${(size / 1024 ** 3).toFixed(1)} GB`;
+  }
+</script>
+
+{#snippet SortIcon(key: SortKey)}
+  {#if sortKey === key}
+    {#if sortDir === 'asc'}
+      <IconArrowUpward class="size-3 shrink-0" aria-hidden="true" />
+    {:else}
+      <IconArrowDownward class="size-3 shrink-0" aria-hidden="true" />
+    {/if}
+  {:else}
+    <IconUnfoldMore class="text-base-content/30 size-3 shrink-0" aria-hidden="true" />
+  {/if}
+{/snippet}
+
+{#if session.status !== 'idle'}
+  <section class="mt-4" aria-live="polite">
+    <div class="text-base-content/60 mb-2 flex items-center justify-between gap-3 text-xs">
+      <span
+        >{session.status === 'running'
+          ? m.storage_search_searching()
+          : m.storage_search_results_elapsed({
+              count: session.results.length,
+              elapsed: session.elapsed
+            })}</span
+      >
+      {#if session.status === 'running'}<span class="badge badge-warning badge-sm"
+          >{m.storage_search_status_running()}</span
+        >{:else if session.status === 'done' && session.failures.length === 0}<span
+          class="badge badge-success badge-sm">{m.storage_search_status_done()}</span
+        >{:else if session.status === 'done'}<span class="badge badge-warning badge-sm"
+          >{m.storage_search_status_partial()}</span
+        >{:else}<span class="badge badge-error badge-sm">{m.storage_search_status_error()}</span
+        >{/if}
+    </div>
+    {#if session.status === 'running'}<progress class="progress progress-primary w-full"
+      ></progress>{/if}
+    {#if failureMessage}
+      <p class="alert alert-warning mt-2 text-sm" role="alert">{failureMessage}</p>
+    {/if}
+    {#if session.status === 'done' && session.results.length === 0}<p
+        class="text-base-content/50 py-8 text-center text-sm"
+      >
+        {m.storage_search_no_results()}
+      </p>{/if}
+    {#if session.results.length > 0}
+      <div
+        bind:this={resultsContainer}
+        class="border-base-300 mt-2 max-h-64 overflow-auto rounded-lg border"
+      >
+        <table class="table-xs table-pin-rows table">
+          <thead
+            ><tr
+              ><th>{m.storage_search_result_type()}</th><th aria-sort={sortAria('name')}
+                ><button
+                  type="button"
+                  class="flex cursor-pointer items-center gap-1 font-medium"
+                  onclick={() => toggleSort('name')}
+                  >{m.storage_header_name()}{@render SortIcon('name')}</button
+                ></th
+              ><th aria-sort={sortAria('bucket')}
+                ><button
+                  type="button"
+                  class="flex cursor-pointer items-center gap-1 font-medium"
+                  onclick={() => toggleSort('bucket')}
+                  >{m.storage_search_scope_label()}{@render SortIcon('bucket')}</button
+                ></th
+              ><th aria-sort={sortAria('size')}
+                ><button
+                  type="button"
+                  class="flex cursor-pointer items-center gap-1 font-medium"
+                  onclick={() => toggleSort('size')}
+                  >{m.storage_header_size()}{@render SortIcon('size')}</button
+                ></th
+              ><th aria-sort={sortAria('lastModified')}
+                ><button
+                  type="button"
+                  class="flex cursor-pointer items-center gap-1 font-medium"
+                  onclick={() => toggleSort('lastModified')}
+                  >{m.storage_header_last_modified()}{@render SortIcon('lastModified')}</button
+                ></th
+              ></tr
+            ></thead
+          >
+          <tbody
+            >{#each paginatedResults as result (result.bucket + result.key)}<tr
+                class="group hover:bg-base-300 cursor-pointer [&_td]:cursor-pointer"
+                onclick={() => onOpen(result)}
+                ><td
+                  >{#if result.isDirectory}<IconFolder
+                      class="size-4"
+                      aria-label={m.storage_folder()}
+                    />{:else}<IconDescription
+                      class="size-4"
+                      aria-label={m.storage_file()}
+                    />{/if}</td
+                ><td
+                  ><button
+                    type="button"
+                    class="text-left"
+                    onclick={(event) => {
+                      event.stopPropagation();
+                      onOpen(result);
+                    }}
+                    ><span class="block font-mono font-medium">{keyToName(result.key)}</span><span
+                      class="text-base-content/50 block font-mono text-xs">{result.key}</span
+                    ></button
+                  ></td
+                ><td><span class="badge badge-ghost badge-sm font-mono">{result.bucket}</span></td
+                ><td class="text-base-content/60 font-mono text-xs"
+                  >{result.isDirectory ? '-' : formatSize(result.size)}</td
+                ><td class="text-base-content/60 font-mono text-xs"
+                  >{result.lastModified.toLocaleDateString()}</td
+                ></tr
+              >{/each}</tbody
+          >
+        </table>
+      </div>
+      <div class="mt-2">
+        <Pagination
+          bind:pageSize
+          storageKey="storage_search_page_size"
+          pageSizeLabel={m.storage_page_size()}
+          infoLabel="{m.storage_page()} {currentPage + 1}"
+          current={currentPage}
+          total={totalPages}
+          onfirst={() => changePage(0)}
+          onprev={() => changePage(currentPage - 1)}
+          onnext={() => changePage(currentPage + 1)}
+          onlast={() => changePage(totalPages - 1)}
+          onpagesizechange={changePageSize}
+        />
+      </div>
+    {/if}
+  </section>
+{/if}
diff --git a/src/lib/components/storage/StorageSearchSessions.svelte b/src/lib/components/storage/StorageSearchSessions.svelte
new file mode 100644
index 00000000..8f93d6c5
--- /dev/null
+++ b/src/lib/components/storage/StorageSearchSessions.svelte
@@ -0,0 +1,57 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { SearchSession } from '$lib/storage/search.svelte.js';
+  import IconClose from 'virtual:icons/material-symbols/close';
+
+  interface Props {
+    sessions: SearchSession[];
+    activeId: string;
+    onSelect: (id: string) => void;
+    onRemove: (id: string) => void;
+  }
+
+  let { sessions, activeId, onSelect, onRemove }: Props = $props();
+</script>
+
+{#if sessions.length > 1}
+  <nav
+    class="border-base-300 flex overflow-x-auto border-b px-5 pt-2"
+    aria-label={m.storage_search_sessions_label()}
+  >
+    {#each sessions as session (session.id)}
+      <div class="flex shrink-0 items-center">
+        <button
+          type="button"
+          class={[
+            'tab tab-sm gap-1.5 font-mono text-xs',
+            { 'tab-active text-primary': activeId === session.id }
+          ]}
+          aria-current={activeId === session.id ? 'page' : undefined}
+          onclick={() => onSelect(session.id)}
+        >
+          {session.label}
+          {#if session.status === 'running'}<span
+              class="loading loading-spinner loading-xs"
+              aria-label={m.storage_search_status_running()}
+            ></span>{/if}
+          {#if session.status === 'done' && session.failures.length === 0}<span
+              class="badge badge-success badge-xs">{m.storage_search_status_done()}</span
+            >{/if}
+          {#if session.status === 'done' && session.failures.length > 0}<span
+              class="badge badge-warning badge-xs">{m.storage_search_status_partial()}</span
+            >{/if}
+          {#if session.status === 'error'}<span class="badge badge-error badge-xs"
+              >{m.storage_search_status_error()}</span
+            >{/if}
+        </button>
+        <button
+          type="button"
+          class="btn btn-ghost btn-xs btn-square"
+          aria-label={m.storage_search_remove_session({ name: session.label })}
+          onclick={() => onRemove(session.id)}
+          ><IconClose class="size-3" aria-hidden="true" /></button
+        >
+      </div>
+    {/each}
+  </nav>
+{/if}
diff --git a/src/lib/components/storage/__tests__/StorageSearch.svelte.spec.ts b/src/lib/components/storage/__tests__/StorageSearch.svelte.spec.ts
new file mode 100644
index 00000000..dc800590
--- /dev/null
+++ b/src/lib/components/storage/__tests__/StorageSearch.svelte.spec.ts
@@ -0,0 +1,375 @@
+import { page, userEvent } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import StorageSearchWrapper from './StorageSearchWrapper.svelte';
+import { StorageState } from '$lib/storage/state.svelte.js';
+import type { StorageApi } from '$lib/storage/api.js';
+import { StorageError } from '$lib/storage/errors.js';
+import type { RecentSearchEntry, StorageSearchResponse } from '$lib/storage/types.js';
+
+const { goto, invalidateAll } = vi.hoisted(() => ({ goto: vi.fn(), invalidateAll: vi.fn() }));
+
+vi.mock('$app/navigation', () => ({ goto, invalidateAll }));
+vi.mock('$app/paths', () => ({
+  resolve: (_route: string, params: { bucket: string; prefix: string }) =>
+    `/storage/${params.bucket}/${params.prefix}`
+}));
+
+type SearchApiMock = {
+  search: ReturnType<typeof vi.fn>;
+  listRecentSearches: ReturnType<typeof vi.fn>;
+  recordRecentSearch: ReturnType<typeof vi.fn>;
+  clearRecentSearches: ReturnType<typeof vi.fn>;
+};
+
+function createState(options?: {
+  response?: StorageSearchResponse;
+  history?: RecentSearchEntry[];
+}): {
+  state: StorageState;
+  api: SearchApiMock;
+} {
+  const api = {
+    search: vi.fn().mockResolvedValue(options?.response ?? { results: [] }),
+    listRecentSearches: vi.fn().mockResolvedValue(options?.history ?? []),
+    recordRecentSearch: vi.fn().mockResolvedValue(undefined),
+    clearRecentSearches: vi.fn().mockResolvedValue(undefined)
+  } satisfies SearchApiMock;
+  return {
+    state: new StorageState({
+      connected: true,
+      buckets: ['alpha', 'beta'],
+      api: api as unknown as StorageApi
+    }),
+    api
+  };
+}
+
+describe('StorageSearch', () => {
+  it('opens with the explorer bucket selected', async () => {
+    const explorer = createState();
+    render(StorageSearchWrapper, { state: explorer.state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await expect.element(page.getByRole('button', { name: 'alpha', exact: true })).toBeVisible();
+  });
+
+  it('loads recent searches when the search modal opens', async () => {
+    const { state, api } = createState();
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await expect.poll(() => api.listRecentSearches.mock.calls.length).toBe(1);
+  });
+
+  it('cycles query text through recent searches without changing search options', async () => {
+    const { state } = createState({
+      history: [
+        {
+          buckets: ['beta'],
+          query: 'newest',
+          useRegex: true,
+          excludePatterns: ['_temp'],
+          searchPath: 'archive/',
+          maxDepth: 2
+        },
+        {
+          buckets: ['alpha'],
+          query: 'older',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    const query = page.getByLabelText('Search query');
+    await query.fill('draft');
+    await userEvent.keyboard('{ArrowUp}');
+    await expect.element(query).toHaveValue('newest');
+    await userEvent.keyboard('{ArrowUp}');
+    await expect.element(query).toHaveValue('older');
+    await userEvent.keyboard('{ArrowUp}');
+    await expect.element(query).toHaveValue('older');
+    await userEvent.keyboard('{ArrowDown}');
+    await expect.element(query).toHaveValue('newest');
+    await userEvent.keyboard('{ArrowDown}');
+    await expect.element(query).toHaveValue('draft');
+    await userEvent.keyboard('{ArrowDown}');
+    await expect.element(query).toHaveValue('draft');
+    await expect.element(page.getByRole('button', { name: 'alpha', exact: true })).toBeVisible();
+    await expect
+      .element(page.getByRole('button', { name: '.*', exact: true }))
+      .toHaveAttribute('aria-pressed', 'false');
+  });
+
+  it('searches every bucket from the landing page', async () => {
+    const { state, api } = createState();
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByLabelText('Search query').fill('report');
+    await page.getByRole('button', { name: 'Search', exact: true }).click();
+    await expect.poll(() => api.search.mock.calls.length).toBe(2);
+    expect(api.search).toHaveBeenCalledWith(
+      expect.objectContaining({ bucket: 'alpha', query: 'report' })
+    );
+    expect(api.search).toHaveBeenCalledWith(
+      expect.objectContaining({ bucket: 'beta', query: 'report' })
+    );
+  });
+
+  it('retains results and identifies buckets that fail during a multi-bucket search', async () => {
+    const { state, api } = createState();
+    api.search.mockImplementation(({ bucket }: { bucket: string }) => {
+      if (bucket === 'beta')
+        return Promise.reject(new StorageError('access_denied', 'Access denied'));
+      return Promise.resolve({
+        results: [{ key: 'report.csv', size: 1, lastModified: new Date(), isDirectory: false }]
+      });
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByLabelText('Search query').fill('report');
+    await page.getByRole('button', { name: 'Search', exact: true }).click();
+
+    await expect
+      .element(page.getByRole('alert'))
+      .toHaveTextContent('Access to one or more selected buckets was denied.');
+    await expect.element(page.getByRole('alert')).not.toHaveTextContent('beta');
+    await expect.element(page.getByRole('button', { name: 'report.csv' })).toBeVisible();
+    await expect.element(page.getByText('Partial', { exact: true })).toBeVisible();
+  });
+
+  it('adds a parallel session', async () => {
+    const { state } = createState();
+    render(StorageSearchWrapper, { state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('button', { name: 'Parallel search' }).click();
+    await expect.element(page.getByRole('navigation', { name: 'Search sessions' })).toBeVisible();
+    await expect.element(page.getByRole('button', { name: 'Search 2', exact: true })).toBeVisible();
+  });
+
+  it('uses the regex button and sends date and size filters', async () => {
+    const { state, api } = createState();
+    render(StorageSearchWrapper, { state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    const regex = page.getByRole('button', { name: '.*', exact: true });
+    await regex.click();
+    await expect.element(regex).toHaveAttribute('aria-pressed', 'true');
+    await page.getByText('Advanced options').click();
+    await page.getByLabelText('Size filter value').fill('10');
+    await page.getByLabelText('Date filter value').fill('15.03.2027');
+    await page.getByLabelText('Search query').fill('report-[0-9]+');
+    await page.getByRole('button', { name: 'Search', exact: true }).click();
+    await expect.poll(() => api.search.mock.calls.length).toBe(1);
+    expect(api.search).toHaveBeenCalledWith(
+      expect.objectContaining({
+        useRegex: true,
+        filters: [
+          { field: 'date', operator: '>', value: '15.03.2027' },
+          { field: 'size', operator: '>', value: '10' }
+        ]
+      })
+    );
+  });
+
+  it('makes the bucket dropdown divider non-interactive', async () => {
+    const { state } = createState();
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('button', { name: 'all buckets', exact: true }).click();
+    const divider = page.getByRole('presentation');
+    await expect.element(divider).toHaveClass('pointer-events-none');
+  });
+
+  it('renders results and opens directories or file previews', async () => {
+    const { state, api } = createState({
+      response: {
+        results: [
+          { key: 'reports/', size: 0, lastModified: new Date(), isDirectory: true },
+          { key: 'reports/data.csv', size: 1, lastModified: new Date(), isDirectory: false }
+        ]
+      }
+    });
+    const preview = vi.spyOn(state, 'openModal');
+    render(StorageSearchWrapper, { state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByLabelText('Search query').fill('report');
+    await page.getByRole('button', { name: 'Search', exact: true }).click();
+    await expect.element(page.getByText('2 results ·')).toBeVisible();
+    await page.getByRole('button', { name: /reportsreports\// }).click();
+    expect(goto).toHaveBeenCalledWith('/storage/alpha/reports');
+
+    render(StorageSearchWrapper, { state, currentBucket: 'alpha' });
+    await page.getByRole('button', { name: 'Open search' }).last().click();
+    await page.getByLabelText('Search query').last().fill('data');
+    await page.getByRole('button', { name: 'Search', exact: true }).last().click();
+    await page.getByRole('button', { name: 'data.csv' }).click();
+    expect(preview).toHaveBeenCalledWith('preview', { key: 'reports/data.csv', bucket: 'alpha' });
+    expect(api.search).toHaveBeenCalled();
+  });
+
+  it('records submitted searches to the history as one grouped entry per search', async () => {
+    const { state, api } = createState();
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByLabelText('Search query').fill('report');
+    await page.getByRole('button', { name: 'Search', exact: true }).click();
+    await expect.poll(() => api.recordRecentSearch.mock.calls.length).toBe(1);
+    expect(api.recordRecentSearch).toHaveBeenCalledWith(
+      expect.objectContaining({ buckets: ['alpha', 'beta'], query: 'report' })
+    );
+  });
+
+  it('shows an empty state for recent searches', async () => {
+    const { state } = createState();
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    await expect
+      .element(page.getByText('Your recent searches will appear here.'))
+      .toBeInTheDocument();
+  });
+
+  it('lists recent searches and fills the active session when used', async () => {
+    const { state } = createState({
+      history: [
+        {
+          buckets: ['alpha'],
+          query: 'report',
+          useRegex: true,
+          excludePatterns: ['_temp'],
+          searchPath: 'events/',
+          maxDepth: 2
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    await page.getByRole('button', { name: /report/ }).click();
+    await expect.element(page.getByLabelText('Search query')).toHaveValue('report');
+    await expect.element(page.getByRole('button', { name: 'alpha', exact: true })).toBeVisible();
+  });
+
+  it('renders grouped multi-bucket history entries without a keyed-each crash', async () => {
+    const { state } = createState({
+      history: [
+        {
+          buckets: ['stackable-ui-test'],
+          query: 'md',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        },
+        {
+          buckets: ['stackable-ui-test', 'archive'],
+          query: 'md',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    const entries = await page.getByRole('button', { name: /md/ }).elements();
+    expect(entries).toHaveLength(2);
+  });
+
+  it('selects specific buckets from a grouped recent entry', async () => {
+    const { state } = createState({
+      history: [
+        {
+          buckets: ['alpha', 'beta'],
+          query: 'report',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    await page.getByRole('button', { name: 'Choose buckets' }).click();
+    await page.getByLabelText('Include beta in this search').click();
+    await page.getByRole('button', { name: 'Search selected buckets' }).click();
+    await expect.element(page.getByLabelText('Search query')).toHaveValue('report');
+    await expect.element(page.getByRole('button', { name: 'beta', exact: true })).toBeVisible();
+  });
+
+  it('opens the bucket collapsible instead of searching when a grouped entry row is clicked', async () => {
+    const { state, api } = createState({
+      history: [
+        {
+          buckets: ['alpha', 'beta'],
+          query: 'report',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    await page.getByRole('button', { name: /report/ }).click();
+    await expect.element(page.getByLabelText('Include beta in this search')).toBeVisible();
+    expect(api.search).not.toHaveBeenCalled();
+  });
+
+  it('shows tooltips on the bucket chooser and bucket checkboxes in recent entries', async () => {
+    const { state } = createState({
+      history: [
+        {
+          buckets: ['alpha', 'beta'],
+          query: 'report',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+
+    await page.getByRole('button', { name: 'Choose buckets' }).hover();
+    await expect.element(page.getByRole('tooltip').last()).toHaveTextContent('Choose buckets');
+
+    await page.getByRole('button', { name: 'Choose buckets' }).click();
+    await page.getByLabelText('Include alpha in this search').hover();
+    await expect.element(page.getByRole('tooltip').last()).toHaveTextContent('alpha');
+  });
+
+  it('clears recent searches', async () => {
+    const { state, api } = createState({
+      history: [
+        {
+          buckets: ['alpha'],
+          query: 'report',
+          useRegex: false,
+          excludePatterns: [],
+          searchPath: '',
+          maxDepth: null
+        }
+      ]
+    });
+    render(StorageSearchWrapper, { state });
+    await page.getByRole('button', { name: 'Open search' }).click();
+    await page.getByRole('tab', { name: 'Recent' }).click();
+    await page.getByRole('button', { name: 'Clear recent searches' }).click();
+    await page.getByRole('button', { name: 'Clear', exact: true }).click();
+    expect(api.clearRecentSearches).toHaveBeenCalled();
+    await expect
+      .element(page.getByText('Your recent searches will appear here.'))
+      .toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/__tests__/StorageSearchWrapper.svelte b/src/lib/components/storage/__tests__/StorageSearchWrapper.svelte
new file mode 100644
index 00000000..1b182de2
--- /dev/null
+++ b/src/lib/components/storage/__tests__/StorageSearchWrapper.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import StorageSearch from '../StorageSearch.svelte';
+
+  interface Props {
+    state: StorageState;
+    currentBucket?: string;
+  }
+
+  let { state, currentBucket }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<StorageSearch {currentBucket} />
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index 1552ee8a..48c2573e 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -60,7 +60,9 @@
     (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
       (storage.contextMenu !== null && storage.ctxIsFile)
   );
-  const canDownload = $derived(storage.selectedFiles.length > 0 || storage.ctxIsFile);
+  const canDownload = $derived(
+    storage.selectedFiles.length > 0 || storage.selectedFolders.length > 0 || storage.ctxIsFile
+  );
   const canShowDetails = $derived(
     storage.contextMenu !== null ||
       (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0)
diff --git a/src/lib/components/storage/explorer/DownloadHistory.svelte b/src/lib/components/storage/explorer/DownloadHistory.svelte
new file mode 100644
index 00000000..bfea581e
--- /dev/null
+++ b/src/lib/components/storage/explorer/DownloadHistory.svelte
@@ -0,0 +1,134 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { DownloadHistoryEntry } from '$lib/storage/api.js';
+  import { SvelteSet } from 'svelte/reactivity';
+  import { selectedDownloadHistoryPayloadSize } from '$lib/storage/download-history.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
+  import IconChevronDown from 'virtual:icons/material-symbols/keyboard-arrow-down';
+  import IconChevronUp from 'virtual:icons/material-symbols/keyboard-arrow-up';
+
+  interface Props {
+    entries: DownloadHistoryEntry[];
+    onDownload: (id: string, keys: string[]) => Promise<void>;
+  }
+
+  let { entries, onDownload }: Props = $props();
+  const uid = $props.id();
+  let expanded = $state<Record<string, boolean>>({});
+  let selected = $state<Record<string, string[]>>({});
+  let downloading = $state<string | null>(null);
+
+  function toggleDetails(id: string): void {
+    expanded = { ...expanded, [id]: !expanded[id] };
+  }
+
+  function toggleKey(id: string, key: string, checked: boolean): void {
+    const keys = new SvelteSet(selected[id] ?? []);
+    if (checked) keys.add(key);
+    else keys.delete(key);
+    selected = { ...selected, [id]: [...keys] };
+  }
+
+  async function download(id: string, keys: string[]): Promise<void> {
+    downloading = id;
+    try {
+      await onDownload(id, keys);
+    } finally {
+      downloading = null;
+    }
+  }
+</script>
+
+<section
+  class="border-base-300 min-h-0 flex-1 overflow-y-auto border-t px-3 py-3"
+  aria-label={m.storage_download_history_title()}
+>
+  <h2 class="text-base-content/50 mb-2 text-[10px] font-semibold tracking-widest uppercase">
+    {m.storage_download_history_title()}
+  </h2>
+  {#if entries.length === 0}
+    <p class="text-base-content/50 text-xs">{m.storage_download_history_empty()}</p>
+  {:else}
+    <ul class="space-y-2">
+      {#each entries as entry (entry.id)}
+        {@const chosen = selected[entry.id] ?? []}
+        {@const files = entry.entries.filter((item) => !item.isDirectory)}
+        {@const totalSize = entry.entries.reduce((total, item) => total + item.size, 0)}
+        {@const selectedSize = selectedDownloadHistoryPayloadSize(entry.entries, chosen)}
+        <li class="bg-base-200 rounded-lg p-2.5">
+          <button
+            class="hover:bg-base-300/50 focus-visible:outline-primary flex w-full cursor-pointer items-center gap-2 rounded text-left transition-colors focus-visible:outline-2 focus-visible:outline-offset-2"
+            aria-expanded={expanded[entry.id]}
+            aria-label={expanded[entry.id]
+              ? m.storage_download_history_hide_details()
+              : m.storage_download_history_show_details()}
+            onclick={() => toggleDetails(entry.id)}
+          >
+            <span class="min-w-0 flex-1">
+              <span class="text-base-content block truncate text-xs font-medium"
+                >{entry.bucket}</span
+              >
+              <span class="text-base-content/60 block text-[10px]">
+                {new Date(entry.createdAt).toLocaleString()} · {m.storage_download_history_file_count(
+                  { count: entry.entries.length }
+                )} · {formatFileSize(totalSize)} · {entry.archive
+                  ? m.storage_download_history_zip()
+                  : m.storage_download_history_direct()}
+              </span>
+            </span>
+            <span class="btn btn-ghost btn-xs" aria-hidden="true">
+              {#if expanded[entry.id]}
+                <IconChevronUp aria-hidden="true" />
+              {:else}
+                <IconChevronDown aria-hidden="true" />
+              {/if}
+            </span>
+          </button>
+          {#if expanded[entry.id]}
+            <fieldset class="border-base-300 mt-2 min-w-0 space-y-1 border-t pt-2">
+              <legend class="text-base-content/70 text-[11px]" aria-live="polite">
+                {m.storage_download_history_selected_count({ count: chosen.length })} · {formatFileSize(
+                  selectedSize
+                )}
+              </legend>
+              {#each files as item (`${entry.id}-${item.key}`)}
+                <div class="flex items-center gap-2">
+                  <input
+                    id={`${uid}-${entry.id}-${item.key}`}
+                    class="checkbox checkbox-xs"
+                    type="checkbox"
+                    checked={chosen.includes(item.key)}
+                    onchange={(event) => toggleKey(entry.id, item.key, event.currentTarget.checked)}
+                  />
+                  <label
+                    for={`${uid}-${entry.id}-${item.key}`}
+                    class="text-base-content min-w-0 flex-1 truncate text-xs"
+                    >{item.key}
+                    <span class="text-base-content/50">({formatFileSize(item.size)})</span></label
+                  >
+                </div>
+              {/each}
+            </fieldset>
+            <div class="mt-2 flex flex-wrap gap-2">
+              <button
+                class="btn btn-primary btn-xs"
+                disabled={chosen.length === 0 || downloading === entry.id}
+                onclick={() => download(entry.id, chosen)}
+                >{m.storage_download_history_download_selected()}</button
+              >
+              <button
+                class="btn btn-ghost btn-xs"
+                disabled={downloading === entry.id}
+                onclick={() =>
+                  download(
+                    entry.id,
+                    entry.entries.map((item) => item.key)
+                  )}>{m.storage_download_history_download_all()}</button
+              >
+            </div>
+          {/if}
+        </li>
+      {/each}
+    </ul>
+  {/if}
+</section>
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 931e8fab..2a96dc59 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -84,7 +84,9 @@
     (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
       (storage.contextMenu !== null && storage.ctxIsFile)
   );
-  const canDownload = $derived(storage.selectedFiles.length > 0 || storage.ctxIsFile);
+  const canDownload = $derived(
+    storage.selectedFiles.length > 0 || storage.selectedFolders.length > 0 || storage.ctxIsFile
+  );
   const canShowDetails = $derived(
     storage.contextMenu !== null ||
       (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0)
diff --git a/src/lib/components/storage/explorer/OperationsButton.svelte b/src/lib/components/storage/explorer/OperationsButton.svelte
index 4056c44b..d897f08b 100644
--- a/src/lib/components/storage/explorer/OperationsButton.svelte
+++ b/src/lib/components/storage/explorer/OperationsButton.svelte
@@ -14,6 +14,8 @@
   import IconDeleteSweep from 'virtual:icons/material-symbols/delete-sweep-outline';
   import IconHistory from 'virtual:icons/material-symbols/history';
   import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
+  import IconDownload from 'virtual:icons/material-symbols/download';
+  import DownloadHistory from './DownloadHistory.svelte';
 
   const storage = getStorageState();
 
@@ -21,48 +23,12 @@
     paste: IconContentPaste,
     move: IconDriveFileMove,
     rename: IconEdit,
-    delete: IconDelete
+    delete: IconDelete,
+    download: IconDownload
   };
 
   let dropdownOpen = $state(false);
-  let tick = $state(0);
   let expandedOps: Record<string, boolean> = $state({});
-  let dropdownEl: HTMLDivElement | undefined = $state();
-
-  interface ChunkTrack {
-    prevBytes: number;
-    chunkStart: number;
-    chunkBytes: number;
-  }
-  let chunkTracks: Record<string, ChunkTrack> = {};
-
-  $effect(() => {
-    if (!storage.hasRunningOps) return;
-    const hasByteProgress = storage.operations.some(
-      (op) => op.status === 'running' && op.totalBytes > 0
-    );
-    const intervalMs = hasByteProgress ? 100 : 1000;
-    const id = setInterval(() => {
-      tick++;
-      for (const op of storage.operations) {
-        if (op.status !== 'running' || op.totalBytes <= 0) continue;
-        const track = chunkTracks[op.id];
-        if (!track) {
-          chunkTracks[op.id] = {
-            prevBytes: op.completedBytes,
-            chunkStart: Date.now(),
-            chunkBytes: 0
-          };
-        } else if (op.completedBytes !== track.prevBytes) {
-          const diff = op.completedBytes - track.prevBytes;
-          track.prevBytes = op.completedBytes;
-          track.chunkBytes = diff;
-          track.chunkStart = Date.now();
-        }
-      }
-    }, intervalMs);
-    return () => clearInterval(id);
-  });
 
   function toggleDropdown() {
     dropdownOpen = !dropdownOpen;
@@ -72,15 +38,18 @@
     expandedOps = { ...expandedOps, [opId]: !expandedOps[opId] };
   }
 
-  const activeOps = $derived(storage.operations.filter((op) => op.status === 'running'));
+  const visibleOps = $derived(storage.operations.filter((op) => op.type !== 'download'));
+  const activeOps = $derived(visibleOps.filter((op) => op.status === 'running'));
   const historyOps = $derived(
-    storage.operations
+    visibleOps
       .filter((op) => op.status !== 'running')
       .slice()
       .reverse()
   );
   const hasHistory = $derived(historyOps.length > 0);
-  const hasError = $derived(storage.operations.some((o) => o.status === 'error'));
+  const hasAnyHistory = $derived(hasHistory || storage.downloadHistory.length > 0);
+  const hasRunningOps = $derived(activeOps.length > 0);
+  const hasError = $derived(visibleOps.some((op) => op.status === 'error'));
 
   function statusColor(op: StorageOperation): string {
     switch (op.status) {
@@ -121,12 +90,11 @@
       case 'interrupted':
         return m.storage_operation_interrupted();
       default:
-        return op.errorMessage ?? m.storage_operation_failed();
+        return m.storage_operation_failed();
     }
   }
 
   function formatElapsed(startedAt: number, completedAt: number | undefined): string {
-    void tick;
     const end = completedAt ?? Date.now();
     const seconds = Math.floor((end - startedAt) / 1000);
     if (seconds < 60) return `${seconds}s`;
@@ -144,22 +112,10 @@
   }
 
   /**
-   * Return an interpolated completedBytes that smooths over chunk boundaries.
-   * When a new chunk completes (a jump in completedBytes), this converges
-   * smoothly from the previous value to the new one over ~1.5s instead of
-   * snapping, giving a smoother visual for multipart S3 copy operations
-   * where each part is 256 MB.
+   * Use the latest server-reported byte total for the progress display.
    */
   function displayBytes(op: StorageOperation): number {
-    if (op.status !== 'running' || op.totalBytes <= 0) return op.completedBytes;
-    void tick;
-    const track = chunkTracks[op.id];
-    if (!track || track.chunkBytes <= 0) return op.completedBytes;
-    const elapsed = (Date.now() - track.chunkStart) / 1000;
-    const expectedDuration = 1.5;
-    const progress = Math.min(1, elapsed / expectedDuration);
-    const chunkProgress = track.chunkBytes * progress;
-    return Math.min(track.prevBytes, track.prevBytes - track.chunkBytes + chunkProgress);
+    return op.completedBytes;
   }
 
   function percent(op: StorageOperation): number {
@@ -179,7 +135,6 @@
   }
 
   function speedLabel(op: StorageOperation): string {
-    void tick;
     const elapsed = (Date.now() - op.startedAt) / 1000;
     if (elapsed <= 0 || op.completedBytes <= 0) return '';
     const bytesPerSec = op.completedBytes / elapsed;
@@ -187,7 +142,6 @@
   }
 
   function etaLabel(op: StorageOperation): string {
-    void tick;
     const elapsed = (Date.now() - op.startedAt) / 1000;
     if (elapsed <= 0 || op.completedBytes <= 0 || op.totalBytes <= 0) return '';
     const bytesPerSec = op.completedBytes / elapsed;
@@ -211,7 +165,7 @@
 
 <svelte:window onkeydown={(e) => e.key === 'Escape' && (dropdownOpen = false)} />
 
-{#if storage.operations.length > 0}
+{#if visibleOps.length > 0 || storage.downloadHistory.length > 0 || storage.downloadHistoryLoading}
   {#if dropdownOpen}
     <div
       class="fixed inset-0 z-40"
@@ -220,20 +174,20 @@
       aria-hidden="true"
     ></div>
   {/if}
-  <div bind:this={dropdownEl} class="relative z-50 inline-flex">
+  <div class="relative z-50 inline-flex">
     <!-- Trigger button -->
     <div class="tooltip tooltip-bottom" data-tip={m.storage_operations_label()}>
       <button
         class="
           btn btn-ghost btn-xs relative size-7 rounded-full p-0
-          {storage.hasRunningOps ? 'text-primary' : hasError ? 'text-error' : 'text-success'}
+          {hasRunningOps ? 'text-primary' : hasError ? 'text-error' : 'text-success'}
         "
         aria-label={m.storage_operations_label()}
         aria-expanded={dropdownOpen}
         aria-haspopup="menu"
         onclick={toggleDropdown}
       >
-        {#if storage.hasRunningOps}
+        {#if hasRunningOps}
           <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
           {#if activeOps.length > 1}
             <span
@@ -256,7 +210,7 @@
       <div
         role="menu"
         aria-label={m.storage_operations_label()}
-        class="rounded-box border-base-300 bg-base-100 absolute right-0 z-60 mt-2 flex max-h-[calc(100dvh-8rem)] w-96 flex-col overflow-hidden border shadow-xl"
+        class="rounded-box border-base-300 bg-base-100 absolute right-0 z-60 mt-2 flex max-h-[calc(100dvh-6rem)] w-[min(24rem,calc(100vw-1rem))] origin-top-right flex-col overflow-hidden border shadow-xl"
       >
         <!-- Active operations section -->
         {#if activeOps.length > 0}
@@ -324,7 +278,7 @@
                   <!-- Expanded detail -->
                   {#if expandedOps[op.id]}
                     <div class="mt-2 space-y-1.5">
-                      <!-- Current file -->
+                      <!-- Active files -->
                       {#if op.currentFileName}
                         <div class="text-base-content/50 truncate pl-5 text-[11px]">
                           {op.currentFileName}
@@ -395,7 +349,7 @@
                       </div>
                     </div>
                   {:else}
-                    <!-- Collapsed: current file name on single line -->
+                    <!-- Collapsed: active files on single line -->
                     {#if op.currentFileName}
                       <div class="text-base-content/40 mt-1 truncate pl-5 text-[10px]">
                         {op.currentFileName}
@@ -409,7 +363,7 @@
         {/if}
 
         <!-- History section -->
-        {#if hasHistory}
+        {#if hasAnyHistory}
           <div class="flex min-h-0 flex-1 flex-col px-3 pt-2.5 pb-2">
             <div class="mb-2 flex items-center justify-between">
               <p class="text-base-content/50 text-[10px] font-semibold tracking-widest uppercase">
@@ -424,73 +378,75 @@
                 {m.storage_operations_clear_history()}
               </button>
             </div>
-            <ul class="mb-10 min-h-0 flex-1 space-y-1 overflow-y-auto">
-              {#each historyOps as op (op.id)}
-                {@const TypeIcon = typeIconMap[op.type]}
-                <li role="none" class="rounded-md px-2.5 py-2 {statusBgColor(op)}">
-                  <div class="flex items-center gap-2">
-                    <!-- Status icon -->
-                    <span class="shrink-0 {statusColor(op)}" aria-hidden="true">
-                      {#if op.status === 'done'}
-                        <IconCheckCircle class="size-3.5" />
-                      {:else if op.status === 'error'}
-                        <IconError class="size-3.5" />
-                      {:else if op.status === 'cancelled'}
-                        <IconCancel class="size-3.5" />
-                      {:else}
-                        <IconPowerOff class="size-3.5" />
-                      {/if}
-                    </span>
-                    <!-- Operation type icon -->
-                    <span class="text-base-content/50 shrink-0" aria-hidden="true">
-                      <TypeIcon class="size-3" />
-                    </span>
-                    <span class="text-base-content/80 min-w-0 flex-1 truncate text-[11px]">
-                      {op.label}
-                    </span>
-                    <div class="flex shrink-0 flex-col items-end gap-0.5">
-                      <span class="text-[10px] font-medium {statusColor(op)}">
-                        {statusLabel(op)}
+            {#if hasHistory}
+              <ul class="mb-10 min-h-0 flex-1 space-y-1 overflow-y-auto">
+                {#each historyOps as op (op.id)}
+                  {@const TypeIcon = typeIconMap[op.type]}
+                  <li role="none" class="rounded-md px-2.5 py-2 {statusBgColor(op)}">
+                    <div class="flex items-center gap-2">
+                      <!-- Status icon -->
+                      <span class="shrink-0 {statusColor(op)}" aria-hidden="true">
+                        {#if op.status === 'done'}
+                          <IconCheckCircle class="size-3.5" />
+                        {:else if op.status === 'error'}
+                          <IconError class="size-3.5" />
+                        {:else if op.status === 'cancelled'}
+                          <IconCancel class="size-3.5" />
+                        {:else}
+                          <IconPowerOff class="size-3.5" />
+                        {/if}
                       </span>
-                      <span class="text-base-content/35 text-[9px] tabular-nums">
-                        {formatElapsed(op.startedAt, op.completedAt)}
+                      <!-- Operation type icon -->
+                      <span class="text-base-content/50 shrink-0" aria-hidden="true">
+                        <TypeIcon class="size-3" />
+                      </span>
+                      <span class="text-base-content/80 min-w-0 flex-1 truncate text-[11px]">
+                        {op.label}
                       </span>
+                      <div class="flex shrink-0 flex-col items-end gap-0.5">
+                        <span class="text-[10px] font-medium {statusColor(op)}">
+                          {statusLabel(op)}
+                        </span>
+                        <span class="text-base-content/35 text-[9px] tabular-nums">
+                          {formatElapsed(op.startedAt, op.completedAt)}
+                        </span>
+                      </div>
                     </div>
-                  </div>
 
-                  <!-- Error detail -->
-                  {#if op.status === 'error' && op.errorMessage}
-                    <div
-                      class="text-error/70 mt-1 truncate pl-5 text-[10px]"
-                      title={op.errorMessage}
-                    >
-                      {op.errorMessage}
-                    </div>
-                  {:else if op.status === 'interrupted'}
-                    <div class="text-warning/60 mt-1 pl-5 text-[10px]">
-                      {m.storage_operations_interrupted_tooltip()}
-                    </div>
-                  {/if}
+                    <!-- Error detail -->
+                    {#if op.status === 'error' && op.errorMessage}
+                      <div
+                        class="text-error/70 mt-1 truncate pl-5 text-[10px]"
+                        title={op.errorMessage}
+                      >
+                        {op.errorMessage}
+                      </div>
+                    {:else if op.status === 'interrupted'}
+                      <div class="text-warning/60 mt-1 pl-5 text-[10px]">
+                        {m.storage_operations_interrupted_tooltip()}
+                      </div>
+                    {/if}
 
-                  <!-- Partial progress for interrupted / error -->
-                  {#if (op.status === 'interrupted' || op.status === 'error') && op.totalBytes > 0}
-                    <div class="mt-1.5 pl-5">
-                      <div class="bg-base-300 h-1 w-full overflow-hidden rounded-full">
-                        <div
-                          class="h-full rounded-full {op.status === 'interrupted'
-                            ? 'bg-warning'
-                            : 'bg-error'}"
-                          style="width: {percent(op)}%"
-                        ></div>
+                    <!-- Partial progress for interrupted / error -->
+                    {#if (op.status === 'interrupted' || op.status === 'error') && op.totalBytes > 0}
+                      <div class="mt-1.5 pl-5">
+                        <div class="bg-base-300 h-1 w-full overflow-hidden rounded-full">
+                          <div
+                            class="h-full rounded-full {op.status === 'interrupted'
+                              ? 'bg-warning'
+                              : 'bg-error'}"
+                            style="width: {percent(op)}%"
+                          ></div>
+                        </div>
+                        <span class="text-base-content/35 text-[9px] tabular-nums">
+                          {formatBytes(op.completedBytes)} / {formatBytes(op.totalBytes)}
+                        </span>
                       </div>
-                      <span class="text-base-content/35 text-[9px] tabular-nums">
-                        {formatBytes(op.completedBytes)} / {formatBytes(op.totalBytes)}
-                      </span>
-                    </div>
-                  {/if}
-                </li>
-              {/each}
-            </ul>
+                    {/if}
+                  </li>
+                {/each}
+              </ul>
+            {/if}
           </div>
         {:else if activeOps.length === 0}
           <div class="text-base-content/40 flex items-center gap-2 px-4 py-3">
@@ -498,6 +454,10 @@
             <span class="text-xs">{m.storage_operations_history()}</span>
           </div>
         {/if}
+        <DownloadHistory
+          entries={storage.downloadHistory}
+          onDownload={(id, keys) => storage.redownloadHistory(id, keys)}
+        />
       </div>
     {/if}
   </div>
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index 693598e3..259dccc1 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -5,7 +5,9 @@
   import IconDelete from 'virtual:icons/material-symbols/delete';
   import IconRefresh from 'virtual:icons/material-symbols/refresh';
   import * as m from '$lib/paraglide/messages.js';
+  import StorageSearch from '$lib/components/storage/StorageSearch.svelte';
   import { getStorageState } from '$lib/storage/context.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
 
   const storage = getStorageState();
 
@@ -13,8 +15,9 @@
   const canPreview = $derived(
     storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0
   );
-  const canDownload = $derived(
-    storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0
+  const canDownload = $derived(selectedCount > 0);
+  const selectedFileSize = $derived(
+    storage.selectedFiles.reduce((total, file) => total + file.size, 0)
   );
 </script>
 
@@ -24,6 +27,11 @@
       <span class="text-base-content/50 mr-1 text-xs">
         {m.storage_selected({ count: selectedCount })}
       </span>
+      {#if storage.selectedFiles.length > 0}
+        <span class="text-base-content/50 text-xs">
+          {m.storage_selected_files_size({ size: formatFileSize(selectedFileSize) })}
+        </span>
+      {/if}
 
       <button
         class="btn btn-ghost btn-xs gap-1"
@@ -70,7 +78,8 @@
         </button>
       {/if}
 
-      <div class="ml-auto">
+      <div class="ml-auto flex items-center gap-1">
+        <StorageSearch currentBucket={storage.bucket} />
         <button
           class="btn btn-ghost btn-xs gap-1 text-white"
           title={m.storage_action_refresh()}
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 4f881b82..18b9ac86 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -542,14 +542,14 @@
   <!-- Item count badges -->
   <div class="flex shrink-0 items-center gap-1.5">
     <span
-      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-30 gap-1"
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm pointer-events-none z-30 gap-1"
       data-tip={m.storage_folder_count({ count: storage.folders.length })}
     >
       <IconFolderOutline class="size-4" aria-hidden="true" />
       <span class="font-bold">{storage.folders.length}</span>
     </span>
     <span
-      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-30 gap-1"
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm pointer-events-none z-30 gap-1"
       data-tip={m.storage_file_count({ count: storage.files.length })}
     >
       <IconDescriptionOutline class="size-4" aria-hidden="true" />
diff --git a/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
index 6f823e49..994ca594 100644
--- a/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
@@ -82,7 +82,7 @@ describe('ContextMenu', () => {
     await expect.element(previewBtn).toHaveAttribute('disabled');
   });
 
-  it('should disable download when context is a folder with no selected files', async () => {
+  it('should enable download when context is a folder', async () => {
     const folder = makeFolder('docs/');
     const state = createState([folder], {
       contextMenu: { x: 100, y: 100, key: 'docs/' },
@@ -91,7 +91,7 @@ describe('ContextMenu', () => {
     render(ContextMenuWrapper, { state });
 
     const downloadBtn = page.getByRole('menuitem', { name: 'Download' });
-    await expect.element(downloadBtn).toHaveAttribute('disabled');
+    await expect.element(downloadBtn).not.toHaveAttribute('disabled');
   });
 
   it('should enable download when context is a file', async () => {
diff --git a/src/lib/components/storage/explorer/__tests__/DownloadHistory.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/DownloadHistory.svelte.spec.ts
new file mode 100644
index 00000000..ddb60b57
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/DownloadHistory.svelte.spec.ts
@@ -0,0 +1,107 @@
+import '../../../../../app.css';
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import DownloadHistory from '../DownloadHistory.svelte';
+import type { DownloadHistoryEntry } from '$lib/storage/api.js';
+
+function makeEntry(overrides: Partial<DownloadHistoryEntry> = {}): DownloadHistoryEntry {
+  return {
+    id: 'entry-1',
+    bucket: 'test-bucket',
+    connectionId: 'connection-1',
+    entries: [
+      { key: 'reports/one.txt', size: 1024, isDirectory: false },
+      { key: 'reports/two.txt', size: 2048, isDirectory: false }
+    ],
+    archive: true,
+    archiveFilename: 'test-bucket.zip',
+    createdAt: new Date('2026-08-24T10:00:00Z').toISOString(),
+    expiresAt: new Date(Date.now() + 86_400_000).toISOString(),
+    ...overrides
+  };
+}
+
+function renderHistory(entries: DownloadHistoryEntry[], onDownload = vi.fn(async () => {})) {
+  const { container, unmount } = render(DownloadHistory, { entries, onDownload });
+  const section = container.querySelector('section') as HTMLElement;
+  // Constrain to the operations dropdown panel width.
+  section.style.width = '384px';
+  return { section, onDownload, unmount };
+}
+
+describe('DownloadHistory', () => {
+  it('shows the empty state when there are no entries', async () => {
+    renderHistory([]);
+    await expect.element(page.getByText('No downloads in the last 30 days.')).toBeInTheDocument();
+  });
+
+  it('renders entry metadata with file count and archive format', async () => {
+    renderHistory([makeEntry()]);
+    await expect.element(page.getByText('test-bucket')).toBeInTheDocument();
+    await expect.element(page.getByText('2 files')).toBeInTheDocument();
+    await expect.element(page.getByText('ZIP')).toBeInTheDocument();
+  });
+
+  it('expands details and reports the number of selected files', async () => {
+    renderHistory([makeEntry()]);
+    await page.getByRole('button', { name: 'Show details' }).click();
+
+    const checkboxes = page.getByRole('checkbox');
+    await expect.element(checkboxes).toHaveLength(2);
+
+    await page.getByLabelText(/reports\/one\.txt/).click();
+    await expect.element(page.getByText('1 selected')).toBeInTheDocument();
+
+    await page.getByLabelText(/reports\/one\.txt/).click();
+    await expect.element(page.getByText('0 selected')).toBeInTheDocument();
+  });
+
+  it('downloads the selected keys via the callback', async () => {
+    const onDownload = vi.fn(async () => {});
+    renderHistory([makeEntry()], onDownload);
+    await page.getByRole('button', { name: 'Show details' }).click();
+    await page.getByLabelText(/reports\/two\.txt/).click();
+
+    await page.getByRole('button', { name: 'Download selected' }).click();
+
+    await vi.waitFor(() => expect(onDownload).toHaveBeenCalledWith('entry-1', ['reports/two.txt']));
+    await expect
+      .element(page.getByRole('button', { name: 'Download selected' }))
+      .not.toBeDisabled();
+  });
+
+  it('only lists files in expanded details', async () => {
+    renderHistory([
+      makeEntry({
+        entries: [
+          { key: 'reports/', size: 0, isDirectory: true },
+          { key: 'reports/one.txt', size: 1024, isDirectory: false }
+        ]
+      })
+    ]);
+    await page.getByRole('button', { name: 'Show details' }).click();
+
+    await expect.element(page.getByRole('checkbox')).toHaveLength(1);
+    await expect.element(page.getByLabelText(/reports\/one\.txt/)).toBeInTheDocument();
+    await expect.element(page.getByText('reports/', { exact: true })).not.toBeInTheDocument();
+  });
+
+  it('does not overflow horizontally with a long unbreakable object key', async () => {
+    const longKey = `very-long-object-name-${'x'.repeat(120)}.bin`;
+    const { section } = renderHistory([
+      makeEntry({ entries: [{ key: longKey, size: 123_456, isDirectory: false }] })
+    ]);
+    await page.getByRole('button', { name: 'Show details' }).click();
+    await expect.element(page.getByText(/0 selected/)).toBeInTheDocument();
+
+    expect(section.scrollWidth).toBeLessThanOrEqual(section.clientWidth);
+  });
+
+  it('does not overflow horizontally with a very long bucket name', async () => {
+    const { section } = renderHistory([
+      makeEntry({ bucket: `extremely-long-bucket-name-${'y'.repeat(120)}` })
+    ]);
+    expect(section.scrollWidth).toBeLessThanOrEqual(section.clientWidth);
+  });
+});
diff --git a/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
index ecb33bd2..e350ec06 100644
--- a/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
@@ -39,6 +39,14 @@ describe('SelectionToolbar', () => {
     await expect.element(page.getByText('2 selected')).toBeInTheDocument();
   });
 
+  it('shows the cumulative size of selected files', async () => {
+    const files = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(files, ['a.txt', 'b.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    await expect.element(page.getByText('Selected files: 2.05 kB')).toBeInTheDocument();
+  });
+
   it('should enable preview button when exactly 1 file selected', async () => {
     const files = [makeFile('a.txt')];
     const state = createState(files, ['a.txt']);
@@ -75,13 +83,22 @@ describe('SelectionToolbar', () => {
     await expect.element(btn).not.toBeDisabled();
   });
 
-  it('should disable download when folder selected', async () => {
+  it('should enable download when folder selected', async () => {
     const objects = [makeFolder('dir/')];
     const state = createState(objects, ['dir/']);
     render(SelectionToolbarWrapper, { state });
 
     const btn = page.getByRole('button', { name: /Download/ });
-    await expect.element(btn).toBeDisabled();
+    await expect.element(btn).not.toBeDisabled();
+  });
+
+  it('should enable download when multiple files are selected', async () => {
+    const files = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(files, ['a.txt', 'b.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Download/ });
+    await expect.element(btn).not.toBeDisabled();
   });
 
   it('should enable delete button when items are selected', async () => {
diff --git a/src/lib/components/storage/modals/StorageModals.svelte b/src/lib/components/storage/modals/StorageModals.svelte
index 796efce8..aad8e2de 100644
--- a/src/lib/components/storage/modals/StorageModals.svelte
+++ b/src/lib/components/storage/modals/StorageModals.svelte
@@ -104,7 +104,7 @@
 {#if storage.activeModal?.type === 'preview'}
   <PreviewModal
     bind:open={previewOpen}
-    bucket={storage.bucket}
+    bucket={storage.activeModal.payload.bucket ?? storage.bucket}
     objectKey={storage.activeModal.payload.key}
     archiveKey={storage.activeModal.payload.archiveKey}
     archivePath={storage.activeModal.payload.archivePath}
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 6289074f..453aaf1b 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -144,3 +144,14 @@ export const storageRenameEnabled =
  *  API endpoint (drag-and-drop) is active. Uses PUBLIC_ key. Disabled by default. */
 export const storageMoveEnabled =
   (publicEnv.PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED ?? 'false') === 'true';
+
+// ── Storage browser: downloads ─────────────────────────────────────────────
+
+/** Days that a user's download history remains available. Controlled by
+ * `STACKABLE_COCKPIT_DOWNLOAD_HISTORY_RETENTION_DAYS`. */
+export const downloadHistoryRetentionMs =
+  (parseInt(env.STACKABLE_COCKPIT_DOWNLOAD_HISTORY_RETENTION_DAYS ?? '', 10) || 30) *
+  24 *
+  60 *
+  60 *
+  1000;
diff --git a/src/lib/server/metrics.ts b/src/lib/server/metrics.ts
index b11cf821..3e12e192 100644
--- a/src/lib/server/metrics.ts
+++ b/src/lib/server/metrics.ts
@@ -24,3 +24,17 @@ export const trinoActiveQueries = new Gauge({
   help: 'Number of active Trino queries submitted through Stackable UI',
   registers: [register]
 });
+
+export const storageSearchTotal = new Counter({
+  name: 'storage_search_total',
+  help: 'Bucket-scoped storage searches executed through the Stackable UI',
+  labelNames: ['outcome'],
+  registers: [register]
+});
+
+export const storageSearchHistoryTotal = new Counter({
+  name: 'storage_search_history_total',
+  help: 'Recent storage search history operations executed through the Stackable UI',
+  labelNames: ['operation', 'outcome'],
+  registers: [register]
+});
diff --git a/src/lib/server/migrations/0000_calm_jimmy_woo.sql b/src/lib/server/migrations/0000_calm_jimmy_woo.sql
deleted file mode 100644
index 34720993..00000000
--- a/src/lib/server/migrations/0000_calm_jimmy_woo.sql
+++ /dev/null
@@ -1,12 +0,0 @@
-CREATE TABLE "user_storage_connections" (
-	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
-	"user_id" text NOT NULL,
-	"name" text NOT NULL,
-	"encrypted_payload" text NOT NULL,
-	"hash" text NOT NULL,
-	"additional_buckets" jsonb DEFAULT '[]' NOT NULL,
-	"created_at" timestamp DEFAULT now() NOT NULL,
-	"updated_at" timestamp DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE INDEX "user_id_idx" ON "user_storage_connections" USING btree ("user_id");
diff --git a/src/lib/server/migrations/0002_dashing_nuke.sql b/src/lib/server/migrations/0000_friendly_vulcan.sql
similarity index 56%
rename from src/lib/server/migrations/0002_dashing_nuke.sql
rename to src/lib/server/migrations/0000_friendly_vulcan.sql
index 68fb0651..af787303 100644
--- a/src/lib/server/migrations/0002_dashing_nuke.sql
+++ b/src/lib/server/migrations/0000_friendly_vulcan.sql
@@ -1,3 +1,29 @@
+CREATE TABLE "user_recent_searches" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" text NOT NULL,
+	"connection_id" uuid NOT NULL,
+	"buckets" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"query" text NOT NULL,
+	"use_regex" boolean DEFAULT false NOT NULL,
+	"exclude_patterns" text[] DEFAULT '{}' NOT NULL,
+	"search_path" text DEFAULT '' NOT NULL,
+	"max_depth" integer,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "user_recent_searches_connection_query" UNIQUE NULLS NOT DISTINCT("user_id","connection_id","query","use_regex","exclude_patterns","search_path","max_depth","buckets")
+);
+--> statement-breakpoint
+CREATE TABLE "user_storage_connections" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" text NOT NULL,
+	"name" text NOT NULL,
+	"encrypted_payload" text NOT NULL,
+	"hash" text NOT NULL,
+	"additional_buckets" jsonb DEFAULT '[]' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "user_storage_connections_user_id_name_unique" UNIQUE("user_id","name")
+);
+--> statement-breakpoint
 CREATE TABLE "account" (
 	"id" text PRIMARY KEY NOT NULL,
 	"account_id" text NOT NULL,
@@ -48,8 +74,11 @@ CREATE TABLE "verification" (
 	"updated_at" timestamp DEFAULT now() NOT NULL
 );
 --> statement-breakpoint
+ALTER TABLE "user_recent_searches" ADD CONSTRAINT "user_recent_searches_connection_id_user_storage_connections_id_fk" FOREIGN KEY ("connection_id") REFERENCES "public"."user_storage_connections"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "user_recent_searches_connection_idx" ON "user_recent_searches" USING btree ("user_id","connection_id");--> statement-breakpoint
+CREATE INDEX "user_id_idx" ON "user_storage_connections" USING btree ("user_id");--> statement-breakpoint
 CREATE INDEX "account_userId_idx" ON "account" USING btree ("user_id");--> statement-breakpoint
 CREATE INDEX "session_userId_idx" ON "session" USING btree ("user_id");--> statement-breakpoint
 CREATE INDEX "verification_identifier_idx" ON "verification" USING btree ("identifier");
diff --git a/src/lib/server/migrations/0001_add_unique_connection_name.sql b/src/lib/server/migrations/0001_add_unique_connection_name.sql
deleted file mode 100644
index f85c97bf..00000000
--- a/src/lib/server/migrations/0001_add_unique_connection_name.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE "user_storage_connections" ADD CONSTRAINT "user_storage_connections_user_id_name_unique" UNIQUE("user_id","name");
diff --git a/src/lib/server/migrations/0001_keen_prodigy.sql b/src/lib/server/migrations/0001_keen_prodigy.sql
deleted file mode 100644
index f85c97bf..00000000
--- a/src/lib/server/migrations/0001_keen_prodigy.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE "user_storage_connections" ADD CONSTRAINT "user_storage_connections_user_id_name_unique" UNIQUE("user_id","name");
diff --git a/src/lib/server/migrations/0003_short_malcolm_colcord.sql b/src/lib/server/migrations/0003_short_malcolm_colcord.sql
new file mode 100644
index 00000000..d19b941f
--- /dev/null
+++ b/src/lib/server/migrations/0003_short_malcolm_colcord.sql
@@ -0,0 +1,14 @@
+CREATE TABLE "storage_download_manifests" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" text NOT NULL,
+	"connection_id" uuid NOT NULL,
+	"bucket" text NOT NULL,
+	"prefix" text NOT NULL,
+	"entries" jsonb NOT NULL,
+	"format" text NOT NULL,
+	"archive" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "storage_download_manifests_user_expiry_idx" ON "storage_download_manifests" USING btree ("user_id","expires_at");
diff --git a/src/lib/server/migrations/meta/0000_snapshot.json b/src/lib/server/migrations/meta/0000_snapshot.json
index 9a9dcb6e..9f696d4b 100644
--- a/src/lib/server/migrations/meta/0000_snapshot.json
+++ b/src/lib/server/migrations/meta/0000_snapshot.json
@@ -1,9 +1,135 @@
 {
-  "id": "37569bc7-4e3e-4cc3-b3db-daa37dc0cd52",
+  "id": "7fcb6ac4-f556-42a4-aabf-0baa74a178f1",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",
   "tables": {
+    "public.user_recent_searches": {
+      "name": "user_recent_searches",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "buckets": {
+          "name": "buckets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query": {
+          "name": "query",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "use_regex": {
+          "name": "use_regex",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "exclude_patterns": {
+          "name": "exclude_patterns",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "search_path": {
+          "name": "search_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "max_depth": {
+          "name": "max_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_recent_searches_connection_idx": {
+          "name": "user_recent_searches_connection_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_recent_searches_connection_id_user_storage_connections_id_fk": {
+          "name": "user_recent_searches_connection_id_user_storage_connections_id_fk",
+          "tableFrom": "user_recent_searches",
+          "tableTo": "user_storage_connections",
+          "columnsFrom": ["connection_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_recent_searches_connection_query": {
+          "name": "user_recent_searches_connection_query",
+          "nullsNotDistinct": false,
+          "columns": [
+            "user_id",
+            "connection_id",
+            "query",
+            "use_regex",
+            "exclude_patterns",
+            "search_path",
+            "max_depth",
+            "buckets"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
     "public.user_storage_connections": {
       "name": "user_storage_connections",
       "schema": "",
@@ -80,6 +206,367 @@
       },
       "foreignKeys": {},
       "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_storage_connections_user_id_name_unique": {
+          "name": "user_storage_connections_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "account_userId_idx": {
+          "name": "account_userId_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_storage_connection_id": {
+          "name": "active_storage_connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "session_userId_idx": {
+          "name": "session_userId_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "username": {
+          "name": "username",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "verification_identifier_idx": {
+          "name": "verification_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
       "uniqueConstraints": {},
       "policies": {},
       "checkConstraints": {},
diff --git a/src/lib/server/migrations/meta/0001_snapshot.json b/src/lib/server/migrations/meta/0001_snapshot.json
deleted file mode 100644
index 11c82878..00000000
--- a/src/lib/server/migrations/meta/0001_snapshot.json
+++ /dev/null
@@ -1,106 +0,0 @@
-{
-  "id": "1b23e196-397b-4589-94f8-7fab70a5fbec",
-  "prevId": "37569bc7-4e3e-4cc3-b3db-daa37dc0cd52",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.user_storage_connections": {
-      "name": "user_storage_connections",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "uuid",
-          "primaryKey": true,
-          "notNull": true,
-          "default": "gen_random_uuid()"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "encrypted_payload": {
-          "name": "encrypted_payload",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "hash": {
-          "name": "hash",
-          "type": "text",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "additional_buckets": {
-          "name": "additional_buckets",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'"
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "updated_at": {
-          "name": "updated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {
-        "user_id_idx": {
-          "name": "user_id_idx",
-          "columns": [
-            {
-              "expression": "user_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {},
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "user_storage_connections_user_id_name_unique": {
-          "name": "user_storage_connections_user_id_name_unique",
-          "nullsNotDistinct": false,
-          "columns": ["user_id", "name"]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": {
-    "columns": {},
-    "schemas": {},
-    "tables": {}
-  }
-}
diff --git a/src/lib/server/migrations/meta/0002_snapshot.json b/src/lib/server/migrations/meta/0003_snapshot.json
similarity index 81%
rename from src/lib/server/migrations/meta/0002_snapshot.json
rename to src/lib/server/migrations/meta/0003_snapshot.json
index a781b2e9..333cf799 100644
--- a/src/lib/server/migrations/meta/0002_snapshot.json
+++ b/src/lib/server/migrations/meta/0003_snapshot.json
@@ -1,9 +1,106 @@
 {
-  "id": "2f3922cc-46f7-4854-8365-19ebbcb11aec",
-  "prevId": "1b23e196-397b-4589-94f8-7fab70a5fbec",
+  "id": "f7b050f7-8fe4-45c8-a445-0e133c4574d0",
+  "prevId": "2f3922cc-46f7-4854-8365-19ebbcb11aec",
   "version": "7",
   "dialect": "postgresql",
   "tables": {
+    "public.storage_download_manifests": {
+      "name": "storage_download_manifests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket": {
+          "name": "bucket",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix": {
+          "name": "prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entries": {
+          "name": "entries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive": {
+          "name": "archive",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "storage_download_manifests_user_expiry_idx": {
+          "name": "storage_download_manifests_user_expiry_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
     "public.user_storage_connections": {
       "name": "user_storage_connections",
       "schema": "",
diff --git a/src/lib/server/migrations/meta/_journal.json b/src/lib/server/migrations/meta/_journal.json
index 8ed6ef7f..91e003ce 100644
--- a/src/lib/server/migrations/meta/_journal.json
+++ b/src/lib/server/migrations/meta/_journal.json
@@ -5,22 +5,15 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1781095861625,
-      "tag": "0000_calm_jimmy_woo",
+      "when": 1787036968123,
+      "tag": "0000_friendly_vulcan",
       "breakpoints": true
     },
     {
-      "idx": 1,
+      "idx": 3,
       "version": "7",
-      "when": 1782383259361,
-      "tag": "0001_keen_prodigy",
-      "breakpoints": true
-    },
-    {
-      "idx": 2,
-      "version": "7",
-      "when": 1782383681028,
-      "tag": "0002_dashing_nuke",
+      "when": 1787222898649,
+      "tag": "0003_short_malcolm_colcord",
       "breakpoints": true
     }
   ]
diff --git a/src/lib/server/schema.ts b/src/lib/server/schema.ts
index b27777d5..229bc27d 100644
--- a/src/lib/server/schema.ts
+++ b/src/lib/server/schema.ts
@@ -1,4 +1,14 @@
-import { pgTable, text, timestamp, uuid, jsonb, index, unique } from 'drizzle-orm/pg-core';
+import {
+  pgTable,
+  text,
+  timestamp,
+  uuid,
+  jsonb,
+  index,
+  unique,
+  boolean,
+  integer
+} from 'drizzle-orm/pg-core';
 
 /**
  * User storage connections table.
@@ -25,3 +35,59 @@ export const userStorageConnections = pgTable(
     unique('user_storage_connections_user_id_name_unique').on(table.userId, table.name)
   ]
 );
+
+/**
+ * Recent storage searches per user and connection. Buckets are sorted before
+ * persistence so their order does not affect the unique search identity.
+ */
+export const userRecentSearches = pgTable(
+  'user_recent_searches',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: text('user_id').notNull(),
+    connectionId: uuid('connection_id')
+      .notNull()
+      .references(() => userStorageConnections.id, { onDelete: 'cascade' }),
+    buckets: jsonb('buckets').$type<string[]>().notNull().default([]),
+    query: text('query').notNull(),
+    useRegex: boolean('use_regex').notNull().default(false),
+    excludePatterns: text('exclude_patterns').array().notNull().default([]),
+    searchPath: text('search_path').notNull().default(''),
+    maxDepth: integer('max_depth'),
+    updatedAt: timestamp('updated_at', { mode: 'date' }).defaultNow().notNull()
+  },
+  (table) => [
+    unique('user_recent_searches_connection_query').on(
+      table.userId,
+      table.connectionId,
+      table.query,
+      table.useRegex,
+      table.excludePatterns,
+      table.searchPath,
+      table.maxDepth,
+      table.buckets
+    ),
+    index('user_recent_searches_connection_idx').on(table.userId, table.connectionId)
+  ]
+);
+
+/**
+ * Immutable user download-history metadata. Connection credentials remain solely
+ * in user_storage_connections.
+ */
+export const storageDownloadManifests = pgTable(
+  'storage_download_manifests',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: text('user_id').notNull(),
+    connectionId: uuid('connection_id').notNull(),
+    bucket: text('bucket').notNull(),
+    prefix: text('prefix').notNull(),
+    entries: jsonb('entries').notNull(),
+    format: text('format').notNull(),
+    archive: text('archive'),
+    createdAt: timestamp('created_at', { mode: 'date' }).defaultNow().notNull(),
+    expiresAt: timestamp('expires_at', { mode: 'date' }).notNull()
+  },
+  (table) => [index('storage_download_manifests_user_expiry_idx').on(table.userId, table.expiresAt)]
+);
diff --git a/src/lib/server/storage/connections-db.test.ts b/src/lib/server/storage/connections-db.test.ts
new file mode 100644
index 00000000..726138c0
--- /dev/null
+++ b/src/lib/server/storage/connections-db.test.ts
@@ -0,0 +1,33 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  deleteWhere: vi.fn(),
+  transaction: vi.fn()
+}));
+
+vi.mock('$lib/server/db.js', () => ({
+  db: {
+    transaction: mocks.transaction
+  }
+}));
+
+import { deleteConnection } from './connections-db.js';
+
+describe('deleteConnection', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.deleteWhere.mockResolvedValue(undefined);
+    mocks.transaction.mockImplementation(async (callback) =>
+      callback({ delete: () => ({ where: mocks.deleteWhere }) })
+    );
+  });
+
+  it('atomically deletes only the owned connection history before the connection', async () => {
+    await deleteConnection('user-1', '00000000-0000-4000-8000-000000000001');
+
+    expect(mocks.transaction).toHaveBeenCalledTimes(1);
+    expect(mocks.deleteWhere).toHaveBeenCalledTimes(2);
+    expect(mocks.deleteWhere.mock.calls[0]?.[0]).toBeDefined();
+    expect(mocks.deleteWhere.mock.calls[1]?.[0]).toBeDefined();
+  });
+});
diff --git a/src/lib/server/storage/connections-db.ts b/src/lib/server/storage/connections-db.ts
index 80b0b8a4..9b511af0 100644
--- a/src/lib/server/storage/connections-db.ts
+++ b/src/lib/server/storage/connections-db.ts
@@ -1,6 +1,6 @@
 import { eq, and } from 'drizzle-orm';
 import { db } from '$lib/server/db.js';
-import { userStorageConnections } from '$lib/server/schema.js';
+import { storageDownloadManifests, userStorageConnections } from '$lib/server/schema.js';
 import { encrypt, decrypt, fingerprint } from './encryption.js';
 import { storageEncryptionKey } from './encryption-key.js';
 import { logger } from '$lib/server/logging';
@@ -127,10 +127,20 @@ export async function getConnectionForUser(
  * Delete a storage connection belonging to a user.
  */
 export async function deleteConnection(userId: string, connectionId: string): Promise<void> {
-  await db
-    .delete(userStorageConnections)
-    .where(
-      and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
-    );
+  await db.transaction(async (tx) => {
+    await tx
+      .delete(storageDownloadManifests)
+      .where(
+        and(
+          eq(storageDownloadManifests.connectionId, connectionId),
+          eq(storageDownloadManifests.userId, userId)
+        )
+      );
+    await tx
+      .delete(userStorageConnections)
+      .where(
+        and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+      );
+  });
   log.info({ connection_id: connectionId }, 'storage connection deleted');
 }
diff --git a/src/lib/server/storage/download-manifests.test.ts b/src/lib/server/storage/download-manifests.test.ts
new file mode 100644
index 00000000..63bd3d61
--- /dev/null
+++ b/src/lib/server/storage/download-manifests.test.ts
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+  insertValues: vi.fn(),
+  deleteWhere: vi.fn(),
+  selectWhere: vi.fn(),
+  getProvider: vi.fn(),
+  getConnectionForUser: vi.fn(),
+  listAllKeys: vi.fn(),
+  getMetadata: vi.fn(),
+  getObject: vi.fn(),
+  orderBy: vi.fn()
+}));
+
+vi.mock('$lib/server/db.js', () => ({
+  db: {
+    insert: () => ({ values: mocks.insertValues }),
+    delete: () => ({ where: mocks.deleteWhere }),
+    select: () => ({ from: () => ({ where: mocks.selectWhere }) })
+  }
+}));
+vi.mock('./utils.js', () => ({ getProvider: mocks.getProvider }));
+vi.mock('./connections-db.js', () => ({ getConnectionForUser: mocks.getConnectionForUser }));
+
+import {
+  createDownloadManifest,
+  openDownloadManifestPart,
+  recreateDownloadManifest
+} from './download-manifests.js';
+
+const config = {
+  type: 's3' as const,
+  host: 's3.example.test',
+  accessStyle: 'Path' as const,
+  region: { name: 'eu-central-1' }
+};
+
+function queryResult(rows: unknown[]) {
+  return { limit: async () => rows };
+}
+
+describe('download manifests', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.listAllKeys.mockResolvedValue(['folder/a.txt', 'folder/b.txt']);
+    mocks.getMetadata.mockResolvedValue({ size: 5 });
+    mocks.getObject.mockResolvedValue({
+      stream: new ReadableStream({ start: (controller) => controller.close() })
+    });
+    mocks.getProvider.mockReturnValue({
+      listAllKeys: mocks.listAllKeys,
+      getMetadata: mocks.getMetadata,
+      getObject: mocks.getObject
+    });
+    mocks.insertValues.mockReturnValue({ returning: async () => [{ id: 'manifest-1' }] });
+    mocks.deleteWhere.mockResolvedValue(undefined);
+  });
+
+  it('expands folders and persists only resolved metadata, not credentials', async () => {
+    const manifest = await createDownloadManifest({
+      userId: 'user-1',
+      connectionId: '00000000-0000-4000-8000-000000000001',
+      bucket: 'bucket',
+      prefix: 'folder/',
+      keys: ['folder/'],
+      config: { ...config, credentials: { accessKey: 'secret-access', secretKey: 'secret-key' } }
+    });
+
+    expect(manifest.files).toHaveLength(1);
+    expect(manifest.files[0]?.filename).toBe('folder.zip');
+    // The reported size includes all ZIP headers and records, so browsers can
+    // report progress against the actual final download size.
+    expect(manifest.files[0]?.size).toBeGreaterThan(10);
+    const persisted = mocks.insertValues.mock.calls[0]?.[0] as Record<string, unknown>;
+    expect(persisted).toMatchObject({
+      userId: 'user-1',
+      bucket: 'bucket',
+      prefix: 'folder/',
+      connectionId: '00000000-0000-4000-8000-000000000001',
+      format: 'zip'
+    });
+    expect(persisted).not.toHaveProperty('archiveSize');
+    expect(JSON.stringify(persisted)).not.toContain('archive_size');
+    expect(JSON.stringify(persisted)).not.toContain('secret-access');
+    expect(JSON.stringify(persisted)).not.toContain('secret-key');
+    expect(mocks.deleteWhere).toHaveBeenCalledTimes(1);
+  });
+
+  it('uses individual files for up to three file keys', async () => {
+    const manifest = await createDownloadManifest({
+      userId: 'user-1',
+      connectionId: '00000000-0000-4000-8000-000000000001',
+      bucket: 'bucket',
+      prefix: '',
+      keys: ['a.txt', 'b.txt', 'c.txt'],
+      config
+    });
+    expect(manifest.files.map((file) => file.filename)).toEqual(['a.txt', 'b.txt', 'c.txt']);
+  });
+
+  it('does not open an expired, foreign, or deleted-connection manifest', async () => {
+    mocks.selectWhere.mockReturnValue(queryResult([]));
+    await expect(openDownloadManifestPart('user-1', 'manifest-1', 1)).resolves.toBeNull();
+
+    mocks.selectWhere.mockReturnValue(
+      queryResult([
+        {
+          id: 'manifest-1',
+          bucket: 'bucket',
+          connectionId: '00000000-0000-4000-8000-000000000001',
+          entries: [{ key: 'a.txt', size: 5, isDirectory: false }],
+          archive: null,
+          expiresAt: new Date(Date.now() + 60_000)
+        }
+      ])
+    );
+    mocks.getConnectionForUser.mockResolvedValue(null);
+    await expect(openDownloadManifestPart('user-1', 'manifest-1', 1)).resolves.toBeNull();
+    expect(mocks.deleteWhere).toHaveBeenCalledWith(expect.anything());
+  });
+
+  it('validates and recreates selections with refreshed object sizes', async () => {
+    mocks.selectWhere.mockReturnValue(
+      queryResult([
+        {
+          id: 'manifest-1',
+          bucket: 'bucket',
+          connectionId: '00000000-0000-4000-8000-000000000001',
+          entries: [
+            { key: 'a.txt', size: 5, isDirectory: false },
+            { key: 'folder/', size: 0, isDirectory: true },
+            { key: 'folder/b.txt', size: 7, isDirectory: false },
+            { key: 'folder/c.txt', size: 8, isDirectory: false }
+          ],
+          archive: 'original.zip',
+          expiresAt: new Date(Date.now() + 60_000),
+          createdAt: new Date()
+        }
+      ])
+    );
+    mocks.getConnectionForUser.mockResolvedValue(config);
+    mocks.getMetadata.mockImplementation(async (key: string) => ({
+      size: key === 'a.txt' ? 40 : 9
+    }));
+    await expect(
+      recreateDownloadManifest('user-1', 'manifest-1', ['a.txt'])
+    ).resolves.toMatchObject({ files: [{ filename: 'a.txt', size: 40 }] });
+    const persisted = mocks.insertValues.mock.calls[0]?.[0] as { entries: Array<{ size: number }> };
+    expect(persisted.entries).toEqual([{ key: 'a.txt', size: 40, isDirectory: false }]);
+    await expect(
+      recreateDownloadManifest('user-1', 'manifest-1', ['other.txt'])
+    ).resolves.toBeNull();
+    await expect(
+      recreateDownloadManifest('user-1', 'manifest-1', ['a.txt', 'a.txt'])
+    ).resolves.toBeNull();
+    await expect(recreateDownloadManifest('user-1', 'manifest-1', [])).resolves.toBeNull();
+  });
+});
diff --git a/src/lib/server/storage/download-manifests.ts b/src/lib/server/storage/download-manifests.ts
new file mode 100644
index 00000000..0e2726b6
--- /dev/null
+++ b/src/lib/server/storage/download-manifests.ts
@@ -0,0 +1,330 @@
+import { and, desc, eq, gt, lte } from 'drizzle-orm';
+import { error, isHttpError } from '@sveltejs/kit';
+import { db } from '$lib/server/db.js';
+import { downloadHistoryRetentionMs } from '$lib/server/feature-flags.js';
+import { logger } from '$lib/server/logging';
+import { storageDownloadManifests } from '$lib/server/schema.js';
+import { getConnectionForUser } from './connections-db.js';
+import type { StorageProvider } from './provider.js';
+import type { S3ConnectionConfig } from './types.js';
+import { getProvider } from './utils.js';
+import { wrapProvider } from './wrap-provider.js';
+import { createZipStream, type ZipEntry, zipStreamSize } from './zip-stream.js';
+
+const log = logger.child({ module: 'storage-download-manifests' });
+
+export type DownloadEntry = ZipEntry;
+
+export interface DownloadFile {
+  filename: string;
+  size: number;
+  part: number;
+}
+
+export interface DownloadManifest {
+  id: string;
+  files: DownloadFile[];
+  expiresAt: Date;
+}
+
+export interface DownloadHistoryEntry {
+  id: string;
+  bucket: string;
+  connectionId: string;
+  prefix: string;
+  entries: DownloadEntry[];
+  archive: boolean;
+  archiveFilename: string | null;
+  expiresAt: Date;
+  createdAt: Date;
+}
+
+function fileName(key: string): string {
+  return key.split('/').filter(Boolean).pop() ?? key;
+}
+
+function archiveBaseName(bucket: string, prefix: string | undefined, keys: string[]): string {
+  if (keys.length === 1 && keys[0].endsWith('/')) {
+    return fileName(keys[0]).replace(/\/$/, '') || bucket;
+  }
+  return fileName(prefix ?? '').replace(/\/$/, '') || bucket;
+}
+
+export function archiveFileName(base: string): string {
+  return `${base}.zip`;
+}
+
+async function removeExpiredManifests(): Promise<void> {
+  await db
+    .delete(storageDownloadManifests)
+    .where(lte(storageDownloadManifests.expiresAt, new Date()));
+}
+
+function shouldArchive(keys: string[]): boolean {
+  return keys.length > 3 || keys.some((key) => key.endsWith('/'));
+}
+
+async function expandKeys(provider: StorageProvider, keys: string[]): Promise<DownloadEntry[]> {
+  const expanded = await Promise.all(
+    keys.map(async (key) =>
+      key.endsWith('/') ? [key, ...(await provider.listAllKeys(key))] : [key]
+    )
+  );
+  return Promise.all(
+    [...new Set(expanded.flat())].map(async (key) => {
+      if (key.endsWith('/')) return { key, size: 0, isDirectory: true };
+      const metadata = await provider.getMetadata(key);
+      return { key, size: metadata.size, isDirectory: false };
+    })
+  );
+}
+
+/**
+ * Build the manifest file list. For archives the reported size is the
+ * exact output size is derived from the immutable manifest metadata.
+ */
+function filesFor(entries: DownloadEntry[], archive: boolean, archiveName: string): DownloadFile[] {
+  return archive
+    ? [
+        {
+          filename: archiveName,
+          size: zipStreamSize(entries),
+          part: 1
+        }
+      ]
+    : entries.map((entry, index) => ({
+        filename: fileName(entry.key),
+        size: entry.size,
+        part: index + 1
+      }));
+}
+
+async function persistManifest(input: {
+  userId: string;
+  connectionId: string;
+  bucket: string;
+  prefix: string;
+  entries: DownloadEntry[];
+  archive: boolean;
+  archiveName: string;
+}): Promise<DownloadManifest> {
+  const expiresAt = new Date(Date.now() + downloadHistoryRetentionMs);
+  const [manifest] = await db
+    .insert(storageDownloadManifests)
+    .values({
+      userId: input.userId,
+      connectionId: input.connectionId,
+      bucket: input.bucket,
+      prefix: input.prefix,
+      entries: input.entries,
+      format: 'zip',
+      archive: input.archive ? input.archiveName : null,
+      expiresAt
+    })
+    .returning({ id: storageDownloadManifests.id });
+  return {
+    id: manifest.id,
+    files: filesFor(input.entries, input.archive, input.archiveName),
+    expiresAt
+  };
+}
+
+/** Resolve all metadata before inserting one immutable manifest row. */
+export async function createDownloadManifest(input: {
+  userId: string;
+  connectionId: string;
+  bucket: string;
+  prefix: string;
+  keys: string[];
+  config: S3ConnectionConfig;
+}): Promise<DownloadManifest> {
+  await removeExpiredManifests();
+  const archive = shouldArchive(input.keys);
+  const provider = wrapProvider(getProvider(input.config, input.bucket));
+  const entries = archive
+    ? await expandKeys(provider, input.keys)
+    : await Promise.all(
+        input.keys.map(async (key) => {
+          const metadata = await provider.getMetadata(key);
+          return { key, size: metadata.size, isDirectory: false };
+        })
+      );
+  const archiveName = archiveFileName(archiveBaseName(input.bucket, input.prefix, input.keys));
+  const manifest = await persistManifest({ ...input, entries, archive, archiveName });
+  log.info(
+    { manifest_id: manifest.id, bucket: input.bucket, file_count: manifest.files.length },
+    'download manifest created'
+  );
+  return manifest;
+}
+
+async function loadOwnedManifest(userId: string, id: string): Promise<DownloadHistoryEntry | null> {
+  const [row] = await db
+    .select()
+    .from(storageDownloadManifests)
+    .where(
+      and(
+        eq(storageDownloadManifests.id, id),
+        eq(storageDownloadManifests.userId, userId),
+        gt(storageDownloadManifests.expiresAt, new Date())
+      )
+    )
+    .limit(1);
+  if (!row) return null;
+  const entries = row.entries as DownloadEntry[];
+  return {
+    id: row.id,
+    bucket: row.bucket,
+    connectionId: row.connectionId,
+    prefix: row.prefix,
+    entries,
+    archive: row.archive !== null,
+    archiveFilename: row.archive,
+    expiresAt: row.expiresAt,
+    createdAt: row.createdAt
+  };
+}
+
+/** Create a fresh history entry from a checked subset of an existing entry. */
+export async function recreateDownloadManifest(
+  userId: string,
+  id: string,
+  selectedKeys: string[]
+): Promise<DownloadManifest | null> {
+  if (selectedKeys.length === 0 || new Set(selectedKeys).size !== selectedKeys.length) return null;
+  const original = await loadOwnedManifest(userId, id);
+  if (!original) return null;
+  const config = await getConnectionForUser(userId, original.connectionId);
+  if (!config) {
+    await db.delete(storageDownloadManifests).where(eq(storageDownloadManifests.id, id));
+    return null;
+  }
+
+  const byKey = new Map(original.entries.map((entry) => [entry.key, entry]));
+  if (selectedKeys.some((key) => !byKey.has(key))) return null;
+  const selected = selectedKeys.map((key) => byKey.get(key)!);
+  const expanded = [
+    ...new Map(
+      selected
+        .flatMap((entry) =>
+          entry.isDirectory
+            ? original.entries.filter(
+                (candidate) => candidate.key === entry.key || candidate.key.startsWith(entry.key)
+              )
+            : [entry]
+        )
+        .map((entry) => [entry.key, entry])
+    ).values()
+  ];
+  const provider = wrapProvider(getProvider(config, original.bucket));
+  const entries = await Promise.all(
+    expanded.map(async (entry) => {
+      if (entry.isDirectory) return { ...entry, size: 0 };
+      try {
+        const metadata = await provider.getMetadata(entry.key);
+        return { ...entry, size: metadata.size };
+      } catch (err) {
+        if (isHttpError(err) && err.status === 404) throw error(404, entry.key);
+        throw err;
+      }
+    })
+  );
+  const nonDirectoryEntries = entries.filter((entry) => !entry.isDirectory);
+  const archive = nonDirectoryEntries.length !== 1;
+  return persistManifest({
+    userId,
+    connectionId: original.connectionId,
+    bucket: original.bucket,
+    prefix: original.prefix,
+    entries: archive ? entries : nonDirectoryEntries,
+    archive,
+    archiveName: archiveFileName(archiveBaseName(original.bucket, original.prefix, selectedKeys))
+  });
+}
+
+/** List current connection-scoped history and remove records whose connection was deleted. */
+export async function listDownloadHistory(
+  userId: string,
+  connectionId?: string
+): Promise<DownloadHistoryEntry[]> {
+  await removeExpiredManifests();
+  const conditions = [
+    eq(storageDownloadManifests.userId, userId),
+    gt(storageDownloadManifests.expiresAt, new Date())
+  ];
+  if (connectionId) conditions.push(eq(storageDownloadManifests.connectionId, connectionId));
+  const rows = await db
+    .select()
+    .from(storageDownloadManifests)
+    .where(and(...conditions))
+    .orderBy(desc(storageDownloadManifests.createdAt));
+  const history: DownloadHistoryEntry[] = [];
+  for (const row of rows) {
+    if (!(await getConnectionForUser(userId, row.connectionId))) {
+      await db.delete(storageDownloadManifests).where(eq(storageDownloadManifests.id, row.id));
+      continue;
+    }
+    history.push({
+      id: row.id,
+      bucket: row.bucket,
+      connectionId: row.connectionId,
+      prefix: row.prefix,
+      entries: row.entries as DownloadEntry[],
+      archive: row.archive !== null,
+      archiveFilename: row.archive,
+      expiresAt: row.expiresAt,
+      createdAt: row.createdAt
+    });
+  }
+  return history;
+}
+
+/** Remove every retained download manifest for one user. */
+export async function clearDownloadHistory(userId: string): Promise<void> {
+  await db.delete(storageDownloadManifests).where(eq(storageDownloadManifests.userId, userId));
+}
+
+/** Load an owned, unexpired manifest and resolve its current encrypted connection. */
+export async function openDownloadManifestPart(
+  userId: string,
+  id: string,
+  part: number
+): Promise<{ stream: ReadableStream; file: DownloadFile } | null> {
+  const manifest = await loadOwnedManifest(userId, id);
+  if (!manifest) return null;
+  const config = await getConnectionForUser(userId, manifest.connectionId);
+  if (!config) {
+    log.warn(
+      { manifest_id: id, connection_id: manifest.connectionId },
+      'download connection unavailable'
+    );
+    await db.delete(storageDownloadManifests).where(eq(storageDownloadManifests.id, id));
+    return null;
+  }
+  const provider = wrapProvider(getProvider(config, manifest.bucket));
+  if (manifest.archive) {
+    if (part !== 1 || !manifest.archiveFilename) return null;
+    return {
+      stream: createZipStream(provider, manifest.entries),
+      file: { filename: manifest.archiveFilename, size: zipStreamSize(manifest.entries), part: 1 }
+    };
+  }
+  const entry = manifest.entries[part - 1];
+  if (!entry || entry.isDirectory) return null;
+  return {
+    stream: new ReadableStream({
+      async start(controller) {
+        try {
+          const download = await provider.getObject(entry.key);
+          await download.stream.pipeTo(
+            new WritableStream({ write: (chunk) => controller.enqueue(chunk) })
+          );
+          controller.close();
+        } catch (err) {
+          controller.error(err);
+        }
+      }
+    }),
+    file: { filename: fileName(entry.key), size: entry.size, part }
+  };
+}
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index c3b1d5ba..8a0d7bf5 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -1,4 +1,10 @@
-import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
+import type {
+  StorageProvider,
+  ObjectDownload,
+  DeleteObjectsResult,
+  SearchOptions,
+  SearchResult
+} from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
@@ -58,11 +64,16 @@ export class HDFSStorageProvider implements StorageProvider {
 
   listAllKeysProgressively(
     _prefix: string,
-    _onBatch: (keys: Array<{ key: string; size: number }>) => void
+    _onBatch: (keys: Array<{ key: string; size: number }>) => void,
+    _options?: import('./provider.js').ProgressiveListOptions
   ): Promise<void> {
     throw new Error('HDFS not implemented');
   }
 
+  search(_query: string, _options?: SearchOptions): Promise<SearchResult> {
+    throw new Error('HDFS not implemented');
+  }
+
   getBucketVersioning(): Promise<string> {
     throw new Error('HDFS not implemented');
   }
diff --git a/src/lib/server/storage/job-store.ts b/src/lib/server/storage/job-store.ts
index f865d24a..962f7104 100644
--- a/src/lib/server/storage/job-store.ts
+++ b/src/lib/server/storage/job-store.ts
@@ -9,11 +9,12 @@ export interface JobProgress {
 }
 
 interface JobEntry<T> {
-  status: 'running' | 'done' | 'error';
+  status: 'running' | 'done' | 'error' | 'cancelled';
   result: T | null;
   error?: string;
   createdAt: number;
   progress: JobProgress;
+  cancel?: () => Promise<void> | void;
 }
 
 const store = new Map<string, JobEntry<unknown>>();
@@ -52,6 +53,22 @@ export function createJob(id: string): void {
   });
 }
 
+/** Attach a response stream's cancellation callback to a running job. */
+export function setJobCancellation(id: string, cancel: () => Promise<void> | void): void {
+  const entry = store.get(id);
+  if (entry?.status === 'running') entry.cancel = cancel;
+}
+
+/** Cancel a job and its active response stream. */
+export async function cancelJob(id: string): Promise<boolean> {
+  const entry = store.get(id);
+  if (!entry || entry.status !== 'running') return false;
+  entry.status = 'cancelled';
+  await entry.cancel?.();
+  log.trace({ job_id: id }, 'job cancelled');
+  return true;
+}
+
 /**
  * Update the progress of a running job.
  */
@@ -71,7 +88,7 @@ export function updateJobProgress(id: string, progress: Partial<JobProgress>): v
  */
 export function completeJob<T>(id: string, result: T): void {
   const entry = store.get(id);
-  if (!entry) return;
+  if (!entry || entry.status !== 'running') return;
   entry.status = 'done' as const;
   (entry as JobEntry<T>).result = result;
   log.trace({ job_id: id }, 'job completed');
@@ -82,12 +99,20 @@ export function completeJob<T>(id: string, result: T): void {
  */
 export function failJob(id: string, error: string): void {
   const entry = store.get(id);
-  if (!entry) return;
+  if (!entry || entry.status !== 'running') return;
   entry.status = 'error' as const;
   entry.error = error;
   log.trace({ job_id: id, error }, 'job failed');
 }
 
+/** Mark a job cancelled when the browser abandons its native download. */
+export function cancelJobFromStream(id: string): void {
+  const entry = store.get(id);
+  if (!entry || entry.status !== 'running') return;
+  entry.status = 'cancelled';
+  log.trace({ job_id: id }, 'job cancelled by download stream');
+}
+
 /**
  * Get the current state of a job. Returns null if not found (expired or never existed).
  */
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
index 0db3f3a8..42579e74 100644
--- a/src/lib/server/storage/preview/parquet.test.ts
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -63,6 +63,7 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
     listAllKeysProgressively: vi.fn(),
+    search: vi.fn(),
     getBucketVersioning: vi.fn(),
     getBucketLifecycleRules: vi.fn(),
     getBucketTags: vi.fn(),
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
index f148ffbb..2cae99a0 100644
--- a/src/lib/server/storage/preview/stream.test.ts
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -19,6 +19,7 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
     listAllKeysProgressively: vi.fn(),
+    search: vi.fn(),
     getBucketVersioning: vi.fn(),
     getBucketLifecycleRules: vi.fn(),
     getBucketTags: vi.fn(),
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 27ef36c7..316f438c 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -1,8 +1,38 @@
-import type { StoragePage, StorageMetadata, DeleteObjectsResult } from '$lib/storage/types.js';
+import type {
+  StoragePage,
+  StorageMetadata,
+  DeleteObjectsResult,
+  SearchResultItem
+} from '$lib/storage/types.js';
 import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
 
 export type { DeleteObjectsResult };
 
+/** Options accepted by {@link StorageProvider.search}. */
+export interface SearchOptions {
+  /** Limit the S3 listing to this key prefix. */
+  prefix?: string;
+  /** Maximum key depth relative to `prefix`. */
+  maxDepth?: number;
+  /** Abort the in-flight search; throws `AbortError` when signalled. */
+  signal?: AbortSignal;
+  /** Decide whether a scanned key matches the search. */
+  matches?: (item: SearchResultItem) => boolean;
+  /** Called immediately after each accepted result. */
+  onMatch?: (item: SearchResultItem) => void;
+}
+
+/** Options for progressive key listing. */
+export interface ProgressiveListOptions {
+  /** Abort the currently pending provider page request. */
+  signal?: AbortSignal;
+}
+
+/** Result of a bucket-scoped search. */
+export interface SearchResult {
+  results: SearchResultItem[];
+}
+
 /** Metadata and body stream returned when fetching a storage object. */
 export interface ObjectDownload {
   stream: ReadableStream;
@@ -48,8 +78,14 @@ export interface StorageProvider {
   listAllKeys(prefix: string): Promise<string[]>;
   listAllKeysProgressively(
     prefix: string,
-    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void
+    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void | boolean,
+    options?: ProgressiveListOptions
   ): Promise<void>;
+  /**
+   * Case-insensitive substring search across all keys in this bucket. Both
+   * files (plain keys) and directories (keys ending in `/`) match.
+   */
+  search(query: string, options?: SearchOptions): Promise<SearchResult>;
   getBucketVersioning(): Promise<string>;
   getBucketLifecycleRules(): Promise<LifecycleRule[]>;
   getBucketTags(): Promise<Record<string, string>>;
diff --git a/src/lib/server/storage/recent-searches-db.spec.ts b/src/lib/server/storage/recent-searches-db.spec.ts
new file mode 100644
index 00000000..8501aa05
--- /dev/null
+++ b/src/lib/server/storage/recent-searches-db.spec.ts
@@ -0,0 +1,239 @@
+import { describe, it, expect, vi, beforeEach, type Mock } from 'vitest';
+import { sql, type SQL } from 'drizzle-orm';
+import { CasingCache } from 'drizzle-orm/casing';
+import { userRecentSearches } from '$lib/server/schema.js';
+import {
+  listRecentSearches,
+  recordRecentSearch,
+  clearRecentSearches,
+  RECENT_SEARCHES_CAP
+} from './recent-searches-db.js';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ trace: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
+}));
+
+const { mockDb } = vi.hoisted(() => ({
+  mockDb: {
+    select: vi.fn(),
+    insert: vi.fn(),
+    delete: vi.fn()
+  }
+}));
+
+vi.mock('$lib/server/db.js', () => ({ db: mockDb }));
+
+type ChainFn = (...args: unknown[]) => MockChain;
+
+/** Mocked Drizzle query builder: every terminal call returns the same chain,
+ *  which is thenable (resolving to `result`) and acts as a SQLWrapper when
+ *  used as a subquery — its `.limit()` value is rendered into `getSQL()`. */
+interface MockChain {
+  from: Mock<ChainFn>;
+  where: Mock<ChainFn>;
+  orderBy: Mock<ChainFn>;
+  limit: Mock<ChainFn>;
+  values: Mock<ChainFn>;
+  onConflictDoUpdate: Mock<ChainFn>;
+  returning: Mock<ChainFn>;
+  then: (resolve: (value: unknown) => unknown) => Promise<unknown>;
+  getSQL: () => SQL;
+}
+
+function buildChain(result: unknown, subquerySQL: string): MockChain {
+  let limitValue: number | undefined;
+  const chain: MockChain = {
+    from: vi.fn<ChainFn>(() => chain),
+    where: vi.fn<ChainFn>(() => chain),
+    orderBy: vi.fn<ChainFn>(() => chain),
+    limit: vi.fn<ChainFn>((...args: unknown[]) => {
+      limitValue = args[0] as number;
+      return chain;
+    }),
+    values: vi.fn<ChainFn>(() => chain),
+    onConflictDoUpdate: vi.fn<ChainFn>(() => chain),
+    returning: vi.fn<ChainFn>(() => chain),
+    then: (resolve: (value: unknown) => unknown) => Promise.resolve(result).then(resolve),
+    getSQL: () =>
+      sql`${sql.raw(`${subquerySQL}${limitValue !== undefined ? ` limit ${limitValue}` : ''}`)}`
+  };
+  return chain;
+}
+
+/** Serialise a Drizzle SQL wrapper the way the Postgres dialect would. */
+function toQuery(condition: unknown) {
+  const config = {
+    escapeName: (n: string) => `"${n}"`,
+    escapeParam: (index: number) => `$${index + 1}`,
+    casing: new CasingCache('camelCase'),
+    paramStartIndex: { value: 0 },
+    inlineParams: false
+  };
+  return (
+    condition as { toQuery: (config: unknown) => { sql: string; params: unknown[] } }
+  ).toQuery(config);
+}
+
+const USER_ID = 'user-1';
+const CONNECTION_ID = '00000000-0000-0000-0000-000000000001';
+
+describe('recent-searches-db', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  describe('listRecentSearches', () => {
+    it('selects buckets+query+options for the user+connection, newest first', async () => {
+      const rows = [
+        { buckets: ['b1', 'b2'], query: 'q2' },
+        { buckets: ['b1'], query: 'q1' }
+      ];
+      mockDb.select.mockReturnValue(buildChain(rows, 'select id from user_recent_searches'));
+
+      const result = await listRecentSearches(USER_ID, CONNECTION_ID);
+
+      expect(mockDb.select).toHaveBeenCalledWith({
+        buckets: userRecentSearches.buckets,
+        query: userRecentSearches.query,
+        useRegex: userRecentSearches.useRegex,
+        excludePatterns: userRecentSearches.excludePatterns,
+        searchPath: userRecentSearches.searchPath,
+        maxDepth: userRecentSearches.maxDepth
+      });
+
+      const selectChain = mockDb.select.mock.results[0].value;
+      expect(selectChain.from).toHaveBeenCalledWith(userRecentSearches);
+
+      const whereSql = toQuery(selectChain.where.mock.calls[0][0]);
+      expect(whereSql.sql).toContain('"user_recent_searches"."user_id" = $1');
+      expect(whereSql.sql).toContain('"user_recent_searches"."connection_id" = $2');
+      expect(whereSql.params).toEqual([USER_ID, CONNECTION_ID]);
+
+      expect(selectChain.orderBy).toHaveBeenCalledTimes(1);
+      expect(toQuery(selectChain.orderBy.mock.calls[0][0]).sql).toBe(
+        '"user_recent_searches"."updated_at" desc'
+      );
+
+      expect(result).toEqual(rows);
+    });
+  });
+
+  describe('recordRecentSearch', () => {
+    it('upserts on the unique key, bumping updated_at, then prunes to the cap', async () => {
+      const insertChain = buildChain(undefined, '');
+      const subqueryChain = buildChain(undefined, 'select id from user_recent_searches');
+      const deleteChain = buildChain(undefined, '');
+
+      mockDb.insert.mockReturnValue(insertChain);
+      mockDb.select.mockReturnValue(subqueryChain);
+      mockDb.delete.mockReturnValue(deleteChain);
+
+      const options = {
+        useRegex: false,
+        excludePatterns: ['_temp'],
+        searchPath: 'events/',
+        maxDepth: 3
+      };
+      const before = Date.now();
+      await recordRecentSearch(
+        USER_ID,
+        CONNECTION_ID,
+        ['bucket-1', 'beta', 'bucket-1'],
+        'query-1',
+        options
+      );
+      const after = Date.now();
+
+      expect(mockDb.insert).toHaveBeenCalledWith(userRecentSearches);
+
+      const insertValues = insertChain.values.mock.calls[0][0] as {
+        userId: string;
+        connectionId: string;
+        buckets: string[];
+        query: string;
+        useRegex: boolean;
+        excludePatterns: string[];
+        searchPath: string;
+        maxDepth: number;
+        updatedAt: Date;
+      };
+      expect(insertValues).toMatchObject({
+        userId: USER_ID,
+        connectionId: CONNECTION_ID,
+        buckets: ['beta', 'bucket-1'],
+        query: 'query-1',
+        useRegex: false,
+        excludePatterns: ['_temp'],
+        searchPath: 'events/',
+        maxDepth: 3
+      });
+      expect(insertValues.updatedAt.getTime()).toBeGreaterThanOrEqual(before);
+      expect(insertValues.updatedAt.getTime()).toBeLessThanOrEqual(after);
+
+      const conflict = insertChain.onConflictDoUpdate.mock.calls[0][0] as {
+        target: unknown[];
+        set: { updatedAt: Date };
+      };
+      expect(conflict.target).toEqual([
+        userRecentSearches.userId,
+        userRecentSearches.connectionId,
+        userRecentSearches.query,
+        userRecentSearches.useRegex,
+        userRecentSearches.excludePatterns,
+        userRecentSearches.searchPath,
+        userRecentSearches.maxDepth,
+        userRecentSearches.buckets
+      ]);
+
+      expect(conflict.set.updatedAt.getTime()).toBeGreaterThanOrEqual(before);
+      expect(conflict.set.updatedAt.getTime()).toBeLessThanOrEqual(after);
+
+      // Prune: subquery limited to the cap, delete excludes those ids.
+      expect(subqueryChain.limit).toHaveBeenCalledWith(RECENT_SEARCHES_CAP);
+      expect(subqueryChain.orderBy).toHaveBeenCalledTimes(1);
+      expect(mockDb.delete).toHaveBeenCalledWith(userRecentSearches);
+
+      const deleteWhereSql = toQuery(deleteChain.where.mock.calls[0][0]);
+      expect(deleteWhereSql.sql).toContain('"user_recent_searches"."user_id" = $1');
+      expect(deleteWhereSql.sql).toContain('"user_recent_searches"."connection_id" = $2');
+      expect(deleteWhereSql.sql).toContain('"user_recent_searches"."id" not in');
+      expect(deleteWhereSql.sql).toContain('limit 20');
+      expect(deleteWhereSql.params).toEqual([USER_ID, CONNECTION_ID]);
+    });
+
+    it('uses a later timestamp for consecutive records in the same millisecond', async () => {
+      const insertChain = buildChain(undefined, '');
+      const subqueryChain = buildChain(undefined, 'select id from user_recent_searches');
+      const deleteChain = buildChain(undefined, '');
+      mockDb.insert.mockReturnValue(insertChain);
+      mockDb.select.mockReturnValue(subqueryChain);
+      mockDb.delete.mockReturnValue(deleteChain);
+      vi.spyOn(Date, 'now').mockReturnValue(1_000);
+
+      const options = { useRegex: true, excludePatterns: [], searchPath: '', maxDepth: null };
+      await recordRecentSearch(USER_ID, CONNECTION_ID, ['bucket-1'], 'query-1', options);
+      const firstTimestamp = (insertChain.values.mock.calls[0][0] as { updatedAt: Date }).updatedAt;
+
+      await recordRecentSearch(USER_ID, CONNECTION_ID, ['bucket-1'], 'query-2', options);
+      const secondTimestamp = (insertChain.values.mock.calls[1][0] as { updatedAt: Date })
+        .updatedAt;
+
+      expect(secondTimestamp.getTime()).toBeGreaterThan(firstTimestamp.getTime());
+    });
+  });
+
+  describe('clearRecentSearches', () => {
+    it('deletes all rows for the user+connection', async () => {
+      const deleteChain = buildChain(undefined, '');
+      mockDb.delete.mockReturnValue(deleteChain);
+
+      await clearRecentSearches(USER_ID, CONNECTION_ID);
+
+      expect(mockDb.delete).toHaveBeenCalledWith(userRecentSearches);
+      expect(mockDb.select).not.toHaveBeenCalled();
+
+      const whereSql = toQuery(deleteChain.where.mock.calls[0][0]);
+      expect(whereSql.sql).toContain('"user_recent_searches"."user_id" = $1');
+      expect(whereSql.sql).toContain('"user_recent_searches"."connection_id" = $2');
+      expect(whereSql.params).toEqual([USER_ID, CONNECTION_ID]);
+    });
+  });
+});
diff --git a/src/lib/server/storage/recent-searches-db.ts b/src/lib/server/storage/recent-searches-db.ts
new file mode 100644
index 00000000..f6f3270e
--- /dev/null
+++ b/src/lib/server/storage/recent-searches-db.ts
@@ -0,0 +1,142 @@
+import { and, eq, desc, notInArray } from 'drizzle-orm';
+import { db } from '$lib/server/db.js';
+import { userRecentSearches } from '$lib/server/schema.js';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'recent-searches-db' });
+let lastRecordedAt = 0;
+
+/** Maximum number of recent searches kept per user and connection. */
+export const RECENT_SEARCHES_CAP = 20;
+
+/** The advanced options recorded alongside a recent search. */
+export interface RecentSearchOptions {
+  useRegex: boolean;
+  excludePatterns: string[];
+  searchPath: string;
+  maxDepth: number | null;
+}
+
+/** A single stored recent search: the query and advanced options plus the
+ *  ordered list of buckets it ran against. Only `maxDepth` can be NULL
+ *  (meaning "no limit"). */
+export interface RecentSearch {
+  buckets: string[];
+  query: string;
+  useRegex: boolean;
+  excludePatterns: string[];
+  searchPath: string;
+  maxDepth: number | null;
+}
+
+/**
+ * List the most recent searches for a user and connection,
+ * newest first.
+ */
+export async function listRecentSearches(
+  userId: string,
+  connectionId: string
+): Promise<RecentSearch[]> {
+  const rows = await db
+    .select({
+      buckets: userRecentSearches.buckets,
+      query: userRecentSearches.query,
+      useRegex: userRecentSearches.useRegex,
+      excludePatterns: userRecentSearches.excludePatterns,
+      searchPath: userRecentSearches.searchPath,
+      maxDepth: userRecentSearches.maxDepth
+    })
+    .from(userRecentSearches)
+    .where(
+      and(eq(userRecentSearches.userId, userId), eq(userRecentSearches.connectionId, connectionId))
+    )
+    .orderBy(desc(userRecentSearches.updatedAt));
+
+  log.debug({ user_id: userId, connection_id: connectionId }, 'listed recent storage searches');
+  return rows;
+}
+
+/**
+ * Record a search for a user and connection. If an identical search — same
+ * buckets, query and advanced options — already exists it is bumped to the top,
+ * otherwise a new row is inserted. Afterwards the history is pruned down to
+ * RECENT_SEARCHES_CAP entries.
+ *
+ * `buckets` is stored sorted so the unique key is independent of the order in
+ * which the user selected the buckets.
+ */
+export async function recordRecentSearch(
+  userId: string,
+  connectionId: string,
+  buckets: string[],
+  query: string,
+  options: RecentSearchOptions
+): Promise<void> {
+  // JavaScript dates have millisecond precision. Keep writes strictly ordered
+  // so replaying a search always moves it ahead of an earlier same-ms record.
+  lastRecordedAt = Math.max(Date.now(), lastRecordedAt + 1);
+  const now = new Date(lastRecordedAt);
+  const sortedBuckets = [...new Set(buckets)].sort();
+
+  // Upsert on the unique (user, connection, buckets, query, options) key.
+  await db
+    .insert(userRecentSearches)
+    .values({
+      userId,
+      connectionId,
+      buckets: sortedBuckets,
+      query,
+      useRegex: options.useRegex,
+      excludePatterns: options.excludePatterns,
+      searchPath: options.searchPath,
+      maxDepth: options.maxDepth,
+      updatedAt: now
+    })
+    .onConflictDoUpdate({
+      target: [
+        userRecentSearches.userId,
+        userRecentSearches.connectionId,
+        userRecentSearches.query,
+        userRecentSearches.useRegex,
+        userRecentSearches.excludePatterns,
+        userRecentSearches.searchPath,
+        userRecentSearches.maxDepth,
+        userRecentSearches.buckets
+      ],
+      set: { updatedAt: now }
+    });
+
+  // Prune to the most recent RECENT_SEARCHES_CAP rows for this user and connection.
+  const keepIds = db
+    .select({ id: userRecentSearches.id })
+    .from(userRecentSearches)
+    .where(
+      and(eq(userRecentSearches.userId, userId), eq(userRecentSearches.connectionId, connectionId))
+    )
+    .orderBy(desc(userRecentSearches.updatedAt))
+    .limit(RECENT_SEARCHES_CAP);
+
+  await db
+    .delete(userRecentSearches)
+    .where(
+      and(
+        eq(userRecentSearches.userId, userId),
+        eq(userRecentSearches.connectionId, connectionId),
+        notInArray(userRecentSearches.id, keepIds)
+      )
+    );
+
+  log.info({ user_id: userId, connection_id: connectionId }, 'recorded recent storage search');
+}
+
+/**
+ * Remove all recent searches for a user and connection.
+ */
+export async function clearRecentSearches(userId: string, connectionId: string): Promise<void> {
+  await db
+    .delete(userRecentSearches)
+    .where(
+      and(eq(userRecentSearches.userId, userId), eq(userRecentSearches.connectionId, connectionId))
+    );
+  log.debug({ user_id: userId, connection_id: connectionId }, 'cleared recent storage searches');
+}
diff --git a/src/lib/server/storage/request-context.ts b/src/lib/server/storage/request-context.ts
index f854b4ce..6b36a9a7 100644
--- a/src/lib/server/storage/request-context.ts
+++ b/src/lib/server/storage/request-context.ts
@@ -3,6 +3,7 @@ import type { RequestEvent } from '@sveltejs/kit';
 import { getProvider } from './utils.js';
 import { wrapProvider } from './wrap-provider.js';
 import type { StorageProvider } from './provider.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
 export function requireBucket(event: RequestEvent): string {
   const bucket = event.url.searchParams.get('bucket')?.trim();
@@ -16,6 +17,13 @@ export function requireConfig(event: RequestEvent) {
   return config;
 }
 
+/** The connection id is captured for a manifest, never its decrypted config. */
+export function requireStorageConnectionId(event: RequestEvent): string {
+  const connectionId = event.request.headers.get(STORAGE_CONNECTION_ID_HEADER);
+  if (!connectionId) throw error(401, 'No storage connection configured');
+  return connectionId;
+}
+
 export function createStorageProvider(event: RequestEvent): {
   provider: StorageProvider;
   bucket: string;
diff --git a/src/lib/server/storage/s3-provider-search.test.ts b/src/lib/server/storage/s3-provider-search.test.ts
new file mode 100644
index 00000000..6e895937
--- /dev/null
+++ b/src/lib/server/storage/s3-provider-search.test.ts
@@ -0,0 +1,256 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { S3Client } from '@aws-sdk/client-s3';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ trace: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
+}));
+
+// Mock createS3Client — we inject a fake client directly so this is rarely called
+vi.mock('./s3-client.js', () => ({
+  createS3Client: vi.fn().mockReturnValue({ send: vi.fn() })
+}));
+
+import { S3StorageProvider } from './s3-provider.js';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeProvider() {
+  const send = vi.fn();
+  const client = { send } as unknown as S3Client;
+  const config = {
+    type: 's3' as const,
+    host: 'minio.example.com',
+    accessStyle: 'Path' as const,
+    region: { name: 'us-east-1' },
+    bucket: 'test-bucket'
+  };
+  const provider = new S3StorageProvider(config, client);
+  return { provider, send };
+}
+
+// ---------------------------------------------------------------------------
+// listAllKeysProgressively
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.listAllKeysProgressively', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('streams batches across pages and resolves', async () => {
+    send
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'a.txt' }, { Key: 'b.txt' }],
+        IsTruncated: true,
+        NextContinuationToken: 'token-1'
+      })
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'c.txt' }],
+        IsTruncated: false
+      });
+
+    const seen: string[] = [];
+    await provider.listAllKeysProgressively('', (batch) => {
+      seen.push(...batch.map((k) => k.key));
+    });
+
+    expect(seen).toEqual(['a.txt', 'b.txt', 'c.txt']);
+    expect(send).toHaveBeenCalledTimes(2);
+  });
+
+  it('stops paging when the batch callback returns false', async () => {
+    send
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'a.txt' }, { Key: 'b.txt' }],
+        IsTruncated: true,
+        NextContinuationToken: 'token-1'
+      })
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'c.txt' }],
+        IsTruncated: false
+      });
+
+    const seen: string[] = [];
+    await provider.listAllKeysProgressively('', (batch) => {
+      seen.push(...batch.map((k) => k.key));
+      return false;
+    });
+
+    expect(seen).toEqual(['a.txt', 'b.txt']);
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// search
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.search', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('maps an S3 access-denied error to HTTP 403', async () => {
+    send.mockRejectedValue(
+      new S3ServiceException({
+        name: 'AccessDenied',
+        $fault: 'client',
+        $metadata: { httpStatusCode: 403 },
+        message: 'Access denied'
+      })
+    );
+
+    await expect(provider.search('report')).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('matches case-insensitively anywhere in the full key path', async () => {
+    send.mockResolvedValue({
+      Contents: [
+        { Key: 'Reports/2026/Q3/final.pdf', Size: 100, LastModified: new Date('2026-01-01') },
+        { Key: 'reports/2026/Q3/final.pdf', Size: 200, LastModified: new Date('2026-01-02') },
+        { Key: 'notes/report.txt', Size: 50 },
+        { Key: 'other/archive.zip', Size: 10 }
+      ],
+      IsTruncated: false
+    });
+
+    const result = await provider.search('report');
+
+    expect(result.results.map((r) => r.key)).toEqual([
+      'Reports/2026/Q3/final.pdf',
+      'reports/2026/Q3/final.pdf',
+      'notes/report.txt'
+    ]);
+  });
+
+  it('returns files and directories, flagging keys ending in "/"', async () => {
+    send.mockResolvedValue({
+      Contents: [
+        { Key: 'data/', Size: 0, LastModified: new Date('2026-02-01') },
+        { Key: 'data/2026/', Size: 0 },
+        { Key: 'data/2026/file.csv', Size: 42, LastModified: new Date('2026-02-02') }
+      ],
+      IsTruncated: false
+    });
+
+    const result = await provider.search('data');
+
+    expect(result.results).toHaveLength(3);
+    expect(result.results[0]).toMatchObject({
+      key: 'data/',
+      isDirectory: true,
+      size: 0
+    });
+    expect(result.results[1]).toMatchObject({ key: 'data/2026/', isDirectory: true });
+    expect(result.results[2]).toMatchObject({
+      key: 'data/2026/file.csv',
+      isDirectory: false,
+      size: 42
+    });
+  });
+
+  it('falls back to epoch when lastModified is missing', async () => {
+    send.mockResolvedValue({
+      Contents: [{ Key: 'plain.txt', Size: 1 }],
+      IsTruncated: false
+    });
+
+    const result = await provider.search('plain');
+    expect(result.results[0].lastModified).toEqual(new Date(0));
+  });
+
+  it('returns every matching result', async () => {
+    send.mockResolvedValue({
+      Contents: Array.from({ length: 10 }, (_, i) => ({ Key: `match-${i}.txt`, Size: 1 })),
+      IsTruncated: false
+    });
+
+    const result = await provider.search('match');
+
+    expect(result.results).toHaveLength(10);
+  });
+
+  it('lists only the requested prefix and filters depth relative to it', async () => {
+    send.mockResolvedValue({
+      Contents: [
+        { Key: 'reports/final.pdf', Size: 1 },
+        { Key: 'reports/2026/final.pdf', Size: 1 },
+        { Key: 'reports/2026/q1/final.pdf', Size: 1 }
+      ],
+      IsTruncated: false
+    });
+
+    const result = await provider.search('final', { prefix: 'reports/', maxDepth: 2 });
+
+    expect(result.results.map((item) => item.key)).toEqual([
+      'reports/final.pdf',
+      'reports/2026/final.pdf'
+    ]);
+    expect(send.mock.calls[0][0].input.Prefix).toBe('reports/');
+  });
+
+  it('continues paging until all keys have been searched', async () => {
+    send.mockResolvedValueOnce({
+      Contents: [{ Key: 'a.txt', Size: 1 }],
+      IsTruncated: true,
+      NextContinuationToken: 'token-1'
+    });
+    send.mockResolvedValueOnce({ Contents: [{ Key: 'match.txt', Size: 1 }], IsTruncated: false });
+
+    const result = await provider.search('match');
+
+    expect(result.results).toHaveLength(1);
+    expect(send).toHaveBeenCalledTimes(2);
+  });
+
+  it('uses defaults when options are omitted', async () => {
+    send.mockResolvedValue({ Contents: [], IsTruncated: false });
+
+    const result = await provider.search('x');
+
+    expect(result).toEqual({ results: [] });
+  });
+
+  it('aborts before scanning when the signal is already aborted', async () => {
+    const controller = new AbortController();
+    controller.abort();
+
+    await expect(provider.search('x', { signal: controller.signal })).rejects.toMatchObject({
+      name: 'AbortError'
+    });
+    expect(send).not.toHaveBeenCalled();
+  });
+
+  it('aborts mid-listing when the signal fires', async () => {
+    const controller = new AbortController();
+    let callCount = 0;
+    send.mockImplementation(() => {
+      callCount++;
+      if (callCount === 1) {
+        return Promise.resolve({
+          Contents: [{ Key: 'a.txt', Size: 1 }],
+          IsTruncated: true,
+          NextContinuationToken: 'token-1'
+        });
+      }
+      controller.abort();
+      return Promise.resolve({
+        Contents: [{ Key: 'b.txt', Size: 1 }],
+        IsTruncated: false
+      });
+    });
+
+    await expect(provider.search('x', { signal: controller.signal })).rejects.toMatchObject({
+      name: 'AbortError'
+    });
+  });
+});
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 598fade9..b5bbf8c9 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -19,9 +19,21 @@ import {
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
 import { Upload } from '@aws-sdk/lib-storage';
-import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
+import type {
+  StorageProvider,
+  ObjectDownload,
+  DeleteObjectsResult,
+  SearchOptions,
+  SearchResult,
+  ProgressiveListOptions
+} from './provider.js';
 import type { S3Config } from './types.js';
-import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
+import type {
+  StoragePage,
+  StorageObject,
+  StorageMetadata,
+  SearchResultItem
+} from '$lib/storage/types.js';
 import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
 import { logger } from '$lib/server/logging';
 import { createS3Client } from './s3-client.js';
@@ -389,7 +401,8 @@ export class S3StorageProvider implements StorageProvider {
 
   async listAllKeysProgressively(
     prefix: string,
-    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void
+    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void | boolean,
+    options?: ProgressiveListOptions
   ): Promise<void> {
     log.trace({ bucket: this.bucket, prefix }, 'S3 ListObjectsV2 (progressive, concurrent)');
 
@@ -404,7 +417,8 @@ export class S3StorageProvider implements StorageProvider {
           Bucket: this.bucket,
           Prefix: prefix,
           ContinuationToken: token
-        })
+        }),
+        { abortSignal: options?.signal }
       );
 
     // Seed the first fetch
@@ -420,7 +434,8 @@ export class S3StorageProvider implements StorageProvider {
         }
       }
       if (batch.length > 0) {
-        onBatch(batch);
+        const shouldStop = onBatch(batch) === false;
+        if (shouldStop) break;
       }
 
       // If truncated, chain the next fetch so it starts while we process the
@@ -434,6 +449,69 @@ export class S3StorageProvider implements StorageProvider {
     log.trace({ bucket: this.bucket, prefix }, 'progressive listing complete');
   }
 
+  async search(query: string, options?: SearchOptions): Promise<SearchResult> {
+    const signal = options?.signal;
+    const prefix = options?.prefix ?? '';
+    const maxDepth = options?.maxDepth;
+    const matches =
+      options?.matches ??
+      ((item: SearchResultItem) => item.key.toLowerCase().includes(query.toLowerCase()));
+    const onMatch = options?.onMatch;
+
+    log.trace(
+      {
+        bucket: this.bucket,
+        query,
+        prefix,
+        max_depth: maxDepth
+      },
+      'S3 ListObjectsV2 (search)'
+    );
+
+    if (signal?.aborted) {
+      throw new DOMException('The operation was aborted', 'AbortError');
+    }
+
+    const results: SearchResultItem[] = [];
+
+    await withS3Errors(
+      () =>
+        this.listAllKeysProgressively(
+          prefix,
+          (batch) => {
+            for (const item of batch) {
+              if (signal?.aborted) {
+                throw new DOMException('The operation was aborted', 'AbortError');
+              }
+              const relativeKey = item.key.slice(prefix.length);
+              if (
+                maxDepth !== undefined &&
+                relativeKey.split('/').filter(Boolean).length > maxDepth
+              ) {
+                continue;
+              }
+              const result = {
+                key: item.key,
+                size: item.size,
+                lastModified: item.lastModified ?? new Date(0),
+                isDirectory: item.key.endsWith('/')
+              };
+              if (matches(result)) {
+                results.push(result);
+                onMatch?.(result);
+              }
+            }
+            return undefined;
+          },
+          { signal }
+        ),
+      { bucket: this.bucket, operation: 'search' }
+    );
+
+    log.info({ bucket: this.bucket, query, result_count: results.length }, 'search complete');
+    return { results };
+  }
+
   async listAllKeys(prefix: string): Promise<string[]> {
     log.trace({ bucket: this.bucket, prefix }, 'S3 ListObjectsV2 (recursive)');
     const keys: string[] = [];
diff --git a/src/lib/server/storage/zip-stream.test.ts b/src/lib/server/storage/zip-stream.test.ts
new file mode 100644
index 00000000..15551d23
--- /dev/null
+++ b/src/lib/server/storage/zip-stream.test.ts
@@ -0,0 +1,68 @@
+import AdmZip from 'adm-zip';
+import { describe, expect, it } from 'vitest';
+import { createZipStream, zipStreamSize } from './zip-stream.js';
+import type { StorageProvider } from './provider.js';
+
+function objectStream(value: string): ReadableStream {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode(value));
+      controller.close();
+    }
+  });
+}
+
+describe('createZipStream', () => {
+  it('calculates the exact length of the generated stream', async () => {
+    const entries = [{ key: 'file.txt', size: 3, isDirectory: false }];
+    const provider = {
+      getObject: async () => ({ stream: new Response('abc').body! })
+    } as unknown as StorageProvider;
+
+    const stream = createZipStream(provider, entries);
+    expect(zipStreamSize(entries)).toBe((await new Response(stream).arrayBuffer()).byteLength);
+  });
+  it('streams readable, uncompressed entries without staging object contents', async () => {
+    const objects = new Map([
+      ['reports/one.txt', 'first report'],
+      ['reports/two.txt', 'second report']
+    ]);
+    const provider = {
+      getObject: async (key: string) => ({ stream: objectStream(objects.get(key) ?? '') })
+    } as StorageProvider;
+
+    const archive = new Uint8Array(
+      await new Response(
+        createZipStream(provider, [
+          { key: 'reports/', size: 0, isDirectory: true },
+          { key: 'reports/one.txt', size: 12, isDirectory: false },
+          { key: 'reports/two.txt', size: 13, isDirectory: false }
+        ])
+      ).arrayBuffer()
+    );
+    const zip = new AdmZip(Buffer.from(archive));
+
+    expect(zip.getEntry('reports/')?.isDirectory).toBe(true);
+    expect(zip.readAsText('reports/one.txt')).toBe('first report');
+    expect(zip.readAsText('reports/two.txt')).toBe('second report');
+    expect(zip.getEntry('reports/one.txt')?.header.method).toBe(0);
+  });
+
+  it('uses ZIP64 records when the central directory has 65,535 entries', async () => {
+    const provider = {} as StorageProvider;
+    const entries = Array.from({ length: 65_535 }, (_, index) => ({
+      key: `empty-${index}/`,
+      size: 0,
+      isDirectory: true
+    }));
+    const archive = new Uint8Array(
+      await new Response(createZipStream(provider, entries)).arrayBuffer()
+    );
+    const view = new DataView(archive.buffer, archive.byteOffset, archive.byteLength);
+    const eocdOffset = archive.length - 22;
+
+    expect(view.getUint32(eocdOffset, true)).toBe(0x06054b50);
+    expect(view.getUint16(eocdOffset + 8, true)).toBe(0xffff);
+    expect(view.getUint32(eocdOffset - 20, true)).toBe(0x07064b50);
+  }, 60_000);
+});
diff --git a/src/lib/server/storage/zip-stream.ts b/src/lib/server/storage/zip-stream.ts
new file mode 100644
index 00000000..b2551ab0
--- /dev/null
+++ b/src/lib/server/storage/zip-stream.ts
@@ -0,0 +1,284 @@
+import type { StorageProvider } from './provider.js';
+
+const ZIP_VERSION = 20;
+const ZIP64_VERSION = 45;
+const DATA_DESCRIPTOR_FLAG = 0x08;
+const UTF8_FLAG = 0x0800;
+const STORE_METHOD = 0;
+const UINT16_MAX = 0xffff;
+const UINT32_MAX = 0xffffffff;
+const CRC32_TABLE = Uint32Array.from({ length: 256 }, (_value, index) => {
+  let value = index;
+  for (let bit = 0; bit < 8; bit++) {
+    value = value & 1 ? (value >>> 1) ^ 0xedb88320 : value >>> 1;
+  }
+  return value >>> 0;
+});
+
+export interface ZipEntry {
+  key: string;
+  size: number;
+  isDirectory: boolean;
+}
+
+/** Calculate the exact byte length of an uncompressed ZIP for known entries. */
+export function zipStreamSize(entries: ZipEntry[]): number {
+  let offset = 0;
+  let centralDirectorySize = 0;
+
+  for (const entry of entries) {
+    const localOffset = offset;
+    const nameLength = entryName(entry).length;
+    const zip64Size = entry.size >= UINT32_MAX;
+    offset += 30 + nameLength + (zip64Size ? 20 : 0);
+    offset += entry.size + (zip64Size ? 24 : 16);
+
+    const zip64Offset = localOffset >= UINT32_MAX;
+    const extraLength = (zip64Size ? 20 : 0) + (zip64Offset ? 12 : 0);
+    centralDirectorySize += 46 + nameLength + extraLength;
+  }
+
+  const zip64 =
+    entries.length >= UINT16_MAX || centralDirectorySize >= UINT32_MAX || offset >= UINT32_MAX;
+  return offset + centralDirectorySize + (zip64 ? 98 : 22);
+}
+
+interface CentralDirectoryEntry {
+  name: Uint8Array;
+  crc32: number;
+  size: number;
+  offset: number;
+  zip64: boolean;
+  isDirectory: boolean;
+}
+
+function bytes(value: string): Uint8Array {
+  return new TextEncoder().encode(value);
+}
+
+function concat(...chunks: Uint8Array[]): Uint8Array {
+  const result = new Uint8Array(chunks.reduce((length, chunk) => length + chunk.length, 0));
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}
+
+function uint16(value: number): Uint8Array {
+  const result = new Uint8Array(2);
+  new DataView(result.buffer).setUint16(0, value, true);
+  return result;
+}
+
+function uint32(value: number): Uint8Array {
+  const result = new Uint8Array(4);
+  new DataView(result.buffer).setUint32(0, value, true);
+  return result;
+}
+
+function uint64(value: number): Uint8Array {
+  const result = new Uint8Array(8);
+  const view = new DataView(result.buffer);
+  const bigint = BigInt(value);
+  view.setUint32(0, Number(bigint & BigInt(UINT32_MAX)), true);
+  view.setUint32(4, Number(bigint >> BigInt(32)), true);
+  return result;
+}
+
+function crc32Update(crc: number, chunk: Uint8Array): number {
+  let result = crc ^ UINT32_MAX;
+  for (const byte of chunk) {
+    result = CRC32_TABLE[(result ^ byte) & 0xff]! ^ (result >>> 8);
+  }
+  return (result ^ UINT32_MAX) >>> 0;
+}
+
+function localHeader(name: Uint8Array, zip64: boolean): Uint8Array {
+  const extra = zip64 ? concat(uint16(0x0001), uint16(16), uint64(0), uint64(0)) : new Uint8Array();
+  return concat(
+    uint32(0x04034b50),
+    uint16(zip64 ? ZIP64_VERSION : ZIP_VERSION),
+    uint16(DATA_DESCRIPTOR_FLAG | UTF8_FLAG),
+    uint16(STORE_METHOD),
+    uint16(0),
+    uint16(0),
+    uint32(0),
+    uint32(zip64 ? UINT32_MAX : 0),
+    uint32(zip64 ? UINT32_MAX : 0),
+    uint16(name.length),
+    uint16(extra.length),
+    name,
+    extra
+  );
+}
+
+function dataDescriptor(crc32: number, size: number, zip64: boolean): Uint8Array {
+  return concat(
+    uint32(0x08074b50),
+    uint32(crc32),
+    zip64 ? uint64(size) : uint32(size),
+    zip64 ? uint64(size) : uint32(size)
+  );
+}
+
+function centralHeader(entry: CentralDirectoryEntry): Uint8Array {
+  const zip64Size = entry.size >= UINT32_MAX;
+  const zip64Offset = entry.offset >= UINT32_MAX;
+  const extraValues = [
+    ...(zip64Size ? [uint64(entry.size), uint64(entry.size)] : []),
+    ...(zip64Offset ? [uint64(entry.offset)] : [])
+  ];
+  const extra = extraValues.length
+    ? concat(
+        uint16(0x0001),
+        uint16(extraValues.reduce((size, value) => size + value.length, 0)),
+        ...extraValues
+      )
+    : new Uint8Array();
+  return concat(
+    uint32(0x02014b50),
+    uint16(extra.length ? ZIP64_VERSION : ZIP_VERSION),
+    uint16(entry.zip64 ? ZIP64_VERSION : ZIP_VERSION),
+    uint16(DATA_DESCRIPTOR_FLAG | UTF8_FLAG),
+    uint16(STORE_METHOD),
+    uint16(0),
+    uint16(0),
+    uint32(entry.crc32),
+    uint32(zip64Size ? UINT32_MAX : entry.size),
+    uint32(zip64Size ? UINT32_MAX : entry.size),
+    uint16(entry.name.length),
+    uint16(extra.length),
+    uint16(0),
+    uint16(0),
+    uint16(0),
+    uint32(entry.isDirectory ? 0x10 : 0),
+    uint32(zip64Offset ? UINT32_MAX : entry.offset),
+    entry.name,
+    extra
+  );
+}
+
+function endOfCentralDirectory(count: number, size: number, offset: number): Uint8Array {
+  const zip64 = count >= UINT16_MAX || size >= UINT32_MAX || offset >= UINT32_MAX;
+  if (!zip64) {
+    return concat(
+      uint32(0x06054b50),
+      uint16(0),
+      uint16(0),
+      uint16(count),
+      uint16(count),
+      uint32(size),
+      uint32(offset),
+      uint16(0)
+    );
+  }
+  const zip64Offset = offset + size;
+  return concat(
+    uint32(0x06064b50),
+    uint64(44),
+    uint16(ZIP64_VERSION),
+    uint16(ZIP64_VERSION),
+    uint32(0),
+    uint32(0),
+    uint64(count),
+    uint64(count),
+    uint64(size),
+    uint64(offset),
+    uint32(0x07064b50),
+    uint32(0),
+    uint64(zip64Offset),
+    uint32(1),
+    uint32(0x06054b50),
+    uint16(0),
+    uint16(0),
+    uint16(UINT16_MAX),
+    uint16(UINT16_MAX),
+    uint32(UINT32_MAX),
+    uint32(UINT32_MAX),
+    uint16(0)
+  );
+}
+
+function entryName(entry: ZipEntry): Uint8Array {
+  return bytes(entry.isDirectory && !entry.key.endsWith('/') ? `${entry.key}/` : entry.key);
+}
+
+/**
+ * Creates a standards-compliant, uncompressed ZIP stream. Object bytes are
+ * forwarded directly from the provider; only central-directory metadata stays
+ * in memory.
+ */
+export function createZipStream(provider: StorageProvider, entries: ZipEntry[]): ReadableStream {
+  let cancelled = false;
+  let activeReader: ReadableStreamDefaultReader<Uint8Array> | undefined;
+
+  return new ReadableStream({
+    async start(controller) {
+      let offset = 0;
+      const centralEntries: CentralDirectoryEntry[] = [];
+      try {
+        for (const entry of entries) {
+          if (cancelled) return;
+          const name = entryName(entry);
+          if (name.length > UINT16_MAX) throw new Error('Archive entry name is too long');
+          const sizeZip64 = entry.size >= UINT32_MAX;
+          controller.enqueue(localHeader(name, sizeZip64));
+          const localOffset = offset;
+          offset += 30 + name.length + (sizeZip64 ? 20 : 0);
+
+          let crc32 = 0;
+          let actualSize = 0;
+          if (!entry.isDirectory) {
+            const download = await provider.getObject(entry.key);
+            activeReader = download.stream.getReader();
+            while (!cancelled) {
+              const { done, value } = await activeReader.read();
+              if (done) break;
+              crc32 = crc32Update(crc32, value);
+              actualSize += value.length;
+              offset += value.length;
+              controller.enqueue(value);
+            }
+            activeReader.releaseLock();
+            activeReader = undefined;
+          }
+          if (cancelled) return;
+          if (actualSize !== entry.size) {
+            throw new Error(`Object size changed while creating archive: ${entry.key}`);
+          }
+          const entryZip64 = sizeZip64 || actualSize >= UINT32_MAX;
+          const descriptor = dataDescriptor(crc32, actualSize, entryZip64);
+          controller.enqueue(descriptor);
+          offset += descriptor.length;
+          centralEntries.push({
+            name,
+            crc32,
+            size: actualSize,
+            offset: localOffset,
+            zip64: entryZip64,
+            isDirectory: entry.isDirectory
+          });
+        }
+
+        const centralOffset = offset;
+        for (const entry of centralEntries) {
+          const header = centralHeader(entry);
+          controller.enqueue(header);
+          offset += header.length;
+        }
+        controller.enqueue(
+          endOfCentralDirectory(centralEntries.length, offset - centralOffset, centralOffset)
+        );
+        controller.close();
+      } catch (err) {
+        controller.error(err);
+      }
+    },
+    async cancel() {
+      cancelled = true;
+      await activeReader?.cancel();
+    }
+  });
+}
diff --git a/src/lib/storage/api.spec.ts b/src/lib/storage/api.spec.ts
index 95ab05ac..fcf83ca0 100644
--- a/src/lib/storage/api.spec.ts
+++ b/src/lib/storage/api.spec.ts
@@ -123,6 +123,81 @@ describe('createFetchStorageApi', () => {
     });
   });
 
+  describe('search', () => {
+    it('searches a bucket and forwards its abort signal', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const controller = new AbortController();
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        ndjsonResponse([
+          JSON.stringify({
+            type: 'complete',
+            results: [
+              {
+                key: 'report.txt',
+                size: 1,
+                lastModified: '2026-08-12T12:00:00.000Z',
+                isDirectory: false
+              }
+            ]
+          })
+        ])
+      );
+
+      const result = await api.search({
+        bucket: 'documents',
+        query: 'report',
+        signal: controller.signal
+      });
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/search?bucket=documents&q=report');
+      expect(init?.signal).toBe(controller.signal);
+      expect(result.results[0].lastModified).toBeInstanceOf(Date);
+    });
+  });
+
+  describe('recent searches', () => {
+    it('lists recent searches', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse([{ buckets: ['documents'], query: 'report' }])
+      );
+
+      await expect(api.listRecentSearches()).resolves.toEqual([
+        { buckets: ['documents'], query: 'report' }
+      ]);
+      expect(vi.mocked(globalThis.fetch).mock.calls[0]![0]).toBe('/api/storage/search/history');
+    });
+
+    it('records and clears recent searches', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 204 }));
+
+      await api.recordRecentSearch({
+        buckets: ['documents', 'archive'],
+        query: 'report',
+        useRegex: true,
+        excludePatterns: ['_temp'],
+        searchPath: 'events/',
+        maxDepth: 3
+      });
+      await api.clearRecentSearches();
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toBe('/api/storage/search/history');
+      expect(init).toMatchObject({ method: 'POST' });
+      expect(JSON.parse(String(init?.body))).toEqual({
+        buckets: ['documents', 'archive'],
+        query: 'report',
+        useRegex: true,
+        excludePatterns: ['_temp'],
+        searchPath: 'events/',
+        maxDepth: 3
+      });
+      expect(vi.mocked(globalThis.fetch).mock.calls[1]![1]).toMatchObject({ method: 'DELETE' });
+    });
+  });
+
   describe('copy', () => {
     it('sends a POST request with JSON body', async () => {
       const api = createFetchStorageApi(() => 'conn-1');
diff --git a/src/lib/storage/api.test-utils.ts b/src/lib/storage/api.test-utils.ts
index dc968887..08ac9b15 100644
--- a/src/lib/storage/api.test-utils.ts
+++ b/src/lib/storage/api.test-utils.ts
@@ -33,6 +33,22 @@ export function createMemoryStorageApi(overrides?: Partial<StorageApi>): Storage
       return emptyPage;
     },
 
+    async search() {
+      return { results: [] };
+    },
+
+    async listRecentSearches() {
+      return [];
+    },
+
+    async recordRecentSearch() {
+      // no-op
+    },
+
+    async clearRecentSearches() {
+      // no-op
+    },
+
     async copy(): Promise<CopyMoveResult> {
       return { results: [], failed: 0 };
     },
@@ -65,6 +81,30 @@ export function createMemoryStorageApi(overrides?: Partial<StorageApi>): Storage
       return { status: 'done' };
     },
 
+    async cancelJob() {
+      // no-op
+    },
+
+    async createDownloadManifest() {
+      return {
+        id: 'download-manifest',
+        files: [],
+        expiresAt: new Date().toISOString()
+      };
+    },
+
+    async listDownloadHistory() {
+      return [];
+    },
+
+    async clearDownloadHistory() {
+      // no-op
+    },
+
+    async recreateDownloadManifest() {
+      return { id: 'download-manifest', files: [], expiresAt: new Date().toISOString() };
+    },
+
     async checkObjectExists() {
       return false;
     },
diff --git a/src/lib/storage/api.ts b/src/lib/storage/api.ts
index f8bbf2bf..601c8a54 100644
--- a/src/lib/storage/api.ts
+++ b/src/lib/storage/api.ts
@@ -14,7 +14,14 @@
 import { STORAGE_CONNECTION_ID_HEADER } from './connection-id-header.js';
 import { createStorageFetch } from './storage-fetch.js';
 import { readNdjsonStream, type NdjsonStreamCallbacks } from './ndjson-stream.js';
-import type { StoragePage, ArchiveListingResponse } from './types.js';
+import { serializeFilter, type SearchFilterSpec } from './search-filter.js';
+import type {
+  StoragePage,
+  ArchiveListingResponse,
+  StorageSearchResponse,
+  StorageSearchUpdate,
+  RecentSearchEntry
+} from './types.js';
 import type { FileDetails, DirectoryMetadata, BucketDetails } from './details-types.js';
 
 // ── Types ──────────────────────────────────────────────────────────────────
@@ -37,11 +44,53 @@ export interface JobStatus {
   };
 }
 
+export interface DownloadManifestResponse {
+  id: string;
+  files: Array<{ filename: string; size: number; part: number }>;
+  expiresAt: string;
+}
+
+export interface DownloadHistoryEntry {
+  id: string;
+  bucket: string;
+  connectionId: string;
+  entries: Array<{ key: string; size: number; isDirectory: boolean }>;
+  archive: boolean;
+  archiveFilename: string | null;
+  createdAt: string;
+  expiresAt: string;
+}
+
 // ── Interface ──────────────────────────────────────────────────────────────
 
 export interface StorageApi {
   list(params: { bucket: string; prefix?: string; pageSize?: number }): Promise<StoragePage>;
 
+  search(params: {
+    bucket: string;
+    query: string;
+    prefix?: string;
+    maxDepth?: number;
+    useRegex?: boolean;
+    excludePatterns?: string[];
+    filters?: SearchFilterSpec[];
+    signal?: AbortSignal;
+    onUpdate?: (update: StorageSearchUpdate) => void;
+  }): Promise<StorageSearchResponse>;
+
+  listRecentSearches(): Promise<RecentSearchEntry[]>;
+
+  recordRecentSearch(params: {
+    buckets: string[];
+    query: string;
+    useRegex?: boolean;
+    excludePatterns?: string[];
+    searchPath?: string;
+    maxDepth?: number | null;
+  }): Promise<void>;
+
+  clearRecentSearches(): Promise<void>;
+
   copy(params: {
     bucket: string;
     sourceKeys: string[];
@@ -84,6 +133,23 @@ export interface StorageApi {
 
   pollJob(jobId: string): Promise<JobStatus>;
 
+  cancelJob(jobId: string): Promise<void>;
+
+  createDownloadManifest(
+    params: {
+      bucket: string;
+      prefix: string;
+      keys: string[];
+    },
+    signal?: AbortSignal
+  ): Promise<DownloadManifestResponse>;
+
+  listDownloadHistory(connectionId: string): Promise<DownloadHistoryEntry[]>;
+
+  clearDownloadHistory(): Promise<void>;
+
+  recreateDownloadManifest(manifestId: string, keys: string[]): Promise<DownloadManifestResponse>;
+
   checkObjectExists(params: { bucket: string; key: string }): Promise<boolean>;
 
   download(params: { bucket: string; key: string }): Promise<Response>;
@@ -139,6 +205,45 @@ export function createFetchStorageApi(getConnectionId: () => string | null): Sto
       return (await res.json()) as StoragePage;
     },
 
+    async search({
+      bucket,
+      query,
+      prefix,
+      maxDepth,
+      useRegex,
+      excludePatterns,
+      filters,
+      signal,
+      onUpdate
+    }) {
+      const params = new URLSearchParams({ bucket, q: query });
+      if (prefix) params.set('prefix', prefix);
+      if (maxDepth !== undefined) params.set('maxDepth', String(maxDepth));
+      if (useRegex) params.set('regex', 'true');
+      for (const pattern of excludePatterns ?? []) params.append('exclude', pattern);
+      for (const filter of filters ?? []) params.append('filter', serializeFilter(filter));
+      const res = await fetch_(`/api/storage/search?${params}`, { signal });
+      const { readSearchStream } = await import('./search-stream.js');
+      return readSearchStream(res.body, onUpdate);
+    },
+
+    async listRecentSearches() {
+      const res = await fetch_('/api/storage/search/history');
+      return (await res.json()) as RecentSearchEntry[];
+    },
+
+    async recordRecentSearch({ buckets, query, useRegex, excludePatterns, searchPath, maxDepth }) {
+      await fetch_('/api/storage/search/history', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ buckets, query, useRegex, excludePatterns, searchPath, maxDepth })
+      });
+    },
+
+    async clearRecentSearches() {
+      await fetch_('/api/storage/search/history', { method: 'DELETE' });
+    },
+
     async copy({ bucket, sourceKeys, destinationPrefix, progress, jobId, signal, callbacks }) {
       return copyMoveRequest(fetch_, '/api/storage/copy', {
         bucket,
@@ -213,6 +318,45 @@ export function createFetchStorageApi(getConnectionId: () => string | null): Sto
       return (await res.json()) as JobStatus;
     },
 
+    async cancelJob(jobId) {
+      await fetch_(`/api/storage/copy/job/${encodeURIComponent(jobId)}`, { method: 'DELETE' });
+    },
+
+    async createDownloadManifest({ bucket, prefix, keys }, signal) {
+      const params = new URLSearchParams({ bucket, prefix });
+      const res = await fetch_(`/api/storage/download/manifests?${params}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ keys }),
+        signal
+      });
+      return (await res.json()) as DownloadManifestResponse;
+    },
+
+    async listDownloadHistory(connectionId) {
+      const res = await fetch(
+        `/api/storage/download/manifests?${new URLSearchParams({ connectionId })}`
+      );
+      if (!res.ok) throw new Error(`Request failed with status ${res.status}`);
+      return (await res.json()) as DownloadHistoryEntry[];
+    },
+
+    async clearDownloadHistory() {
+      await fetch_('/api/storage/download/manifests', { method: 'DELETE' });
+    },
+
+    async recreateDownloadManifest(manifestId, keys) {
+      const res = await fetch_(
+        `/api/storage/download/manifests/${encodeURIComponent(manifestId)}/redownload`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ keys })
+        }
+      );
+      return (await res.json()) as DownloadManifestResponse;
+    },
+
     async checkObjectExists({ bucket, key }) {
       const params = new URLSearchParams({ bucket, key });
       try {
diff --git a/src/lib/storage/download-history.spec.ts b/src/lib/storage/download-history.spec.ts
new file mode 100644
index 00000000..55c749e6
--- /dev/null
+++ b/src/lib/storage/download-history.spec.ts
@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest';
+import { selectedDownloadHistoryPayloadSize } from './download-history.js';
+
+const entries = [
+  { key: 'a.txt', size: 10, isDirectory: false },
+  { key: 'folder/', size: 0, isDirectory: true },
+  { key: 'folder/b.txt', size: 20, isDirectory: false },
+  { key: 'folder/nested/c.txt', size: 30, isDirectory: false }
+];
+
+describe('selectedDownloadHistoryPayloadSize', () => {
+  it('sums directly selected files', () => {
+    expect(selectedDownloadHistoryPayloadSize(entries, ['a.txt', 'folder/b.txt'])).toBe(30);
+  });
+
+  it('expands selected directories to their stored descendants', () => {
+    expect(selectedDownloadHistoryPayloadSize(entries, ['folder/'])).toBe(50);
+  });
+
+  it('deduplicates direct children selected alongside their directory', () => {
+    expect(selectedDownloadHistoryPayloadSize(entries, ['folder/', 'folder/b.txt'])).toBe(50);
+  });
+});
diff --git a/src/lib/storage/download-history.ts b/src/lib/storage/download-history.ts
new file mode 100644
index 00000000..ebf8fcac
--- /dev/null
+++ b/src/lib/storage/download-history.ts
@@ -0,0 +1,26 @@
+import type { DownloadHistoryEntry } from './api.js';
+
+/** Return the persisted payload size for the selected history entries. */
+export function selectedDownloadHistoryPayloadSize(
+  entries: DownloadHistoryEntry['entries'],
+  selectedKeys: Iterable<string>
+): number {
+  const entriesByKey = new Map(entries.map((entry) => [entry.key, entry]));
+  const selectedEntries = new Map<string, DownloadHistoryEntry['entries'][number]>();
+
+  for (const key of selectedKeys) {
+    const entry = entriesByKey.get(key);
+    if (!entry) continue;
+    if (entry.isDirectory) {
+      for (const descendant of entries) {
+        if (descendant.key === entry.key || descendant.key.startsWith(entry.key)) {
+          selectedEntries.set(descendant.key, descendant);
+        }
+      }
+    } else {
+      selectedEntries.set(entry.key, entry);
+    }
+  }
+
+  return [...selectedEntries.values()].reduce((total, entry) => total + entry.size, 0);
+}
diff --git a/src/lib/storage/download.spec.ts b/src/lib/storage/download.spec.ts
new file mode 100644
index 00000000..107d418f
--- /dev/null
+++ b/src/lib/storage/download.spec.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it, vi } from 'vitest';
+import { estimateArchiveSize, startDownload } from './download.js';
+import { createMemoryStorageApi } from './api.test-utils.js';
+
+describe('estimateArchiveSize', () => {
+  it('returns the end-of-central-directory size for no entries', () => {
+    expect(estimateArchiveSize([])).toBe(22);
+  });
+
+  it('adds per-entry structure overhead to the payload total', () => {
+    // Each entry contributes 92 bytes of fixed structure plus its name stored
+    // twice ('a.txt'/'b.txt' = 5 characters each), on top of the 22-byte EOCD
+    // and the payload itself.
+    const estimate = estimateArchiveSize([
+      { key: 'a.txt', size: 5, isDirectory: false },
+      { key: 'b.txt', size: 10, isDirectory: false }
+    ]);
+    expect(estimate).toBe(22 + 2 * (92 + 2 * 5) + 15);
+  });
+
+  it('appends a slash to directory entry names without one', () => {
+    const withSlash = estimateArchiveSize([{ key: 'dir/', size: 0, isDirectory: true }]);
+    const withoutSlash = estimateArchiveSize([{ key: 'dir', size: 0, isDirectory: true }]);
+    expect(withoutSlash).toBe(withSlash);
+    expect(withSlash).toBe(22 + 92 + 2 * 4);
+  });
+
+  it('scales with many entries so large downloads show a meaningful size', () => {
+    const entries = Array.from({ length: 1_000 }, (_, index) => ({
+      key: `file-${index}.bin`,
+      size: 1_000_000,
+      isDirectory: false
+    }));
+    const estimate = estimateArchiveSize(entries);
+    expect(estimate).toBeGreaterThan(1_000 * 1_000_000);
+    expect(estimate).toBeLessThan(1_001 * 1_000_000);
+  });
+});
+
+describe('startDownload', () => {
+  it('starts every manifest stream without polling or local persistence', async () => {
+    vi.useFakeTimers();
+    const api = createMemoryStorageApi({
+      createDownloadManifest: async () => ({
+        id: 'manifest-1',
+        expiresAt: new Date().toISOString(),
+        files: [
+          { filename: 'one.txt', size: 1, part: 1 },
+          { filename: 'two.txt', size: 2, part: 2 }
+        ]
+      })
+    });
+    const click = vi.fn();
+    vi.stubGlobal('document', {
+      createElement: () => ({ click, style: {}, remove: vi.fn() }),
+      body: { appendChild: vi.fn() }
+    });
+
+    const promise = startDownload(api, 'bucket', '', ['one.txt', 'two.txt']);
+    await vi.advanceTimersByTimeAsync(500);
+
+    await expect(promise).resolves.toMatchObject({
+      id: 'manifest-1',
+      fileCount: 2,
+      totalBytes: 3,
+      jobIds: expect.arrayContaining([expect.any(String)])
+    });
+    expect(click).toHaveBeenCalledTimes(2);
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+  });
+});
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index 0a76b951..aa9513e7 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -1,56 +1,72 @@
-/**
- * Client-side utility for downloading a single S3 object via the server proxy.
- *
- * Strategy:
- *  1. Fetch the object via `storageFetch` which injects the connection header
- *     and maps HTTP errors to `StorageError`.
- *  3. On success: create a Blob URL and trigger a native browser download via a
- *     programmatic anchor click.
- *
- * Note: The response body is buffered as a Blob before the download link is
- * constructed. This avoids exposing credentials in the URL (query-param approach)
- * while keeping the implementation simple. For very large files this will use
- * proportional browser memory — see TECH_DEBT.md for the long-term fix.
- */
-
-import { createStorageFetch } from '$lib/storage/storage-fetch.js';
-import type { StorageErrorCode } from '$lib/storage/errors.js';
-
-export type DownloadErrorCode = StorageErrorCode;
+import type { StorageApi } from './api.js';
 
 /**
- * Download a single S3 object.
- *
- * Fetches the object with the connection ID header, buffers it as a Blob,
- * then triggers a native browser download via a programmatic anchor click.
- *
- * @throws {StorageError} when the server returns a non-2xx response.
+ * Estimate the byte length of the stored (uncompressed) ZIP that a multi
+ * download will produce. The exact archive size is deliberately not computed
+ * server-side, so this client-side approximation (payload plus per-entry ZIP
+ * structure overhead) drives the size/ETA display while downloading.
  */
-export async function downloadObject(
-  bucket: string,
-  key: string,
-  connectionId: string
-): Promise<void> {
-  const fetch_ = createStorageFetch(() => connectionId);
-  const url = `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
-
-  const response = await fetch_(url);
-
-  const blob = await response.blob();
-  const blobUrl = URL.createObjectURL(blob);
-
-  // Derive filename from the key (last path segment).
-  const filename = key.split('/').filter(Boolean).pop() ?? key;
+export function estimateArchiveSize(
+  entries: Array<{ key: string; size: number; isDirectory?: boolean }>
+): number {
+  let payload = 0;
+  // End-of-central-directory record.
+  let overhead = 22;
+  for (const entry of entries) {
+    const nameLength = entry.key.length + (entry.isDirectory && !entry.key.endsWith('/') ? 1 : 0);
+    // Local file header (30) + data descriptor (16) + central directory header
+    // (46), with the entry name stored twice (local header + central directory).
+    overhead += 92 + 2 * nameLength;
+    if (!entry.isDirectory) payload += entry.size;
+  }
+  return payload + overhead;
+}
 
+async function triggerDownload(
+  manifestId: string,
+  part: number,
+  filename: string,
+  jobId: string
+): Promise<void> {
   const anchor = document.createElement('a');
-  anchor.href = blobUrl;
+  anchor.href = `/api/storage/download/manifests/${encodeURIComponent(manifestId)}/${part}?${new URLSearchParams({ jobId })}`;
   anchor.download = filename;
   anchor.style.display = 'none';
   document.body.appendChild(anchor);
   anchor.click();
-  document.body.removeChild(anchor);
+  // Keep concurrent native downloads initiated by this user gesture alive long enough
+  // for Firefox and Chromium to accept them.
+  await new Promise((resolve) => setTimeout(resolve, 250));
+  setTimeout(() => anchor.remove(), 10_000);
+}
 
-  // Release the object URL after a short delay to allow the browser to initiate
-  // the download before the URL is revoked.
-  setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
+export async function triggerManifestDownloads(manifest: {
+  id: string;
+  files: Array<{ filename: string; part: number }>;
+}): Promise<string[]> {
+  const jobIds: string[] = [];
+  for (const file of manifest.files) {
+    const jobId = crypto.randomUUID();
+    jobIds.push(jobId);
+    await triggerDownload(manifest.id, file.part, file.filename, jobId);
+  }
+  return jobIds;
+}
+
+/** Prepare a final manifest, then immediately hand its streams to the browser. */
+export async function startDownload(
+  api: StorageApi,
+  bucket: string,
+  prefix: string,
+  keys: string[],
+  signal?: AbortSignal
+): Promise<{ id: string; fileCount: number; totalBytes: number; jobIds: string[] }> {
+  const manifest = await api.createDownloadManifest({ bucket, prefix, keys }, signal);
+  const jobIds = await triggerManifestDownloads(manifest);
+  return {
+    id: manifest.id,
+    fileCount: manifest.files.length,
+    totalBytes: manifest.files.reduce((total, file) => total + file.size, 0),
+    jobIds
+  };
 }
diff --git a/src/lib/storage/operations.svelte.spec.ts b/src/lib/storage/operations.svelte.spec.ts
index ac84b7d1..9081f0df 100644
--- a/src/lib/storage/operations.svelte.spec.ts
+++ b/src/lib/storage/operations.svelte.spec.ts
@@ -12,6 +12,7 @@ const OPERATIONS_HISTORY_KEY = 'storage_operations_history';
 function makeMockApi(): StorageApi {
   return {
     pollJob: vi.fn().mockResolvedValue({ status: 'done' }),
+    cancelJob: vi.fn(),
     list: vi.fn(),
     copy: vi.fn(),
     move: vi.fn(),
@@ -202,12 +203,12 @@ describe('OperationsState lifecycle', () => {
     const state = new OperationsState(makeMockApi(), makeOpts());
     state.startOp('op-1', 'Copy: file.txt', 'paste', 3, undefined, undefined, undefined, 500);
 
-    state.updateOpProgress('op-1', 2, 300, 'file2.txt');
+    state.updateOpProgress('op-1', 2, 300, 'file1.txt');
 
     const op = state.operations[0];
     expect(op.completedCount).toBe(2);
     expect(op.completedBytes).toBe(300);
-    expect(op.currentFileName).toBe('file2.txt');
+    expect(op.currentFileName).toBe('file1.txt');
   });
 
   it('updateOpProgress does NOT update operations with status cancelled', () => {
@@ -231,6 +232,17 @@ describe('OperationsState lifecycle', () => {
     expect(state.operations[0].fileJobIds).toEqual(['job-a', 'job-b']);
   });
 
+  it('updateOpTotalBytes refines only the target operation size', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Download', 'download', 4, undefined, undefined, undefined, 100);
+    state.startOp('op-2', 'Other', 'download', 1, undefined, undefined, undefined, 200);
+
+    state.updateOpTotalBytes('op-1', 900);
+
+    expect(state.operations[0].totalBytes).toBe(900);
+    expect(state.operations[1].totalBytes).toBe(200);
+  });
+
   it('finishOp with done sets status=done and completedAt', () => {
     const state = new OperationsState(makeMockApi(), makeOpts());
     state.startOp('op-1', 'Test', 'paste', 1);
@@ -397,6 +409,18 @@ describe('cancelOp', () => {
 
     expect(() => state.cancelOp('nonexistent')).not.toThrow();
   });
+
+  it('cancels every active browser download job', () => {
+    const api = makeMockApi();
+    const state = new OperationsState(api, makeOpts());
+    state.startOp('op-1', 'Download', 'download', 2);
+    state.updateOpJobIds('op-1', ['job-1', 'job-2']);
+
+    state.cancelOp('op-1');
+
+    expect(api.cancelJob).toHaveBeenCalledWith('job-1');
+    expect(api.cancelJob).toHaveBeenCalledWith('job-2');
+  });
 });
 
 describe('clearOperationHistory', () => {
diff --git a/src/lib/storage/operations.svelte.ts b/src/lib/storage/operations.svelte.ts
index 44155bb9..52037d1d 100644
--- a/src/lib/storage/operations.svelte.ts
+++ b/src/lib/storage/operations.svelte.ts
@@ -85,7 +85,8 @@ export class OperationsState {
     abortController?: AbortController,
     destPath?: string,
     sourceNames?: string[],
-    totalBytes = 0
+    totalBytes = 0,
+    persist = true
   ): void {
     this.operations = [
       ...this.operations,
@@ -106,18 +107,25 @@ export class OperationsState {
     if (abortController) {
       this._abortControllers.set(id, abortController);
     }
-    saveOperationsToStorage(this.operations);
+    if (persist) saveOperationsToStorage(this.operations);
   }
 
   updateOpProgress(
     id: string,
     completedCount: number,
     completedBytes: number,
-    currentFileName?: string
+    currentFileName?: string,
+    totalBytes?: number
   ): void {
     this.operations = this.operations.map((op) =>
       op.id === id && op.status !== 'cancelled'
-        ? { ...op, completedCount, completedBytes, currentFileName }
+        ? {
+            ...op,
+            completedCount,
+            completedBytes,
+            currentFileName,
+            totalBytes: totalBytes ?? op.totalBytes
+          }
         : op
     );
   }
@@ -127,21 +135,47 @@ export class OperationsState {
     saveOperationsToStorage(this.operations);
   }
 
+  trackDownload(id: string): void {
+    const operation = this.operations.find((op) => op.id === id);
+    // Native downloads begin asynchronously after their anchor click. Wait for
+    // the first request to register its server-side job before polling it.
+    if (operation?.fileJobIds?.length) {
+      const timer = setTimeout(() => void this._pollJobStatus(operation), 500);
+      this._pollTimers.set(id, timer);
+    }
+  }
+
+  /** Refine the expected transfer size once the download manifest is known. */
+  updateOpTotalBytes(id: string, totalBytes: number): void {
+    this.operations = this.operations.map((op) => (op.id === id ? { ...op, totalBytes } : op));
+  }
+
   finishOp(id: string, status: 'done' | 'error' | 'cancelled', errorMessage?: string): void {
+    const operation = this.operations.find((op) => op.id === id);
     this.operations = this.operations.map((op) =>
       op.id === id && op.status !== 'cancelled'
         ? { ...op, status, errorMessage, completedAt: Date.now() }
         : op
     );
     this._abortControllers.delete(id);
+    if (operation?.type !== 'download') saveOperationsToStorage(this.operations);
+  }
+
+  removeOp(id: string): void {
+    this.operations = this.operations.filter((op) => op.id !== id);
+    this._abortControllers.delete(id);
     saveOperationsToStorage(this.operations);
   }
 
   cancelOp(id: string): void {
+    const operation = this.operations.find((op) => op.id === id);
     const controller = this._abortControllers.get(id);
     if (controller) {
       controller.abort();
     }
+    if (operation?.type === 'download') {
+      for (const jobId of operation.fileJobIds ?? []) void this._api.cancelJob(jobId);
+    }
     const timer = this._pollTimers.get(id);
     if (timer) {
       clearTimeout(timer);
@@ -172,15 +206,26 @@ export class OperationsState {
     let completedCount = 0;
     let completedBytes = 0;
     let anyRunning = false;
+    let anyError = false;
+    let anyCancelled = false;
+    let currentFileName: string | undefined;
 
     for (const jobId of op.fileJobIds!) {
       try {
         const job = await this._api.pollJob(jobId);
+        completedBytes += job.progress?.completedBytes ?? 0;
         if (job.status === 'done') {
           completedCount++;
         } else if (job.status === 'running') {
           anyRunning = true;
-          completedBytes += job.progress?.completedBytes ?? 0;
+          currentFileName = job.progress?.currentFileName;
+        } else if (job.status === 'not_found') {
+          // The browser may not have opened the native download request yet.
+          anyRunning = true;
+        } else if (job.status === 'cancelled') {
+          anyCancelled = true;
+        } else {
+          anyError = true;
         }
       } catch {
         // Job may have expired
@@ -195,6 +240,7 @@ export class OperationsState {
               status: 'running' as const,
               completedCount,
               completedBytes,
+              currentFileName,
               completedAt: undefined
             }
           : o
@@ -206,7 +252,11 @@ export class OperationsState {
         o.id === op.id
           ? {
               ...o,
-              status: (completedCount === op.itemCount ? 'done' : 'error') as 'done' | 'error',
+              status: (anyCancelled
+                ? 'cancelled'
+                : anyError || completedCount !== op.itemCount
+                  ? 'error'
+                  : 'done') as 'done' | 'error' | 'cancelled',
               completedCount,
               completedBytes,
               completedAt: Date.now()
diff --git a/src/lib/storage/search-filter.spec.ts b/src/lib/storage/search-filter.spec.ts
new file mode 100644
index 00000000..82fd7bfe
--- /dev/null
+++ b/src/lib/storage/search-filter.spec.ts
@@ -0,0 +1,190 @@
+import { describe, it, expect } from 'vitest';
+import {
+  compileFilterPredicates,
+  formatDateValue,
+  isUsableFilter,
+  parseDateInput,
+  parseFilterParam,
+  parseSizeInput,
+  serializeFilter,
+  FILTER_OPERATORS
+} from './search-filter.js';
+
+const MB = 1024 ** 2;
+
+describe('parseSizeInput', () => {
+  it('interprets bare numbers as megabytes', () => {
+    expect(parseSizeInput('1')).toBe(1024 ** 2);
+    expect(parseSizeInput('2')).toBe(2 * 1024 ** 2);
+    expect(parseSizeInput('2048 ')).toBe(2048 * 1024 ** 2);
+  });
+
+  it('accepts dot and comma decimal separators', () => {
+    expect(parseSizeInput('1.5')).toBe(1.5 * MB);
+    expect(parseSizeInput('1,5')).toBe(1.5 * MB);
+    expect(parseSizeInput('2.5')).toBe(2.5 * MB);
+  });
+
+  it('accepts an explicit MB suffix (case insensitive)', () => {
+    expect(parseSizeInput('2.5 MB')).toBe(2.5 * MB);
+    expect(parseSizeInput('2.5mb')).toBe(2.5 * MB);
+    expect(parseSizeInput('3 MiB')).toBe(3 * MB);
+    expect(parseSizeInput('4 M')).toBe(4 * MB);
+  });
+
+  it('rejects other unit suffixes — sizes are always MB', () => {
+    expect(parseSizeInput('1 KB')).toBeNull();
+    expect(parseSizeInput('1 GB')).toBeNull();
+    expect(parseSizeInput('1 TB')).toBeNull();
+    expect(parseSizeInput('3 seConds')).toBeNull();
+  });
+
+  it('rejects malformed values', () => {
+    expect(parseSizeInput('abc')).toBeNull();
+    expect(parseSizeInput('1.2.3')).toBeNull();
+    expect(parseSizeInput('-5')).toBeNull();
+    expect(parseSizeInput('1.5 blerg')).toBeNull();
+  });
+});
+
+describe('parseDateInput', () => {
+  it('parses ISO year-first notation', () => {
+    expect(parseDateInput('2026-08-17')).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('2026/08/17')).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('2026.08.17')).toEqual(new Date(2026, 7, 17));
+  });
+
+  it('parses European day-first notation', () => {
+    expect(parseDateInput('17.08.2026')).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('17/08/2026')).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('17-08-2026')).toEqual(new Date(2026, 7, 17));
+  });
+
+  it('parses US month-first notation and day-first when forced', () => {
+    expect(parseDateInput('08/17/2026')).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('08/17/2026', { preferDayFirst: true })).toEqual(new Date(2026, 7, 17));
+    expect(parseDateInput('08-17-2026')).toEqual(new Date(2026, 7, 17));
+  });
+
+  it('assumes day-first for ambiguous values by default', () => {
+    expect(parseDateInput('02/03/2026')).toEqual(new Date(2026, 2, 2));
+    expect(parseDateInput('02/03/2026', { preferDayFirst: false })).toEqual(new Date(2026, 1, 3));
+  });
+
+  it('accepts an optional time component', () => {
+    expect(parseDateInput('17.08.2026 14:30')).toEqual(new Date(2026, 7, 17, 14, 30));
+    expect(parseDateInput('2026-08-17T09:05:30')).toEqual(new Date(2026, 7, 17, 9, 5, 30));
+  });
+
+  it('rejects invalid dates', () => {
+    expect(parseDateInput('30.02.2026')).toBeNull();
+    expect(parseDateInput('abc')).toBeNull();
+    expect(parseDateInput('2026-13-01')).toBeNull();
+    expect(parseDateInput('32.01.2026')).toBeNull();
+    expect(parseDateInput('2026-08-17 25:00')).toBeNull();
+    expect(parseDateInput('17.08.2026 10:99')).toBeNull();
+  });
+});
+
+describe('formatDateValue', () => {
+  it('formats local time to YYYY-MM-DD', () => {
+    expect(formatDateValue(new Date(2026, 0, 5))).toBe('2026-01-05');
+  });
+});
+
+describe('serialise / parse filter params', () => {
+  it('round-trips a filter', () => {
+    const spec = { field: 'date' as const, operator: '>' as const, value: '17.08.2026' };
+    expect(parseFilterParam(serializeFilter(spec))).toEqual(spec);
+  });
+
+  it('parses size filters', () => {
+    expect(parseFilterParam('size<1.5GB')).toEqual({
+      field: 'size',
+      operator: '<',
+      value: '1.5GB'
+    });
+  });
+
+  it('rejects malformed params', () => {
+    expect(parseFilterParam('nonsense')).toBeNull();
+    expect(parseFilterParam('datetime>2026-01-01')).toBeNull();
+    expect(parseFilterParam('date**2026')).toBeNull();
+  });
+
+  it('exposes the default operator first', () => {
+    expect(FILTER_OPERATORS).toEqual(['>', '=', '<']);
+  });
+});
+
+describe('isUsableFilter', () => {
+  it('accepts parseable values and rejects empty or invalid ones', () => {
+    expect(isUsableFilter({ field: 'size', operator: '>', value: '1 MB' })).toBe(true);
+    expect(isUsableFilter({ field: 'date', operator: '<', value: '01.02.2026' })).toBe(true);
+    expect(isUsableFilter({ field: 'size', operator: '>', value: '' })).toBe(false);
+    expect(isUsableFilter({ field: 'date', operator: '>', value: 'not a date' })).toBe(false);
+  });
+});
+
+describe('compileFilterPredicates', () => {
+  const item = (size: number, lastModified: Date) => ({ size, lastModified });
+
+  it('returns a pass-through when no usable filters exist', () => {
+    const predicate = compileFilterPredicates([{ field: 'size', operator: '>', value: '' }]);
+    expect(predicate(item(1, new Date()))).toBe(true);
+  });
+
+  it('filters by size', () => {
+    const predicate = compileFilterPredicates([{ field: 'size', operator: '>', value: '1' }]);
+    expect(predicate(item(2 * MB, new Date()))).toBe(true);
+    expect(predicate(item(MB / 2, new Date()))).toBe(false);
+  });
+
+  it('filters by exact size', () => {
+    const predicate = compileFilterPredicates([{ field: 'size', operator: '=', value: '1' }]);
+    expect(predicate(item(MB, new Date()))).toBe(true);
+    expect(predicate(item(MB + 1, new Date()))).toBe(false);
+  });
+
+  it('excludes directories while a size filter is active', () => {
+    const predicate = compileFilterPredicates([{ field: 'size', operator: '<', value: '2' }]);
+    expect(predicate({ size: MB, lastModified: new Date(), isDirectory: false })).toBe(true);
+    expect(predicate({ size: 0, lastModified: new Date(), isDirectory: true })).toBe(false);
+  });
+
+  it('date "=" matches the whole day', () => {
+    const predicate = compileFilterPredicates([
+      { field: 'date', operator: '=', value: '17.08.2026' }
+    ]);
+    expect(predicate(item(1, new Date(2026, 7, 17, 0, 0, 0)))).toBe(true);
+    expect(predicate(item(1, new Date(2026, 7, 17, 23, 59, 59)))).toBe(true);
+    expect(predicate(item(1, new Date(2026, 7, 16, 23, 59, 59)))).toBe(false);
+    expect(predicate(item(1, new Date(2026, 7, 18, 0, 0, 0)))).toBe(false);
+  });
+
+  it('date ">" matches days strictly after the given day', () => {
+    const predicate = compileFilterPredicates([
+      { field: 'date', operator: '>', value: '2026-08-17' }
+    ]);
+    expect(predicate(item(1, new Date(2026, 7, 18, 0, 0, 0)))).toBe(true);
+    expect(predicate(item(1, new Date(2026, 7, 17, 23, 59, 59)))).toBe(false);
+  });
+
+  it('date "<" matches days strictly before the given day', () => {
+    const predicate = compileFilterPredicates([
+      { field: 'date', operator: '<', value: '17.08.2026' }
+    ]);
+    expect(predicate(item(1, new Date(2026, 7, 17, 0, 0, 0)))).toBe(false);
+    expect(predicate(item(1, new Date(2026, 7, 16, 23, 59, 59)))).toBe(true);
+  });
+
+  it('combines multiple filters with logical AND', () => {
+    const predicate = compileFilterPredicates([
+      { field: 'size', operator: '>', value: '1' },
+      { field: 'date', operator: '<', value: '01.01.2026' }
+    ]);
+    expect(predicate(item(2 * MB, new Date(2025, 11, 31, 23, 59)))).toBe(true);
+    expect(predicate(item(2 * MB, new Date(2026, 0, 2)))).toBe(false);
+    expect(predicate(item(MB / 2, new Date(2025, 11, 31)))).toBe(false);
+  });
+});
diff --git a/src/lib/storage/search-filter.ts b/src/lib/storage/search-filter.ts
new file mode 100644
index 00000000..f03f3d98
--- /dev/null
+++ b/src/lib/storage/search-filter.ts
@@ -0,0 +1,261 @@
+/**
+ * Date / size filter parsing and matching for storage searches.
+ *
+ * This module is intentionally free of any server or client dependencies (only
+ * plain TypeScript) so that it can be shared by:
+ *   • the search UI (src/lib/components/storage/*)
+ *   • the search API endpoint (src/routes/(app)/api/storage/search/+server.ts)
+ *
+ * Sizes are always expressed in megabytes: a bare number is interpreted as MB
+ * (an explicit `MB` / `MiB` suffix is accepted for clarity) and both "." and ","
+ * are accepted as decimal separators. The date parser accepts ISO (YYYY-MM-DD),
+ * European (DD.MM.YYYY) and US (MM/DD/YYYY) notations plus an optional time
+ * component.
+ */
+
+export type SearchFilterField = 'date' | 'size';
+export type SearchFilterOperator = '>' | '=' | '<';
+
+/** The operator options shown in the filter input dropdown, in order. */
+export const FILTER_OPERATORS: readonly SearchFilterOperator[] = ['>', '=', '<'];
+
+/** A single filter row stored on a search session. */
+export interface SearchFilter {
+  id: string;
+  field: SearchFilterField;
+  operator: SearchFilterOperator;
+  value: string;
+}
+
+/** Transport form of a filter without the UI-only row id. */
+export type SearchFilterSpec = Omit<SearchFilter, 'id'>;
+
+/** Minimal shape needed to evaluate the filters against. */
+export interface FilterableItem {
+  size: number;
+  lastModified: Date;
+  /** Whether the item is a directory. Size filters never match directories. */
+  isDirectory?: boolean;
+}
+
+// ── Size parsing ─────────────────────────────────────────────────────────────
+
+/** One megabyte in bytes — the only unit used for size filters. */
+const MB = 1024 ** 2;
+
+/**
+ * Parse a size filter value such as "1.5", "1,5 MB" or "3 MiB" into bytes.
+ * Sizes are always expressed in megabytes; a bare number is interpreted as MB
+ * and both "." and "," are accepted as the decimal separator. Any other unit
+ * (KB, GB, …) is rejected. Returns null when the input cannot be parsed.
+ */
+export function parseSizeInput(input: string): number | null {
+  const match = /^(\d+(?:[.,]\d+)?)\s*([a-zA-Z]*)$/.exec(input.trim());
+  if (!match) return null;
+  const [, numberPart, unitRaw] = match;
+  const value = Number(numberPart.replace(',', '.'));
+  if (!Number.isFinite(value) || value < 0) return null;
+  const unit = unitRaw.toLowerCase();
+  if (unit !== '' && unit !== 'm' && unit !== 'mb' && unit !== 'mib') return null;
+  return Math.round(value * MB);
+}
+
+// ── Date parsing ─────────────────────────────────────────────────────────────
+
+export interface ParseDateOptions {
+  /**
+   * Whether an ambiguous `A/B/YYYY` value (both parts ≤ 12) should be read as
+   * day-first (European) rather than month-first (US). Defaults to true.
+   */
+  preferDayFirst?: boolean;
+}
+
+const DATE_PART_RE = /^(?:(\d{1,4})([./-]))?(\d{1,2})\2?(\d{1,4})$/;
+
+/**
+ * Parse a date string into a local `Date`, accepting:
+ *   • ISO / year-first: 2026-08-17, 2026/08/17, 2026.08.17
+ *   • European:         17.08.2026, 17/08/2026, 17-08-2026
+ *   • US:               08/17/2026, 08-17-2026
+ * An optional time component (` HH:mm` or `THH:mm`) is also accepted.
+ * Returns null when the value is not a valid date.
+ */
+export function parseDateInput(input: string, options: ParseDateOptions = {}): Date | null {
+  const trimmed = input.trim();
+  const parts = trimmed.split(/[T ]/);
+  if (parts.length === 0 || parts.length > 2) return null;
+  const datePart = parts[0];
+  const timePart = parts[1];
+
+  const groups = DATE_PART_RE.exec(datePart);
+  if (!groups) return null;
+
+  let year: number;
+  let month: number;
+  let day: number;
+
+  if (groups[1] !== undefined && groups[1].length === 4) {
+    // YYYY-…-…
+    year = Number(groups[1]);
+    month = Number(groups[3]);
+    day = Number(groups[4]);
+  } else {
+    const a = Number(groups[1] ?? groups[3]);
+    const b = Number(groups[3]);
+    if (groups[4].length !== 4) return null;
+    year = Number(groups[4]);
+
+    // Determine day/month order. Non-numeric grouping cannot occur: the regex
+    // guarantees three numeric components, with a separator between them.
+    if (a > 12 && b <= 12) {
+      // First component must be the day.
+      day = a;
+      month = b;
+    } else if (a <= 12 && b > 12) {
+      // Second component must be the day; first is the month (US style).
+      day = b;
+      month = a;
+    } else {
+      // Ambiguous — honour the caller's preference (day-first by default).
+      if (options.preferDayFirst !== false) {
+        day = a;
+        month = b;
+      } else {
+        day = b;
+        month = a;
+      }
+    }
+  }
+
+  if (!Number.isInteger(month) || month < 1 || month > 12) return null;
+  if (!Number.isInteger(day) || day < 1 || day > 31) return null;
+  if (year < 1) return null;
+
+  let hours = 0;
+  let minutes = 0;
+  let seconds = 0;
+  if (timePart !== undefined) {
+    const timeMatch = /^(\d{1,2}):(\d{2})(?::(\d{2}))?$/.exec(timePart);
+    if (timeMatch === null) return null;
+    hours = Number(timeMatch[1]);
+    minutes = Number(timeMatch[2]);
+    seconds = timeMatch[3] === undefined ? 0 : Number(timeMatch[3]);
+    if (hours > 23 || minutes > 59 || seconds > 59) return null;
+  }
+
+  const parsed = new Date(year, month - 1, day, hours, minutes, seconds, 0);
+  // Reject invalid calendar dates such as 30 February.
+  if (
+    parsed.getFullYear() !== year ||
+    parsed.getMonth() !== month - 1 ||
+    parsed.getDate() !== day
+  ) {
+    return null;
+  }
+  return parsed;
+}
+
+/** Format a Date as an ISO-style date string (YYYY-MM-DD, local time). */
+export function formatDateValue(date: Date): string {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, '0');
+  const day = String(date.getDate()).padStart(2, '0');
+  return `${year}-${month}-${day}`;
+}
+
+// ── Serialisation ────────────────────────────────────────────────────────────
+
+/** Serialise a filter to a single `filter=` query parameter value. */
+export function serializeFilter(spec: SearchFilterSpec): string {
+  return `${spec.field}${spec.operator}${spec.value}`;
+}
+
+/** Parse a `filter=<field><operator><value>` query parameter value. */
+export function parseFilterParam(raw: string): SearchFilterSpec | null {
+  const match = /^(date|size)([><=])(.+)$/.exec(raw);
+  if (!match) return null;
+  return {
+    field: match[1] as SearchFilterField,
+    operator: match[2] as SearchFilterOperator,
+    value: match[3]
+  };
+}
+
+// ── Per-field parsing helpers ────────────────────────────────────────────────
+
+/** Parse the value of a size filter into bytes (null when invalid). */
+export function parseSizeFilterValue(spec: Pick<SearchFilterSpec, 'value'>): number | null {
+  return parseSizeInput(spec.value);
+}
+
+/** Parse the value of a date filter into a Date (null when invalid). */
+export function parseDateFilterValue(
+  spec: Pick<SearchFilterSpec, 'value'>,
+  options?: ParseDateOptions
+): Date | null {
+  return parseDateInput(spec.value, options);
+}
+
+/**
+ * True when the filter has a typed value that actually filters something
+ * without being flagged as invalid in the UI.
+ */
+export function isUsableFilter(spec: SearchFilterSpec): boolean {
+  return spec.field === 'size'
+    ? parseSizeFilterValue(spec) !== null
+    : parseDateFilterValue(spec) !== null;
+}
+
+// ── Matching ─────────────────────────────────────────────────────────────────
+
+function compareSize(actual: number, target: number, operator: SearchFilterOperator): boolean {
+  if (operator === '>') return actual > target;
+  if (operator === '<') return actual < target;
+  return actual === target;
+}
+
+/**
+ * Compile a list of filter specifications into a single predicate. All
+ * specified filters must match (logical AND). Filters whose value is empty or
+ * cannot be parsed are skipped, so callers may pass user-provided rows freely.
+ * As soon as a usable size filter is present, directories are excluded: folder
+ * entries have no well-defined size and must not satisfy size constraints.
+ */
+export function compileFilterPredicates(
+  specs: SearchFilterSpec[]
+): (item: FilterableItem) => boolean {
+  const predicates: Array<(item: FilterableItem) => boolean> = [];
+  let hasSizeFilter = false;
+
+  for (const spec of specs) {
+    if (spec.field === 'size') {
+      const target = parseSizeFilterValue(spec);
+      if (target === null) continue;
+      hasSizeFilter = true;
+      predicates.push((item) => compareSize(item.size, target, spec.operator));
+      continue;
+    }
+    const date = parseDateFilterValue(spec);
+    if (date === null) continue;
+    const start = new Date(date);
+    start.setHours(0, 0, 0, 0);
+    const end = new Date(start);
+    end.setDate(end.getDate() + 1);
+    const startTime = start.getTime();
+    const endTime = end.getTime();
+    const { operator } = spec;
+    predicates.push((item) => {
+      const time = item.lastModified.getTime();
+      if (operator === '=') return time >= startTime && time < endTime;
+      if (operator === '>') return time >= endTime;
+      return time < startTime;
+    });
+  }
+
+  if (hasSizeFilter) {
+    predicates.push((item) => item.isDirectory !== true);
+  }
+
+  if (predicates.length === 0) return () => true;
+  return (item) => predicates.every((predicate) => predicate(item));
+}
diff --git a/src/lib/storage/search-regex.spec.ts b/src/lib/storage/search-regex.spec.ts
new file mode 100644
index 00000000..d5b0c451
--- /dev/null
+++ b/src/lib/storage/search-regex.spec.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { createSafeSearchRegex, UnsafeSearchRegexError } from './search-regex.js';
+
+describe('createSafeSearchRegex', () => {
+  it('creates a case-insensitive regex for safe patterns', () => {
+    expect(createSafeSearchRegex('report-[0-9]+').test('REPORT-2026')).toBe(true);
+  });
+
+  it.each(['(a+)+$', '(a|aa)+$', 'a*a*', '(?<x>a)\\k<x>', '(?=a)a'])(
+    'rejects potentially expensive pattern %s',
+    (pattern) => {
+      expect(() => createSafeSearchRegex(pattern)).toThrow(UnsafeSearchRegexError);
+    }
+  );
+
+  it('rejects invalid syntax and overly long patterns', () => {
+    expect(() => createSafeSearchRegex('[')).toThrow(UnsafeSearchRegexError);
+    expect(() => createSafeSearchRegex('a'.repeat(513))).toThrow(UnsafeSearchRegexError);
+  });
+});
diff --git a/src/lib/storage/search-regex.ts b/src/lib/storage/search-regex.ts
new file mode 100644
index 00000000..879cf455
--- /dev/null
+++ b/src/lib/storage/search-regex.ts
@@ -0,0 +1,103 @@
+import { RegExpParser } from 'regexpp';
+import type { AST } from 'regexpp';
+
+const MAX_PATTERN_LENGTH = 512;
+const MAX_AST_NODES = 200;
+const MAX_REPEAT = 1_000;
+
+export class UnsafeSearchRegexError extends Error {}
+
+/**
+ * Parse and constrain regexes before handing them to the JavaScript regex engine.
+ * The policy excludes constructs that can cause catastrophic backtracking.
+ */
+export function createSafeSearchRegex(pattern: string): RegExp {
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    throw new UnsafeSearchRegexError('Regular expression must not exceed 512 characters');
+  }
+
+  let ast: AST.Pattern;
+  try {
+    ast = new RegExpParser({ ecmaVersion: 2022 }).parsePattern(pattern);
+  } catch {
+    throw new UnsafeSearchRegexError('Regular expression is invalid');
+  }
+
+  if (countNodes(ast) > MAX_AST_NODES) {
+    throw new UnsafeSearchRegexError('Regular expression is too complex');
+  }
+  assertSafe(ast);
+
+  try {
+    return new RegExp(pattern, 'i');
+  } catch {
+    throw new UnsafeSearchRegexError('Regular expression is invalid');
+  }
+}
+
+function assertSafe(node: AST.Node): void {
+  if (node.type === 'Backreference') {
+    throw new UnsafeSearchRegexError('Regular expression backreferences are not supported');
+  }
+  if (node.type === 'Assertion' && (node.kind === 'lookahead' || node.kind === 'lookbehind')) {
+    throw new UnsafeSearchRegexError('Regular expression lookarounds are not supported');
+  }
+  if (node.type === 'Quantifier') {
+    if (node.max !== Infinity && node.max > MAX_REPEAT) {
+      throw new UnsafeSearchRegexError('Regular expression repeat count is too large');
+    }
+    if (containsQuantifier(node.element)) {
+      throw new UnsafeSearchRegexError('Nested regular expression repetitions are not supported');
+    }
+    if (node.max === Infinity && isAlternatingGroup(node.element)) {
+      throw new UnsafeSearchRegexError('Unbounded repetitions of alternatives are not supported');
+    }
+  }
+  if (node.type === 'Alternative' && countUnboundedQuantifiers(node) > 1) {
+    throw new UnsafeSearchRegexError(
+      'Multiple unbounded regular expression repetitions are not supported'
+    );
+  }
+
+  for (const child of childrenOf(node)) assertSafe(child);
+}
+
+function containsQuantifier(node: AST.Node): boolean {
+  if (node.type === 'Quantifier') return true;
+  return childrenOf(node).some(containsQuantifier);
+}
+
+function isAlternatingGroup(node: AST.QuantifiableElement): boolean {
+  return (node.type === 'Group' || node.type === 'CapturingGroup') && node.alternatives.length > 1;
+}
+
+function countUnboundedQuantifiers(node: AST.Alternative): number {
+  return node.elements.filter(
+    (element) => element.type === 'Quantifier' && element.max === Infinity
+  ).length;
+}
+
+function countNodes(node: AST.Node): number {
+  return 1 + childrenOf(node).reduce((total, child) => total + countNodes(child), 0);
+}
+
+function childrenOf(node: AST.Node): AST.Node[] {
+  switch (node.type) {
+    case 'Pattern':
+    case 'Group':
+    case 'CapturingGroup':
+      return node.alternatives;
+    case 'Alternative':
+      return node.elements;
+    case 'Quantifier':
+      return [node.element];
+    case 'CharacterClass':
+      return node.elements;
+    case 'CharacterClassRange':
+      return [node.min, node.max];
+    case 'Assertion':
+      return 'alternatives' in node ? node.alternatives : [];
+    default:
+      return [];
+  }
+}
diff --git a/src/lib/storage/search-stream.spec.ts b/src/lib/storage/search-stream.spec.ts
new file mode 100644
index 00000000..7c1297d8
--- /dev/null
+++ b/src/lib/storage/search-stream.spec.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it, vi } from 'vitest';
+import { readSearchStream } from './search-stream.js';
+import { StorageError } from './errors.js';
+
+function createStream(events: object[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const event of events) controller.enqueue(encoder.encode(JSON.stringify(event) + '\n'));
+      controller.close();
+    }
+  });
+}
+
+describe('readSearchStream', () => {
+  it('applies incremental batches and replaces them with snapshots', async () => {
+    const onUpdate = vi.fn();
+    const result = await readSearchStream(
+      createStream([
+        {
+          type: 'batch',
+          results: [{ key: 'old.txt', size: 1, lastModified: '2026-01-01', isDirectory: false }]
+        },
+        {
+          type: 'snapshot',
+          results: [{ key: 'new.txt', size: 2, lastModified: '2026-01-02', isDirectory: false }]
+        },
+        { type: 'complete', results: [] }
+      ]),
+      onUpdate
+    );
+
+    expect(onUpdate).toHaveBeenNthCalledWith(2, {
+      snapshot: true,
+      results: [expect.objectContaining({ key: 'new.txt', lastModified: expect.any(Date) })]
+    });
+    expect(result).toEqual({ results: [] });
+  });
+
+  it('throws a streamed error', async () => {
+    await expect(
+      readSearchStream(createStream([{ type: 'error', message: 'Failed' }]))
+    ).rejects.toThrow('Failed');
+  });
+
+  it('preserves a streamed error classification', async () => {
+    await expect(
+      readSearchStream(createStream([{ type: 'error', code: 'access_denied', message: 'Denied' }]))
+    ).rejects.toMatchObject(new StorageError('access_denied', 'Denied'));
+  });
+});
diff --git a/src/lib/storage/search-stream.ts b/src/lib/storage/search-stream.ts
new file mode 100644
index 00000000..73c652b2
--- /dev/null
+++ b/src/lib/storage/search-stream.ts
@@ -0,0 +1,55 @@
+import type { SearchResultItem, StorageSearchResponse, StorageSearchUpdate } from './types.js';
+import { StorageError, type StorageErrorCode } from './errors.js';
+
+interface SearchStreamEvent {
+  type: 'batch' | 'snapshot' | 'complete' | 'error';
+  results?: SearchResultItem[];
+  code?: StorageErrorCode;
+  message?: string;
+}
+
+export async function readSearchStream(
+  stream: ReadableStream<Uint8Array> | null,
+  onUpdate?: (update: StorageSearchUpdate) => void
+): Promise<StorageSearchResponse> {
+  if (!stream) throw new Error('Search response did not include a body');
+
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  const results = new Map<string, SearchResultItem>();
+  let buffer = '';
+
+  const apply = (event: SearchStreamEvent, snapshot: boolean): void => {
+    const eventResults = (event.results ?? []).map((result) => ({
+      ...result,
+      lastModified: new Date(result.lastModified)
+    }));
+    if (snapshot) results.clear();
+    for (const result of eventResults) results.set(result.key, result);
+    onUpdate?.({ results: [...results.values()], snapshot });
+  };
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split('\n');
+      buffer = lines.pop() ?? '';
+
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        const event = JSON.parse(line) as SearchStreamEvent;
+        if (event.type === 'error') {
+          throw new StorageError(event.code ?? 'unknown', event.message ?? 'Search failed');
+        }
+        if (event.type === 'batch') apply(event, false);
+        if (event.type === 'snapshot' || event.type === 'complete') apply(event, true);
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+
+  return { results: [...results.values()] };
+}
diff --git a/src/lib/storage/search.svelte.spec.ts b/src/lib/storage/search.svelte.spec.ts
new file mode 100644
index 00000000..c19c9dbe
--- /dev/null
+++ b/src/lib/storage/search.svelte.spec.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it } from 'vitest';
+import { StorageSearchState } from './search.svelte.js';
+import { createMemoryStorageApi } from './api.test-utils.js';
+import type { StorageSearchUpdate } from './types.js';
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((resolvePromise) => {
+    resolve = resolvePromise;
+  });
+  return { promise, resolve };
+}
+
+describe('StorageSearchState', () => {
+  it('adds streamed matches before the search completes', async () => {
+    const response = deferred<{ results: [] }>();
+    const api = createMemoryStorageApi({
+      async search({ onUpdate }) {
+        onUpdate?.({
+          snapshot: false,
+          results: [
+            {
+              key: 'report.csv',
+              size: 10,
+              lastModified: new Date('2026-01-01'),
+              isDirectory: false
+            }
+          ]
+        } satisfies StorageSearchUpdate);
+        return response.promise;
+      }
+    });
+    const state = new StorageSearchState({
+      api,
+      getBuckets: () => ['documents'],
+      getCurrentBucket: () => 'documents'
+    });
+    state.updateSession('s1', { query: 'report' });
+
+    const running = state.run('s1');
+
+    expect(state.active?.results).toEqual([expect.objectContaining({ bucket: 'documents' })]);
+    expect(state.active?.status).toBe('running');
+
+    response.resolve({ results: [] });
+    await running;
+  });
+
+  it('keeps streamed matches when a running search is cancelled', async () => {
+    const response = deferred<{ results: [] }>();
+    const api = createMemoryStorageApi({
+      async search({ onUpdate }) {
+        onUpdate?.({
+          snapshot: false,
+          results: [
+            {
+              key: 'report.csv',
+              size: 10,
+              lastModified: new Date('2026-01-01'),
+              isDirectory: false
+            }
+          ]
+        });
+        return response.promise;
+      }
+    });
+    const state = new StorageSearchState({
+      api,
+      getBuckets: () => ['documents'],
+      getCurrentBucket: () => 'documents'
+    });
+    state.updateSession('s1', { query: 'report' });
+
+    void state.run('s1');
+    state.cancel('s1');
+
+    expect(state.active?.status).toBe('done');
+    expect(state.active?.results).toEqual([expect.objectContaining({ key: 'report.csv' })]);
+  });
+});
diff --git a/src/lib/storage/search.svelte.ts b/src/lib/storage/search.svelte.ts
new file mode 100644
index 00000000..8213f8e3
--- /dev/null
+++ b/src/lib/storage/search.svelte.ts
@@ -0,0 +1,353 @@
+import { SvelteMap } from 'svelte/reactivity';
+import * as m from '$lib/paraglide/messages.js';
+import {
+  isUsableFilter,
+  type SearchFilter,
+  type SearchFilterField
+} from '$lib/storage/search-filter.js';
+import type { StorageApi } from '$lib/storage/api.js';
+import { StorageError } from '$lib/storage/errors.js';
+import type { RecentSearchEntry, SearchResultItem } from '$lib/storage/types.js';
+
+export type SearchStatus = 'idle' | 'running' | 'done' | 'error';
+
+export interface SearchResult extends SearchResultItem {
+  bucket: string;
+}
+
+export interface SearchFailure {
+  code: string;
+}
+
+export interface SearchSession {
+  id: string;
+  label: string;
+  query: string;
+  selectedBuckets: string[];
+  useRegex: boolean;
+  excludePatterns: string[];
+  searchPath: string;
+  maxDepth: number | undefined;
+  filters: SearchFilter[];
+  results: SearchResult[];
+  status: SearchStatus;
+  elapsed: number;
+  failures: SearchFailure[];
+}
+
+export class StorageSearchState {
+  private sessionCounter = 1;
+  private filterCounter = 0;
+  private controllers = new SvelteMap<string, AbortController>();
+  private started = new SvelteMap<string, number>();
+  private readonly api: StorageApi;
+  private readonly getBuckets: () => string[];
+  private readonly getCurrentBucket: () => string | undefined;
+
+  sessions = $state<SearchSession[]>([]);
+  activeId = $state('s1');
+  excludeInput = $state('');
+  advancedOpen = $state(false);
+  history = $state<RecentSearchEntry[]>([]);
+  active = $derived(this.sessions.find((session) => session.id === this.activeId));
+  runningCount = $derived(this.sessions.filter((session) => session.status === 'running').length);
+  completedCount = $derived(this.sessions.filter((session) => session.status === 'done').length);
+  partialCount = $derived(
+    this.sessions.filter((session) => session.status === 'done' && session.failures.length > 0)
+      .length
+  );
+
+  constructor(options: {
+    api: StorageApi;
+    getBuckets: () => string[];
+    getCurrentBucket: () => string | undefined;
+  }) {
+    this.api = options.api;
+    this.getBuckets = options.getBuckets;
+    this.getCurrentBucket = options.getCurrentBucket;
+    this.sessions = [this.makeSession('s1', this.sessionCounter)];
+  }
+
+  close(): void {
+    for (const controller of this.controllers.values()) controller.abort();
+    this.controllers.clear();
+  }
+
+  async open(): Promise<void> {
+    this.history = await this.loadHistory();
+  }
+
+  private async loadHistory(): Promise<RecentSearchEntry[]> {
+    try {
+      return await this.api.listRecentSearches();
+    } catch {
+      return [];
+    }
+  }
+
+  async refreshHistory(): Promise<void> {
+    this.history = await this.loadHistory();
+  }
+
+  async clearHistory(): Promise<void> {
+    try {
+      await this.api.clearRecentSearches();
+      this.history = [];
+    } catch {
+      // Clearing history is non-essential; the list simply stays as is.
+    }
+  }
+
+  useRecentEntry(entry: RecentSearchEntry, buckets?: string[]): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, {
+      query: entry.query,
+      selectedBuckets: buckets && buckets.length > 0 ? buckets : entry.buckets,
+      useRegex: entry.useRegex,
+      excludePatterns: entry.excludePatterns,
+      searchPath: entry.searchPath,
+      maxDepth: entry.maxDepth ?? undefined,
+      results: [],
+      status: 'idle',
+      elapsed: 0,
+      failures: []
+    });
+  }
+
+  addSession(): void {
+    this.sessionCounter += 1;
+    const id = `s${Date.now()}`;
+    this.sessions = [...this.sessions, this.makeSession(id, this.sessionCounter)];
+    this.activeId = id;
+    this.excludeInput = '';
+    this.advancedOpen = false;
+  }
+
+  removeSession(id: string): void {
+    this.controllers.get(id)?.abort();
+    this.controllers.delete(id);
+    const remaining = this.sessions.filter((session) => session.id !== id);
+    if (remaining.length === 0) {
+      this.sessionCounter += 1;
+      const session = this.makeSession(`s${Date.now()}`, this.sessionCounter);
+      this.sessions = [session];
+      this.activeId = session.id;
+      return;
+    }
+    this.sessions = remaining;
+    if (this.activeId === id) this.activeId = remaining.at(-1)!.id;
+  }
+
+  addExcludePattern(): void {
+    const active = this.active;
+    if (!active) return;
+    const pattern = this.excludeInput.trim();
+    if (pattern && !active.excludePatterns.includes(pattern)) {
+      this.updateSession(active.id, { excludePatterns: [...active.excludePatterns, pattern] });
+    }
+    this.excludeInput = '';
+  }
+
+  toggleBucket(bucket: string): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, {
+      selectedBuckets: active.selectedBuckets.includes(bucket)
+        ? active.selectedBuckets.filter((item) => item !== bucket)
+        : [...active.selectedBuckets, bucket]
+    });
+  }
+
+  setBucketScope(buckets: string[]): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, { selectedBuckets: buckets });
+  }
+
+  private newFilterId(): string {
+    this.filterCounter += 1;
+    return `f${this.filterCounter}`;
+  }
+
+  addFilter(field: SearchFilterField = 'date'): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, {
+      filters: [...active.filters, { id: this.newFilterId(), field, operator: '>', value: '' }]
+    });
+  }
+
+  removeFilter(id: string): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, {
+      filters: active.filters.filter((filter) => filter.id !== id)
+    });
+  }
+
+  updateFilter(id: string, patch: Partial<SearchFilter>): void {
+    const active = this.active;
+    if (!active) return;
+    this.updateSession(active.id, {
+      filters: active.filters.map((filter) => (filter.id === id ? { ...filter, ...patch } : filter))
+    });
+  }
+
+  updateSession(id: string, patch: Partial<SearchSession>): void {
+    this.sessions = this.sessions.map((session) =>
+      session.id === id ? { ...session, ...patch } : session
+    );
+  }
+
+  async run(id: string): Promise<void> {
+    const session = this.sessions.find((item) => item.id === id);
+    if (!session || !session.query.trim()) return;
+
+    const buckets =
+      session.selectedBuckets.length > 0 ? session.selectedBuckets : this.getBuckets();
+
+    // Record the submitted search in the per-connection history as a single
+    // grouped entry covering all searched buckets. Fire-and-forget: history is
+    // non-essential, so failures are swallowed and the list is refreshed once
+    // the record has settled.
+    const trimmedQuery = session.query.trim();
+    const recordPromise = this.api
+      .recordRecentSearch({
+        buckets,
+        query: trimmedQuery,
+        useRegex: session.useRegex,
+        excludePatterns: session.excludePatterns,
+        searchPath: session.searchPath,
+        maxDepth: session.maxDepth
+      })
+      .catch(() => undefined);
+    void Promise.allSettled([recordPromise]).then(() => this.refreshHistory());
+
+    this.controllers.get(id)?.abort();
+    const controller = new AbortController();
+    this.controllers.set(id, controller);
+    this.updateSession(id, {
+      status: 'running',
+      results: [],
+      elapsed: 0,
+      failures: []
+    });
+    const started = performance.now();
+    this.started.set(id, started);
+
+    try {
+      const responses = await Promise.allSettled(
+        buckets.map((bucket) =>
+          this.api
+            .search({
+              bucket,
+              query: trimmedQuery,
+              prefix: session.searchPath,
+              maxDepth: session.maxDepth,
+              useRegex: session.useRegex,
+              excludePatterns: session.excludePatterns,
+              filters: session.filters
+                .filter((filter) => filter.value.trim() !== '')
+                .filter(isUsableFilter)
+                .map(({ field, operator, value }) => ({ field, operator, value })),
+              signal: controller.signal,
+              onUpdate: (update) => {
+                if (this.controllers.get(id) !== controller || controller.signal.aborted) return;
+                const results = update.results
+                  .filter((result) => this.matches(session, result))
+                  .map((result) => ({ ...result, bucket }));
+                const current = this.sessions.find((item) => item.id === id);
+                if (!current) return;
+                this.updateSession(id, {
+                  results: [
+                    ...current.results.filter((result) => result.bucket !== bucket),
+                    ...results
+                  ]
+                });
+              }
+            })
+            .then((response) => ({ bucket, ...response }))
+        )
+      );
+      if (controller.signal.aborted) return;
+      const successfulResponses = responses
+        .filter((response) => response.status === 'fulfilled')
+        .map((response) => response.value);
+      const failures: SearchFailure[] = responses.flatMap((response) => {
+        if (response.status !== 'rejected') return [];
+        return [
+          { code: response.reason instanceof StorageError ? response.reason.code : 'unknown' }
+        ];
+      });
+      const current = this.sessions.find((item) => item.id === id);
+      if (!current) return;
+      const results = successfulResponses.reduce(
+        (accumulated, { bucket, results }) => [
+          ...accumulated.filter((result) => result.bucket !== bucket),
+          ...results
+            .filter((result) => this.matches(session, result))
+            .map((result) => ({ ...result, bucket }))
+        ],
+        current.results
+      );
+      this.updateSession(id, {
+        status: successfulResponses.length > 0 ? 'done' : 'error',
+        results,
+        elapsed: Math.round(performance.now() - started),
+        failures
+      });
+    } catch (error) {
+      if (!(error instanceof DOMException && error.name === 'AbortError')) {
+        this.updateSession(id, {
+          status: 'error',
+          elapsed: Math.round(performance.now() - started)
+        });
+      }
+    } finally {
+      if (this.controllers.get(id) === controller) this.controllers.delete(id);
+      this.started.delete(id);
+    }
+  }
+
+  cancel(id: string): void {
+    const session = this.sessions.find((item) => item.id === id);
+    if (!session || session.status !== 'running') return;
+    this.controllers.get(id)?.abort();
+    const startedAt = this.started.get(id);
+    const elapsed = startedAt === undefined ? 0 : Math.round(performance.now() - startedAt);
+    this.updateSession(id, { status: session.results.length > 0 ? 'done' : 'idle', elapsed });
+  }
+
+  private makeSession(id: string, number: number): SearchSession {
+    return {
+      id,
+      label: m.storage_search_session_label({ number }),
+      query: '',
+      selectedBuckets: this.getCurrentBucket() ? [this.getCurrentBucket()!] : [],
+      useRegex: false,
+      excludePatterns: [],
+      searchPath: '',
+      maxDepth: undefined,
+      filters: [
+        { id: this.newFilterId(), field: 'date', operator: '>', value: '' },
+        { id: this.newFilterId(), field: 'size', operator: '>', value: '' }
+      ],
+      results: [],
+      status: 'idle',
+      elapsed: 0,
+      failures: []
+    };
+  }
+
+  private matches(session: SearchSession, result: SearchResultItem): boolean {
+    if (session.excludePatterns.some((pattern) => result.key.includes(pattern))) return false;
+    if (!session.useRegex) return true;
+    try {
+      // eslint-disable-next-line security/detect-non-literal-regexp -- useRegex is an opt-in feature; invalid patterns are caught below
+      return new RegExp(session.query, 'i').test(result.key);
+    } catch {
+      return false;
+    }
+  }
+}
diff --git a/src/lib/storage/state.svelte.spec.ts b/src/lib/storage/state.svelte.spec.ts
index 264f304e..f889c47c 100644
--- a/src/lib/storage/state.svelte.spec.ts
+++ b/src/lib/storage/state.svelte.spec.ts
@@ -24,15 +24,29 @@ vi.mock('$app/navigation', () => ({
   invalidateAll: vi.fn()
 }));
 
+vi.mock('$lib/storage/download.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('$lib/storage/download.js')>();
+  return {
+    ...actual,
+    startDownload: vi.fn(),
+    triggerManifestDownloads: vi.fn()
+  };
+});
+
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { SvelteSet } from 'svelte/reactivity';
 import { StorageState } from './state.svelte.js';
 import type { StorageObject, StoragePage } from './types.js';
-import type { StorageApi, CopyMoveResult, DeleteResult } from './api.js';
+import type { StorageApi, CopyMoveResult, DeleteResult, DownloadHistoryEntry } from './api.js';
 import type { FileDetails, DirectoryMetadata, BucketDetails } from './details-types.js';
 import { StorageError } from './errors.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { invalidateAll } from '$app/navigation';
+import {
+  estimateArchiveSize,
+  startDownload,
+  triggerManifestDownloads
+} from '$lib/storage/download.js';
 
 function makeObjects(): StorageObject[] {
   return [
@@ -81,6 +95,14 @@ function makeApi(overrides?: Partial<StorageApi>): StorageApi {
     async list() {
       return makePage();
     },
+    async search() {
+      return { results: [] };
+    },
+    async listRecentSearches() {
+      return [];
+    },
+    async recordRecentSearch() {},
+    async clearRecentSearches() {},
     async copy(): Promise<CopyMoveResult> {
       return { results: [], failed: 0 };
     },
@@ -101,6 +123,21 @@ function makeApi(overrides?: Partial<StorageApi>): StorageApi {
     async pollJob() {
       return { status: 'done' };
     },
+    async cancelJob() {},
+    async createDownloadManifest() {
+      return {
+        id: 'download-manifest',
+        files: [],
+        expiresAt: new Date().toISOString()
+      };
+    },
+    async listDownloadHistory() {
+      return [];
+    },
+    async clearDownloadHistory() {},
+    async recreateDownloadManifest() {
+      return { id: 'download-manifest', files: [], expiresAt: new Date().toISOString() };
+    },
     async checkObjectExists() {
       return false;
     },
@@ -157,10 +194,6 @@ beforeEach(() => {
   vi.clearAllMocks();
 });
 
-// ────────────────────────────────────────────────────────────────────────────
-// executeAction – cut
-// ────────────────────────────────────────────────────────────────────────────
-
 describe('executeAction("cut")', () => {
   it('sets clipboard with action="cut" and selected keys', async () => {
     const state = makeState();
@@ -202,10 +235,6 @@ describe('executeAction("cut")', () => {
   });
 });
 
-// ────────────────────────────────────────────────────────────────────────────
-// executeAction – copy
-// ────────────────────────────────────────────────────────────────────────────
-
 describe('executeAction("copy")', () => {
   it('sets clipboard with action="copy" and selected keys', async () => {
     const state = makeState();
@@ -236,10 +265,6 @@ describe('executeAction("copy")', () => {
   });
 });
 
-// ────────────────────────────────────────────────────────────────────────────
-// isCutKey
-// ────────────────────────────────────────────────────────────────────────────
-
 describe('isCutKey', () => {
   it('returns true when key is in clipboard with cut action and matching bucket', () => {
     const state = makeState();
@@ -302,10 +327,6 @@ describe('isCutKey', () => {
   });
 });
 
-// ────────────────────────────────────────────────────────────────────────────
-// executeAction – paste
-// ────────────────────────────────────────────────────────────────────────────
-
 describe('executeAction("paste")', () => {
   it('shows warning when inside an archive', async () => {
     const state = makeState();
@@ -700,6 +721,25 @@ describe('handleKeydown', () => {
     expect(addToast).not.toHaveBeenCalled();
   });
 
+  it('does not handle Ctrl+A from an open dialog', () => {
+    const state = makeState();
+    const dialog = document.createElement('dialog');
+    const input = document.createElement('input');
+    dialog.setAttribute('open', '');
+    dialog.appendChild(input);
+    document.body.appendChild(dialog);
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    const event = new KeyboardEvent('keydown', { key: 'a', ctrlKey: true, bubbles: true });
+    input.dispatchEvent(event);
+    state.handleKeydown(event);
+
+    expect(event.defaultPrevented).toBe(false);
+    expect(state.selectedKeys).toEqual(new SvelteSet(['file.txt']));
+
+    dialog.remove();
+  });
+
   it('F2 triggers rename when one item is selected', () => {
     const state = makeState();
     state.selectedKeys = new SvelteSet<string>(['file.txt']);
@@ -796,3 +836,159 @@ describe('performDelete clipboard cleanup', () => {
     expect(state.clipboard!.keys).toEqual(['file.txt']);
   });
 });
+
+// ────────────────────────────────────────────────────────────────────────────
+// executeAction – download (archive size estimation)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('executeAction("download")', () => {
+  it('starts an operation with an estimated archive size, then refines it from the manifest', async () => {
+    let resolveStartDownload!: (value: {
+      id: string;
+      fileCount: number;
+      totalBytes: number;
+      jobIds: string[];
+    }) => void;
+    vi.mocked(startDownload).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          resolveStartDownload = resolve;
+        })
+    );
+    let resolveHistoryFn!: (entries: DownloadHistoryEntry[]) => void;
+    const state = makeState({
+      listDownloadHistory: () =>
+        new Promise((resolve) => {
+          resolveHistoryFn = resolve;
+        })
+    });
+    state.connectionId = 'test-connection-id';
+    state.selectionMode = true;
+    state.selectedKeys = new SvelteSet(['dir/', 'file.txt', 'photo.jpg', 'nested/file.js']);
+
+    const promise = state.executeAction('download');
+    await vi.waitFor(() => expect(state.operations).toHaveLength(1));
+
+    const op = state.operations[0]!;
+    const downloadItems = [
+      { key: 'dir/', size: 0, isDirectory: true },
+      { key: 'file.txt', size: 100, isDirectory: false },
+      { key: 'photo.jpg', size: 500, isDirectory: false },
+      { key: 'nested/file.js', size: 200, isDirectory: false }
+    ];
+    expect(op.type).toBe('download');
+    expect(op.totalBytes).toBe(estimateArchiveSize(downloadItems));
+
+    resolveStartDownload({
+      id: 'download-manifest',
+      fileCount: 1,
+      totalBytes: 900,
+      jobIds: ['download-job-1']
+    });
+    await vi.waitFor(() => expect(state.operations[0]?.totalBytes).toBe(900));
+
+    resolveHistoryFn([]);
+    await promise;
+
+    expect(state.operations).toHaveLength(1);
+    expect(state.operations[0]).toMatchObject({
+      status: 'running',
+      fileJobIds: ['download-job-1']
+    });
+  });
+
+  it('marks the operation as failed when the download cannot be started', async () => {
+    vi.mocked(startDownload).mockRejectedValueOnce(new StorageError('server_error', 'Boom'));
+    const state = makeState();
+    state.selectionMode = true;
+    state.selectedKeys = new SvelteSet(['file.txt', 'photo.jpg']);
+
+    await state.executeAction('download');
+
+    expect(state.operations).toHaveLength(1);
+    expect(state.operations[0]?.status).toBe('error');
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// redownloadHistory
+// ────────────────────────────────────────────────────────────────────────────
+
+function makeHistoryEntry(): DownloadHistoryEntry {
+  return {
+    id: 'manifest-1',
+    bucket: 'test-bucket',
+    connectionId: 'test-connection-id',
+    entries: [
+      { key: 'a.txt', size: 1000, isDirectory: false },
+      { key: 'b.txt', size: 2000, isDirectory: false },
+      { key: 'c.txt', size: 4000, isDirectory: false }
+    ],
+    archive: true,
+    archiveFilename: 'test-bucket.zip',
+    createdAt: new Date().toISOString(),
+    expiresAt: new Date(Date.now() + 86_400_000).toISOString()
+  };
+}
+
+describe('redownloadHistory', () => {
+  beforeEach(() => {
+    vi.mocked(triggerManifestDownloads).mockResolvedValue(['download-job-1']);
+  });
+
+  it('tracks an operation with the estimated size of the selected entries', async () => {
+    const recreateSpy = vi.fn().mockResolvedValue({
+      id: 'manifest-2',
+      files: [{ filename: 'selection.zip', size: 3000, part: 1 }],
+      expiresAt: new Date().toISOString()
+    });
+    const state = makeState({ recreateDownloadManifest: recreateSpy });
+    state.downloadHistory = [makeHistoryEntry()];
+
+    await state.redownloadHistory('manifest-1', ['a.txt', 'b.txt']);
+
+    expect(recreateSpy).toHaveBeenCalledWith('manifest-1', ['a.txt', 'b.txt']);
+    expect(triggerManifestDownloads).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: 'manifest-2',
+        files: [{ filename: 'selection.zip', size: 3000, part: 1 }]
+      })
+    );
+    expect(state.operations).toHaveLength(1);
+    expect(state.operations[0]).toMatchObject({
+      status: 'running',
+      fileJobIds: ['download-job-1']
+    });
+  });
+
+  it('marks the operation as failed and drops vanished history entries', async () => {
+    const state = makeState({
+      recreateDownloadManifest: vi
+        .fn()
+        .mockRejectedValue(new StorageError('not_found', 'reports/moved.txt'))
+    });
+    state.downloadHistory = [makeHistoryEntry()];
+
+    await expect(state.redownloadHistory('manifest-1', ['a.txt'])).rejects.toThrow();
+
+    expect(state.operations[0]?.status).toBe('error');
+    expect(state.operations[0]?.errorMessage).toBe(
+      'Failed: File "reports/moved.txt" cannot be found'
+    );
+    expect(state.downloadHistory).toHaveLength(0);
+  });
+});
+
+describe('clearOperationHistory', () => {
+  it('clears both operation and download history', async () => {
+    const clearDownloadHistory = vi.fn();
+    const state = makeState({ clearDownloadHistory });
+    state.downloadHistory = [makeHistoryEntry()];
+
+    await state.clearOperationHistory();
+
+    expect(clearDownloadHistory).toHaveBeenCalledOnce();
+    expect(state.downloadHistory).toEqual([]);
+  });
+});
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index ce6040d5..a1958ca7 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -19,7 +19,12 @@ import {
   storagePasteEnabled,
   storageRenameEnabled
 } from '$lib/client/feature-flags.js';
-import { downloadObject } from '$lib/storage/download.js';
+import {
+  estimateArchiveSize,
+  startDownload,
+  triggerManifestDownloads
+} from '$lib/storage/download.js';
+import type { DownloadHistoryEntry } from '$lib/storage/api.js';
 import type { ConflictEntry } from '$lib/components/storage/modals/shared/conflict-types.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { StorageError, getActionErrorMessage } from './errors.js';
@@ -44,6 +49,8 @@ export class StorageState {
   });
   buckets = $state<string[]>([]);
   connected = $state(false);
+  downloadHistory = $state.raw<DownloadHistoryEntry[]>([]);
+  downloadHistoryLoading = $state(false);
 
   // ── Derived views ──
   folders = $derived(this.objects.objects.filter((o: StorageObject) => o.isDirectory));
@@ -223,6 +230,63 @@ export class StorageState {
     this.loading = false;
     this.selectedKeys = new SvelteSet<string>();
     this.archive.reset();
+    void this.refreshDownloadHistory();
+  }
+
+  async refreshDownloadHistory(): Promise<void> {
+    if (!this.connectionId) {
+      this.downloadHistory = [];
+      return;
+    }
+    this.downloadHistoryLoading = true;
+    try {
+      this.downloadHistory = await this._api.listDownloadHistory(this.connectionId);
+    } catch {
+      this.downloadHistory = [];
+    } finally {
+      this.downloadHistoryLoading = false;
+    }
+  }
+
+  async redownloadHistory(manifestId: string, keys: string[]): Promise<void> {
+    const entry = this.downloadHistory.find((candidate) => candidate.id === manifestId);
+    const selectedEntries = entry ? entry.entries.filter((item) => keys.includes(item.key)) : [];
+    const operationId = crypto.randomUUID();
+    this.operations_.startOp(
+      operationId,
+      m.storage_action_download(),
+      'download',
+      keys.length,
+      new AbortController(),
+      undefined,
+      keys.map(keyToName),
+      estimateArchiveSize(selectedEntries),
+      false
+    );
+    try {
+      const manifest = await this._api.recreateDownloadManifest(manifestId, keys);
+      const jobIds = await triggerManifestDownloads(manifest);
+      this.operations_.updateOpTotalBytes(
+        operationId,
+        manifest.files.reduce((total, file) => total + file.size, 0)
+      );
+      this.operations_.updateOpJobIds(operationId, jobIds);
+      this.operations_.trackDownload(operationId);
+      await this.refreshDownloadHistory();
+    } catch (err) {
+      if (err instanceof StorageError && err.code === 'not_found') {
+        this.operations_.finishOp(
+          operationId,
+          'error',
+          m.storage_download_history_file_not_found({ path: err.message })
+        );
+        this.downloadHistory = this.downloadHistory.filter((entry) => entry.id !== manifestId);
+        await this.refreshDownloadHistory();
+      } else {
+        this.operations_.finishOp(operationId, 'error');
+      }
+      throw err;
+    }
   }
 
   /** Add a bucket to the in-memory list (no server-side persistence). */
@@ -418,8 +482,9 @@ export class StorageState {
         this.openModal('preview', { key });
         return;
 
-      case 'download':
-        if (!key) {
+      case 'download': {
+        const downloadItems = [...this.selectedFolders, ...this.selectedFiles];
+        if (downloadItems.length === 0) {
           addToast('warning', m.storage_action_download_no_selection());
           return;
         }
@@ -427,17 +492,46 @@ export class StorageState {
           void this.archive.downloadFromArchive(key);
           return;
         }
-        for (const f of effectiveSelectedFiles) {
+        for (const f of downloadItems) {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
         try {
-          const connectionId = connectionStore.activeConnectionId;
-          if (!connectionId) {
+          if (!connectionStore.activeConnectionId) {
             addToast('error', m.storage_download_error_unknown());
             return;
           }
-          await downloadObject(this.bucket, key, connectionId);
+          const keys = downloadItems.map((file) => file.key);
+          const abortController = new AbortController();
+          const operationId = crypto.randomUUID();
+          this.operations_.startOp(
+            operationId,
+            m.storage_action_download(),
+            'download',
+            keys.length,
+            abortController,
+            undefined,
+            downloadItems.map((file) => keyToName(file.key)),
+            estimateArchiveSize(downloadItems),
+            false
+          );
+          const result = await startDownload(
+            this._api,
+            this.bucket,
+            this.prefix,
+            keys,
+            abortController.signal
+          );
+          // The manifest reports the authoritative payload total, which also
+          // covers folder contents that were unknown before.
+          this.operations_.updateOpTotalBytes(operationId, result.totalBytes);
+          this.operations_.updateOpJobIds(operationId, result.jobIds);
+          this.operations_.trackDownload(operationId);
+          await this.refreshDownloadHistory();
         } catch (err: unknown) {
+          const operation = this.operations.find(
+            (candidate) => candidate.type === 'download' && candidate.status === 'running'
+          );
+          if (operation) this.operations_.finishOp(operation.id, 'error');
           if (err instanceof StorageError) {
             addToast('error', getActionErrorMessage(err));
           } else {
@@ -445,6 +539,7 @@ export class StorageState {
           }
         }
         return;
+      }
 
       case 'pin':
         this.bookmarks.pin(this.bucket, ctxKey ?? this.prefix);
@@ -753,6 +848,7 @@ export class StorageState {
 
   handleKeydown = (e: KeyboardEvent): void => {
     if (this.activeModal) return;
+    if (e.target instanceof Element && e.target.closest('dialog[open]')) return;
     if (this.archive.isInArchive && e.key !== 'Escape') return;
 
     const isCtrl = e.ctrlKey || e.metaKey;
@@ -797,8 +893,14 @@ export class StorageState {
     this.operations_.cancelOp(id);
   };
 
-  clearOperationHistory = (): void => {
+  clearOperationHistory = async (): Promise<void> => {
     this.operations_.clearOperationHistory();
+    try {
+      await this._api.clearDownloadHistory();
+      this.downloadHistory = [];
+    } catch {
+      await this.refreshDownloadHistory();
+    }
   };
 
   // ────────────────────────────────────────────────────────────────────────────
diff --git a/src/lib/storage/storage-fetch.spec.ts b/src/lib/storage/storage-fetch.spec.ts
index 632868be..9a9cf4cd 100644
--- a/src/lib/storage/storage-fetch.spec.ts
+++ b/src/lib/storage/storage-fetch.spec.ts
@@ -128,6 +128,18 @@ describe('createStorageFetch', () => {
     });
   });
 
+  it('preserves an API error message', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      makeResponse({ status: 404, body: JSON.stringify({ message: 'reports/moved.txt' }) })
+    );
+
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'not_found',
+      message: 'reports/moved.txt'
+    });
+  });
+
   it('throws StorageError on 500 with server_error code', async () => {
     const storageFetch = createStorageFetch(() => 'conn-1');
     vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 500 }));
diff --git a/src/lib/storage/storage-fetch.ts b/src/lib/storage/storage-fetch.ts
index af8954e3..6dffa0c0 100644
--- a/src/lib/storage/storage-fetch.ts
+++ b/src/lib/storage/storage-fetch.ts
@@ -54,7 +54,18 @@ export function createStorageFetch(
 
     if (!response.ok) {
       const code = mapStatusToCode(response.status);
-      throw new StorageError(code, `Request failed with status ${response.status}`);
+      const body = await response
+        .clone()
+        .json()
+        .catch(() => null);
+      const message =
+        typeof body === 'object' &&
+        body !== null &&
+        'message' in body &&
+        typeof body.message === 'string'
+          ? body.message
+          : `Request failed with status ${response.status}`;
+      throw new StorageError(code, message);
     }
 
     return response;
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index 44116d12..687dd085 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -16,6 +16,7 @@ export interface ModalPayloads {
   delete: { keys: string[] };
   preview: {
     key: string;
+    bucket?: string;
     archiveKey?: string;
     archivePath?: string;
     nestedArchivePath?: string;
@@ -122,7 +123,7 @@ export interface ClipboardData {
 
 export type OperationStatus = 'running' | 'done' | 'error' | 'cancelled' | 'interrupted';
 
-export type OperationType = 'paste' | 'move' | 'rename' | 'delete';
+export type OperationType = 'paste' | 'move' | 'rename' | 'delete' | 'download';
 
 export interface StorageOperation {
   id: string;
@@ -142,9 +143,9 @@ export interface StorageOperation {
   totalBytes: number;
   /** Bytes transferred so far (sum of completed items). */
   completedBytes: number;
-  /** Name of the file currently being transferred. */
+  /** Name of the file currently being transferred (single-item copy/move/paste). */
   currentFileName?: string;
-  /** Server-side job IDs per file for recovering results after reload. */
+  /** Server-side job IDs per file for recovering copy/move results after reload. */
   fileJobIds?: string[];
 }
 
@@ -216,6 +217,39 @@ export interface DeleteObjectsResult {
   failed: Array<{ key: string; code?: string; message?: string }>;
 }
 
+// ── Search ───────────────────────────────────────────────────────────────────
+
+/** A single match from a bucket-scoped storage search. */
+export interface SearchResultItem {
+  key: string;
+  size: number;
+  lastModified: Date;
+  isDirectory: boolean;
+}
+
+/** Response from the storage search API. */
+export interface StorageSearchResponse {
+  results: SearchResultItem[];
+}
+
+/** An incremental update emitted while a storage search is in progress. */
+export interface StorageSearchUpdate extends StorageSearchResponse {
+  /** True when this update replaces rather than appends to the current result set. */
+  snapshot: boolean;
+}
+
+/** A single entry in the per-connection recent search history. One entry
+ *  represents one logical search grouped across all buckets it ran against.
+ *  `maxDepth` is NULL when no depth limit was set. */
+export interface RecentSearchEntry {
+  buckets: string[];
+  query: string;
+  useRegex: boolean;
+  excludePatterns: string[];
+  searchPath: string;
+  maxDepth: number | null;
+}
+
 // ── Archive navigation ───────────────────────────────────────────────────────
 
 export const ARCHIVE_EXTENSIONS = ['.zip', '.tar.gz', '.tgz', '.tar', '.rar', '.7z'] as const;
diff --git a/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts b/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
index 4f5c0923..79fd5d3a 100644
--- a/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
+++ b/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
@@ -1,6 +1,6 @@
 import type { RequestHandler } from './$types';
 import { json } from '@sveltejs/kit';
-import { getJob } from '$lib/server/storage/job-store.js';
+import { cancelJob, getJob } from '$lib/server/storage/job-store.js';
 
 export const GET: RequestHandler = async ({ params }) => {
   const { jobId } = params;
@@ -10,3 +10,8 @@ export const GET: RequestHandler = async ({ params }) => {
   }
   return json(job);
 };
+
+export const DELETE: RequestHandler = async ({ params }) => {
+  if (!(await cancelJob(params.jobId))) return json({ status: 'not_found' }, { status: 404 });
+  return json({ status: 'cancelled' });
+};
diff --git a/src/routes/(app)/api/storage/download/manifests/+server.ts b/src/routes/(app)/api/storage/download/manifests/+server.ts
new file mode 100644
index 00000000..ac6c9c5c
--- /dev/null
+++ b/src/routes/(app)/api/storage/download/manifests/+server.ts
@@ -0,0 +1,52 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import {
+  createDownloadManifest,
+  clearDownloadHistory,
+  listDownloadHistory
+} from '$lib/server/storage/download-manifests.js';
+import {
+  requireBucket,
+  requireConfig,
+  requireStorageConnectionId
+} from '$lib/server/storage/request-context.js';
+
+export const POST: RequestHandler = async (event) => {
+  const bucket = requireBucket(event);
+  const config = requireConfig(event);
+  const connectionId = requireStorageConnectionId(event);
+  const prefix = event.url.searchParams.get('prefix')?.trim() ?? '';
+  const keys = ((await event.request.json()) as { keys?: unknown }).keys;
+  if (
+    !Array.isArray(keys) ||
+    keys.length === 0 ||
+    keys.some((key) => typeof key !== 'string' || !key)
+  ) {
+    throw error(400, 'Request body must contain one or more object keys');
+  }
+  const userId = event.locals.user?.id ?? 'anonymous';
+  const manifest = await createDownloadManifest({
+    userId,
+    connectionId,
+    bucket,
+    prefix,
+    keys: [...new Set(keys)],
+    config
+  });
+  event.locals.logger.info(
+    { manifest_id: manifest.id, bucket, key_count: keys.length },
+    'download manifest prepared'
+  );
+  return json(manifest, { status: 201 });
+};
+
+export const GET: RequestHandler = async ({ locals, url }) => {
+  const connectionId = url.searchParams.get('connectionId') ?? undefined;
+  const history = await listDownloadHistory(locals.user?.id ?? 'anonymous', connectionId);
+  return json(history);
+};
+
+export const DELETE: RequestHandler = async (event) => {
+  await clearDownloadHistory(event.locals.user?.id ?? 'anonymous');
+  return new Response(null, { status: 204 });
+};
diff --git a/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/+server.ts b/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/+server.ts
new file mode 100644
index 00000000..dfeeb5be
--- /dev/null
+++ b/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/+server.ts
@@ -0,0 +1,68 @@
+import { error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { openDownloadManifestPart } from '$lib/server/storage/download-manifests.js';
+import {
+  cancelJobFromStream,
+  completeJob,
+  createJob,
+  failJob,
+  setJobCancellation,
+  updateJobProgress
+} from '$lib/server/storage/job-store.js';
+
+export const GET: RequestHandler = async ({ locals, params, url }) => {
+  const part = Number.parseInt(params.part, 10);
+  if (!Number.isSafeInteger(part) || part < 1) throw error(400, 'Invalid download part');
+  const download = await openDownloadManifestPart(
+    locals.user?.id ?? 'anonymous',
+    params.manifestId,
+    part
+  );
+  if (!download)
+    throw error(404, 'Download manifest, storage connection, or object is unavailable');
+  const jobId = url.searchParams.get('jobId');
+  if (jobId) {
+    createJob(jobId);
+    updateJobProgress(jobId, { currentFileName: download.file.filename });
+  }
+  const filename = encodeURIComponent(download.file.filename);
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/octet-stream',
+    'Content-Disposition': `attachment; filename="${download.file.filename}"; filename*=UTF-8''${filename}`,
+    'Cache-Control': 'private, no-store'
+  };
+  if (download.file.size > 0) headers['Content-Length'] = String(download.file.size);
+  let completedBytes = 0;
+  const reader = download.stream.getReader();
+  if (jobId) setJobCancellation(jobId, () => reader.cancel());
+  const stream = new ReadableStream({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          if (jobId) {
+            if (download.file.size > 0 && completedBytes < download.file.size) {
+              cancelJobFromStream(jobId);
+            } else {
+              updateJobProgress(jobId, { completedCount: 1, completedBytes });
+              completeJob(jobId, null);
+            }
+          }
+          controller.close();
+          return;
+        }
+        completedBytes += value.byteLength;
+        if (jobId) updateJobProgress(jobId, { completedBytes });
+        controller.enqueue(value);
+      } catch (err) {
+        if (jobId) failJob(jobId, err instanceof Error ? err.message : 'Download failed');
+        controller.error(err);
+      }
+    },
+    async cancel() {
+      await reader.cancel();
+      if (jobId) cancelJobFromStream(jobId);
+    }
+  });
+  return new Response(stream, { headers });
+};
diff --git a/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/server.test.ts b/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/server.test.ts
new file mode 100644
index 00000000..c8720bc3
--- /dev/null
+++ b/src/routes/(app)/api/storage/download/manifests/[manifestId]/[part]/server.test.ts
@@ -0,0 +1,60 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('$lib/server/storage/download-manifests.js', () => ({ openDownloadManifestPart: vi.fn() }));
+import { openDownloadManifestPart } from '$lib/server/storage/download-manifests.js';
+import { GET } from './+server.js';
+
+describe('GET /api/storage/download/manifests/:manifestId/:part', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('streams a manifest part with its exact Content-Length and no connection header', async () => {
+    vi.mocked(openDownloadManifestPart).mockResolvedValue({
+      stream: new ReadableStream({ start: (controller) => controller.close() }),
+      file: { filename: 'reports.zip', size: 5000, part: 1 }
+    });
+    const response = await GET({
+      locals: { user: { id: 'user-1' } },
+      params: { manifestId: 'manifest-1', part: '1' },
+      url: new URL('https://example.test/api/storage/download/manifests/manifest-1/1')
+    } as Parameters<typeof GET>[0]);
+    expect(response.headers.get('Content-Length')).toBe('5000');
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store');
+    expect(openDownloadManifestPart).toHaveBeenCalledWith('user-1', 'manifest-1', 1);
+  });
+
+  it('streams an archived manifest part with its exact Content-Length', async () => {
+    vi.mocked(openDownloadManifestPart).mockResolvedValue({
+      stream: new ReadableStream({ start: (controller) => controller.close() }),
+      file: { filename: 'reports.zip', size: 5000, part: 1 }
+    });
+    const response = await GET({
+      locals: { user: { id: 'user-1' } },
+      params: { manifestId: 'manifest-1', part: '1' },
+      url: new URL('https://example.test/api/storage/download/manifests/manifest-1/1')
+    } as Parameters<typeof GET>[0]);
+    expect(response.headers.get('Content-Length')).toBe('5000');
+    expect(response.headers.get('Content-Disposition')).toContain('reports.zip');
+  });
+
+  it('marks a stream that ends short of Content-Length as cancelled', async () => {
+    vi.mocked(openDownloadManifestPart).mockResolvedValue({
+      stream: new ReadableStream({
+        start(controller) {
+          controller.enqueue(new Uint8Array([1, 2]));
+          controller.close();
+        }
+      }),
+      file: { filename: 'partial.bin', size: 3, part: 1 }
+    });
+    const response = await GET({
+      locals: { user: { id: 'user-1' } },
+      params: { manifestId: 'manifest-1', part: '1' },
+      url: new URL('https://example.test/api/storage/download/manifests/manifest-1/1?jobId=job-1')
+    } as Parameters<typeof GET>[0]);
+
+    await response.arrayBuffer();
+
+    const { getJob } = await import('$lib/server/storage/job-store.js');
+    expect(getJob('job-1')?.status).toBe('cancelled');
+  });
+});
diff --git a/src/routes/(app)/api/storage/download/manifests/[manifestId]/redownload/+server.ts b/src/routes/(app)/api/storage/download/manifests/[manifestId]/redownload/+server.ts
new file mode 100644
index 00000000..d05413c5
--- /dev/null
+++ b/src/routes/(app)/api/storage/download/manifests/[manifestId]/redownload/+server.ts
@@ -0,0 +1,31 @@
+import { error, json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { recreateDownloadManifest } from '$lib/server/storage/download-manifests.js';
+
+export const POST: RequestHandler = async ({ locals, params, request }) => {
+  const keys = ((await request.json()) as { keys?: unknown }).keys;
+  if (
+    !Array.isArray(keys) ||
+    keys.length === 0 ||
+    keys.some((key) => typeof key !== 'string' || !key)
+  ) {
+    throw error(400, 'Request body must contain one or more object keys');
+  }
+  if (new Set(keys).size !== keys.length)
+    throw error(400, 'Download keys must not contain duplicates');
+  const manifest = await recreateDownloadManifest(
+    locals.user?.id ?? 'anonymous',
+    params.manifestId,
+    keys
+  );
+  if (!manifest)
+    throw error(
+      404,
+      'Download history entry, storage connection, or selected objects are unavailable'
+    );
+  locals.logger.info(
+    { manifest_id: manifest.id, source_manifest_id: params.manifestId, key_count: keys.length },
+    'download history entry recreated'
+  );
+  return json(manifest, { status: 201 });
+};
diff --git a/src/routes/(app)/api/storage/search/+server.ts b/src/routes/(app)/api/storage/search/+server.ts
new file mode 100644
index 00000000..dd661129
--- /dev/null
+++ b/src/routes/(app)/api/storage/search/+server.ts
@@ -0,0 +1,149 @@
+import { error, isHttpError } from '@sveltejs/kit';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import { createSafeSearchRegex, UnsafeSearchRegexError } from '$lib/storage/search-regex.js';
+import { compileFilterPredicates, parseFilterParam } from '$lib/storage/search-filter.js';
+import { storageSearchTotal } from '$lib/server/metrics.js';
+import type { SearchResultItem } from '$lib/storage/types.js';
+import type { RequestHandler } from './$types';
+
+const SNAPSHOT_INTERVAL = 10;
+
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const query = event.url.searchParams.get('q')?.trim() ?? '';
+  const log = event.locals.logger;
+  const prefix = event.url.searchParams.get('prefix') ?? '';
+  const maxDepthParam = event.url.searchParams.get('maxDepth');
+  const maxDepth = maxDepthParam === null ? undefined : Number(maxDepthParam);
+  if (!query) throw error(400, 'Missing required query parameter: q');
+  if (maxDepth !== undefined && (!Number.isInteger(maxDepth) || maxDepth < 1 || maxDepth > 20)) {
+    throw error(400, 'maxDepth must be an integer between 1 and 20');
+  }
+
+  const useRegex = event.url.searchParams.get('regex') === 'true';
+  const excludePatterns = event.url.searchParams.getAll('exclude').filter(Boolean);
+  const filters = event.url.searchParams
+    .getAll('filter')
+    .map(parseFilterParam)
+    .filter((filter): filter is NonNullable<typeof filter> => filter !== null);
+  let regex: RegExp | undefined;
+  if (useRegex) {
+    try {
+      regex = createSafeSearchRegex(query);
+    } catch (err) {
+      if (err instanceof UnsafeSearchRegexError) throw error(400, err.message);
+      throw err;
+    }
+  }
+  const matchesFilters = compileFilterPredicates(filters);
+
+  log.debug(
+    {
+      bucket,
+      query,
+      prefix,
+      max_depth: maxDepth,
+      use_regex: useRegex,
+      exclude_count: excludePatterns.length,
+      filter_count: filters.length
+    },
+    'running storage search'
+  );
+
+  try {
+    const additionalBuckets = event.locals.storageConfig?.additionalBuckets ?? [];
+    const buckets = await provider.listContainers();
+    if (!new Set([...buckets, ...additionalBuckets]).has(bucket)) {
+      throw error(404, 'Storage bucket not found');
+    }
+
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream({
+      async start(controller) {
+        const results: SearchResultItem[] = [];
+        let matchesSinceSnapshot = 0;
+        const send = (
+          type: 'batch' | 'snapshot' | 'complete',
+          eventResults: SearchResultItem[]
+        ) => {
+          controller.enqueue(
+            encoder.encode(JSON.stringify({ type, results: eventResults }) + '\n')
+          );
+        };
+
+        try {
+          const result = await provider.search(query, {
+            prefix,
+            maxDepth,
+            signal: event.request.signal,
+            matches: (item) => {
+              const matched = regex
+                ? regex.test(item.key)
+                : item.key.toLowerCase().includes(query.toLowerCase());
+              return (
+                matched &&
+                !excludePatterns.some((pattern) => item.key.includes(pattern)) &&
+                matchesFilters(item)
+              );
+            },
+            onMatch: (item) => {
+              results.push(item);
+              matchesSinceSnapshot++;
+              if (matchesSinceSnapshot >= SNAPSHOT_INTERVAL) {
+                send('snapshot', results);
+                matchesSinceSnapshot = 0;
+              } else {
+                send('batch', [item]);
+              }
+            }
+          });
+          send('complete', result.results);
+          storageSearchTotal.inc({ outcome: 'success' });
+          log.info(
+            {
+              bucket,
+              query,
+              prefix,
+              max_depth: maxDepth,
+              result_count: result.results.length
+            },
+            'storage search completed'
+          );
+        } catch (err) {
+          storageSearchTotal.inc({ outcome: 'error' });
+          const code = isHttpError(err)
+            ? err.status === 403
+              ? 'access_denied'
+              : err.status === 404
+                ? 'not_found'
+                : err.status >= 500
+                  ? 'server_error'
+                  : 'unknown'
+            : 'unknown';
+          controller.enqueue(
+            encoder.encode(
+              JSON.stringify({
+                type: 'error',
+                code,
+                message: err instanceof Error ? err.message : 'Search failed'
+              }) + '\n'
+            )
+          );
+        } finally {
+          controller.close();
+        }
+      }
+    });
+
+    return new Response(stream, {
+      headers: {
+        'Content-Type': 'application/x-ndjson',
+        'Cache-Control': 'no-cache',
+        Connection: 'keep-alive'
+      }
+    });
+  } catch (err) {
+    storageSearchTotal.inc({ outcome: 'error' });
+    throw err;
+  }
+};
diff --git a/src/routes/(app)/api/storage/search/history/+server.ts b/src/routes/(app)/api/storage/search/history/+server.ts
new file mode 100644
index 00000000..b787e1c5
--- /dev/null
+++ b/src/routes/(app)/api/storage/search/history/+server.ts
@@ -0,0 +1,108 @@
+import { error } from '@sveltejs/kit';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import {
+  clearRecentSearches,
+  listRecentSearches,
+  recordRecentSearch,
+  type RecentSearchOptions
+} from '$lib/server/storage/recent-searches-db.js';
+import { storageSearchHistoryTotal } from '$lib/server/metrics.js';
+import type { RequestHandler } from './$types';
+
+function connectionIdFromRequest(request: Request): string {
+  const connectionId = request.headers.get(STORAGE_CONNECTION_ID_HEADER);
+  if (!connectionId) {
+    throw error(400, 'Missing storage connection ID');
+  }
+  return connectionId;
+}
+
+/** Lists the current user's recent searches for the active storage connection. */
+export const GET: RequestHandler = async ({ request, locals }) => {
+  const userId = locals.user!.id;
+  const connectionId = connectionIdFromRequest(request);
+  try {
+    const searches = await listRecentSearches(userId, connectionId);
+    storageSearchHistoryTotal.inc({ operation: 'list', outcome: 'success' });
+    locals.logger.debug(
+      { user_id: userId, connection_id: connectionId, search_count: searches.length },
+      'recent storage searches returned'
+    );
+    return Response.json(searches);
+  } catch (err) {
+    storageSearchHistoryTotal.inc({ operation: 'list', outcome: 'error' });
+    throw err;
+  }
+};
+
+/** Records a submitted search, moving an identical search to the top. */
+export const POST: RequestHandler = async ({ request, locals }) => {
+  const userId = locals.user!.id;
+  const connectionId = connectionIdFromRequest(request);
+  const body = (await request.json()) as {
+    buckets?: unknown;
+    query?: unknown;
+    useRegex?: unknown;
+    excludePatterns?: unknown;
+    searchPath?: unknown;
+    maxDepth?: unknown;
+  };
+  const buckets = Array.isArray(body.buckets)
+    ? [...new Set(body.buckets.map((b) => (typeof b === 'string' ? b.trim() : '')).filter(Boolean))]
+    : [];
+  const query = typeof body.query === 'string' ? body.query.trim() : '';
+  if (buckets.length === 0 || !query) {
+    throw error(400, 'At least one bucket and a query are required');
+  }
+  const options: RecentSearchOptions = {
+    useRegex: typeof body.useRegex === 'boolean' ? body.useRegex : false,
+    excludePatterns:
+      Array.isArray(body.excludePatterns) &&
+      body.excludePatterns.every((i) => typeof i === 'string')
+        ? body.excludePatterns
+        : [],
+    searchPath: typeof body.searchPath === 'string' ? body.searchPath.trim() : '',
+    maxDepth:
+      typeof body.maxDepth === 'number' && Number.isInteger(body.maxDepth) && body.maxDepth > 0
+        ? body.maxDepth
+        : null
+  };
+
+  try {
+    await recordRecentSearch(userId, connectionId, buckets, query, options);
+    storageSearchHistoryTotal.inc({ operation: 'record', outcome: 'success' });
+    locals.logger.info(
+      {
+        user_id: userId,
+        connection_id: connectionId,
+        buckets,
+        query,
+        use_regex: options.useRegex,
+        max_depth: options.maxDepth
+      },
+      'recent storage search recorded'
+    );
+    return new Response(null, { status: 204 });
+  } catch (err) {
+    storageSearchHistoryTotal.inc({ operation: 'record', outcome: 'error' });
+    throw err;
+  }
+};
+
+/** Clears the current user's recent searches for the active storage connection. */
+export const DELETE: RequestHandler = async ({ request, locals }) => {
+  const userId = locals.user!.id;
+  const connectionId = connectionIdFromRequest(request);
+  try {
+    await clearRecentSearches(userId, connectionId);
+    storageSearchHistoryTotal.inc({ operation: 'clear', outcome: 'success' });
+    locals.logger.info(
+      { user_id: userId, connection_id: connectionId },
+      'recent storage searches cleared'
+    );
+    return new Response(null, { status: 204 });
+  } catch (err) {
+    storageSearchHistoryTotal.inc({ operation: 'clear', outcome: 'error' });
+    throw err;
+  }
+};
diff --git a/src/routes/(app)/api/storage/search/history/server.test.ts b/src/routes/(app)/api/storage/search/history/server.test.ts
new file mode 100644
index 00000000..a9f871b0
--- /dev/null
+++ b/src/routes/(app)/api/storage/search/history/server.test.ts
@@ -0,0 +1,162 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const { recentSearches } = vi.hoisted(() => ({
+  recentSearches: {
+    listRecentSearches: vi.fn(),
+    recordRecentSearch: vi.fn(),
+    clearRecentSearches: vi.fn()
+  }
+}));
+
+vi.mock('$lib/server/storage/recent-searches-db.js', () => recentSearches);
+
+import { GET, POST, DELETE } from './+server.js';
+
+const CONNECTION_ID = '00000000-0000-0000-0000-000000000001';
+
+function mockEvent(method: string, body?: unknown, connectionId: string | null = CONNECTION_ID) {
+  const headers = new Headers();
+  if (connectionId) headers.set('x-storage-connection-id', connectionId);
+  const request = new Request('http://localhost/api/storage/search/history', {
+    method,
+    headers,
+    ...(body === undefined ? {} : { body: JSON.stringify(body) })
+  });
+  return {
+    request,
+    locals: {
+      user: { id: 'user-1' },
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('/api/storage/search/history', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('lists searches for the requesting user and connection', async () => {
+    recentSearches.listRecentSearches.mockResolvedValue([
+      { buckets: ['documents'], query: 'report' },
+      { buckets: ['archive', 'documents'], query: 'invoice' }
+    ]);
+
+    const response = await GET(mockEvent('GET'));
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual([
+      { buckets: ['documents'], query: 'report' },
+      { buckets: ['archive', 'documents'], query: 'invoice' }
+    ]);
+    expect(recentSearches.listRecentSearches).toHaveBeenCalledWith('user-1', CONNECTION_ID);
+  });
+
+  it('records trimmed buckets and query with default options', async () => {
+    recentSearches.recordRecentSearch.mockResolvedValue(undefined);
+
+    const response = await POST(
+      mockEvent('POST', {
+        buckets: [' documents ', 'documents', 'alpha'],
+        query: ' report '
+      }) as Parameters<typeof POST>[0]
+    );
+
+    expect(response.status).toBe(204);
+    expect(recentSearches.recordRecentSearch).toHaveBeenCalledWith(
+      'user-1',
+      CONNECTION_ID,
+      ['documents', 'alpha'],
+      'report',
+      {
+        useRegex: false,
+        excludePatterns: [],
+        searchPath: '',
+        maxDepth: null
+      }
+    );
+  });
+
+  it('records the submitted advanced options', async () => {
+    recentSearches.recordRecentSearch.mockResolvedValue(undefined);
+
+    const response = await POST(
+      mockEvent('POST', {
+        buckets: ['documents'],
+        query: 'report',
+        useRegex: true,
+        excludePatterns: ['_temp', 'logs'],
+        searchPath: ' events/2024/ ',
+        maxDepth: 3
+      }) as Parameters<typeof POST>[0]
+    );
+
+    expect(response.status).toBe(204);
+    expect(recentSearches.recordRecentSearch).toHaveBeenCalledWith(
+      'user-1',
+      CONNECTION_ID,
+      ['documents'],
+      'report',
+      {
+        useRegex: true,
+        excludePatterns: ['_temp', 'logs'],
+        searchPath: 'events/2024/',
+        maxDepth: 3
+      }
+    );
+  });
+
+  it('coerces invalid advanced options to defaults', async () => {
+    recentSearches.recordRecentSearch.mockResolvedValue(undefined);
+
+    const response = await POST(
+      mockEvent('POST', {
+        buckets: ['documents'],
+        query: 'report',
+        useRegex: 'yes',
+        excludePatterns: [1, 2],
+        searchPath: 42,
+        maxDepth: -5
+      }) as Parameters<typeof POST>[0]
+    );
+
+    expect(response.status).toBe(204);
+    expect(recentSearches.recordRecentSearch).toHaveBeenCalledWith(
+      'user-1',
+      CONNECTION_ID,
+      ['documents'],
+      'report',
+      {
+        useRegex: false,
+        excludePatterns: [],
+        searchPath: '',
+        maxDepth: null
+      }
+    );
+  });
+
+  it('rejects invalid history records', async () => {
+    await expect(
+      POST(mockEvent('POST', { buckets: ['documents'], query: ' ' }) as Parameters<typeof POST>[0])
+    ).rejects.toMatchObject({ status: 400 });
+    await expect(
+      POST(mockEvent('POST', { buckets: [], query: 'report' }) as Parameters<typeof POST>[0])
+    ).rejects.toMatchObject({ status: 400 });
+    await expect(
+      POST(
+        mockEvent('POST', { buckets: 'documents', query: 'report' }) as Parameters<typeof POST>[0]
+      )
+    ).rejects.toMatchObject({ status: 400 });
+  });
+
+  it('clears searches for the requesting user and connection', async () => {
+    recentSearches.clearRecentSearches.mockResolvedValue(undefined);
+
+    const response = await DELETE(mockEvent('DELETE') as Parameters<typeof DELETE>[0]);
+
+    expect(response.status).toBe(204);
+    expect(recentSearches.clearRecentSearches).toHaveBeenCalledWith('user-1', CONNECTION_ID);
+  });
+
+  it('rejects requests without a storage connection ID', async () => {
+    await expect(GET(mockEvent('GET', undefined, null))).rejects.toMatchObject({ status: 400 });
+  });
+});
diff --git a/src/routes/(app)/api/storage/search/server.test.ts b/src/routes/(app)/api/storage/search/server.test.ts
new file mode 100644
index 00000000..343f8189
--- /dev/null
+++ b/src/routes/(app)/api/storage/search/server.test.ts
@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { error } from '@sveltejs/kit';
+
+const { mockProvider, storageSearchTotal } = vi.hoisted(() => ({
+  mockProvider: { search: vi.fn(), listContainers: vi.fn() },
+  storageSearchTotal: { inc: vi.fn() }
+}));
+
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+vi.mock('$lib/server/metrics.js', () => ({ storageSearchTotal }));
+
+import { GET } from './+server.js';
+
+function mockEvent(params: string, signal?: AbortSignal) {
+  const url = new URL(`http://localhost/api/storage/search?${params}`);
+  return {
+    url,
+    request: new Request(url, { signal }),
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/search', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockProvider.listContainers.mockResolvedValue(['documents']);
+  });
+
+  it('streams a complete search with backend filtering and the request abort signal', async () => {
+    const controller = new AbortController();
+    mockProvider.search.mockResolvedValue({
+      results: [
+        { key: 'reports/final.pdf', size: 42, lastModified: new Date(), isDirectory: false }
+      ]
+    });
+
+    const response = await GET(
+      mockEvent(
+        'bucket=documents&q=report&prefix=reports%2F&maxDepth=2&regex=true&exclude=archive',
+        controller.signal
+      )
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('Content-Type')).toContain('application/x-ndjson');
+    await expect(response.text()).resolves.toContain('"type":"complete"');
+    expect(mockProvider.search).toHaveBeenCalledWith('report', {
+      prefix: 'reports/',
+      maxDepth: 2,
+      signal: expect.any(AbortSignal),
+      matches: expect.any(Function),
+      onMatch: expect.any(Function)
+    });
+    const { matches } = mockProvider.search.mock.calls[0][1];
+    expect(
+      matches({ key: 'reports/final.pdf', size: 42, lastModified: new Date(), isDirectory: false })
+    ).toBe(true);
+    expect(
+      matches({
+        key: 'reports/archive.pdf',
+        size: 42,
+        lastModified: new Date(),
+        isDirectory: false
+      })
+    ).toBe(false);
+    expect(storageSearchTotal.inc).toHaveBeenCalledWith({ outcome: 'success' });
+  });
+
+  it('rejects a missing bucket', async () => {
+    await expect(GET(mockEvent('q=report'))).rejects.toMatchObject({ status: 400 });
+  });
+
+  it('rejects a missing or blank query', async () => {
+    await expect(GET(mockEvent('bucket=documents'))).rejects.toMatchObject({ status: 400 });
+    await expect(GET(mockEvent('bucket=documents&q=%20%20'))).rejects.toMatchObject({
+      status: 400
+    });
+  });
+
+  it('rejects an invalid maximum depth', async () => {
+    await expect(GET(mockEvent('bucket=documents&q=report&maxDepth=0'))).rejects.toMatchObject({
+      status: 400
+    });
+  });
+
+  it('streams an unexpected provider failure', async () => {
+    mockProvider.search.mockRejectedValue(new Error('connection reset'));
+
+    const response = await GET(mockEvent('bucket=documents&q=report'));
+    await expect(response.text()).resolves.toContain('"type":"error"');
+    expect(storageSearchTotal.inc).toHaveBeenCalledWith({ outcome: 'error' });
+  });
+
+  it('includes access-denied classification in streamed provider failures', async () => {
+    let accessDeniedError: unknown;
+    try {
+      error(403, 'Access denied');
+    } catch (err) {
+      accessDeniedError = err;
+    }
+    mockProvider.search.mockRejectedValue(accessDeniedError);
+
+    const response = await GET(mockEvent('bucket=documents&q=report'));
+
+    await expect(response.text()).resolves.toContain('"code":"access_denied"');
+  });
+
+  it('rejects buckets outside the active connection', async () => {
+    await expect(GET(mockEvent('bucket=private&q=report'))).rejects.toMatchObject({ status: 404 });
+    expect(mockProvider.search).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/routes/(app)/settings/connections/+page.server.ts b/src/routes/(app)/settings/connections/+page.server.ts
index adf669d6..73817f38 100644
--- a/src/routes/(app)/settings/connections/+page.server.ts
+++ b/src/routes/(app)/settings/connections/+page.server.ts
@@ -2,13 +2,51 @@ import { fail, redirect } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 import { superValidate } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import { desc, eq } from 'drizzle-orm';
 import { ConnectionIdSchema } from '$lib/storage/schemas.js';
 import { deleteConnection } from '$lib/server/storage/connections-db.js';
 import { auth } from '$lib/server/auth.js';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt } from '$lib/server/storage/encryption.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
+import type { ConnectionListItem } from '$lib/storage/connection-store.svelte.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   locals.logger.debug('loading storage connections management page');
-  return {};
+
+  const userId = locals.user?.id;
+  if (!userId) return { connections: [] as ConnectionListItem[] };
+
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(eq(userStorageConnections.userId, userId))
+    .orderBy(desc(userStorageConnections.updatedAt));
+
+  const connections: ConnectionListItem[] = rows.map((row) => {
+    let endpoint: string | null = null;
+    try {
+      const payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey())) as {
+        host?: string;
+        port?: number;
+      };
+      endpoint =
+        payload.host && payload.port ? `${payload.host}:${payload.port}` : (payload.host ?? null);
+    } catch {
+      // Return entry without endpoint if decryption fails.
+    }
+    return {
+      id: row.id,
+      name: row.name,
+      endpoint,
+      additionalBuckets: (row.additionalBuckets as string[]) ?? [],
+      createdAt: row.createdAt.toISOString(),
+      updatedAt: row.updatedAt.toISOString()
+    };
+  });
+
+  return { connections };
 };
 
 export const actions: Actions = {
diff --git a/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
index 38d66ff1..7c2bcbb2 100644
--- a/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
@@ -60,7 +60,11 @@ export const load: PageServerLoad = async ({ locals, params }) => {
   );
 
   locals.logger.debug({ connection_id: params.id }, 'loading storage connection edit page');
-  return { editForm, connectionId: params.id };
+  return {
+    editForm,
+    connectionId: params.id,
+    activeConnectionId: locals.session?.activeStorageConnectionId ?? null
+  };
 };
 
 export const actions: Actions = {
diff --git a/src/routes/(app)/settings/connections/[id]/edit/+page.svelte b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
index f4539019..7b0963fb 100644
--- a/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
@@ -9,14 +9,13 @@
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { data } = $props();
 
   const uid = $props.id();
 
   let loaded = $state(false);
-  let isActiveConnection = $derived(connectionStore.activeConnectionId === data.connectionId);
+  let isActiveConnection = $derived(data.activeConnectionId === data.connectionId);
 
   // Unsaved-changes guard
   let initialSnapshot = $state.raw('');
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 27527a88..bc003eea 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -17,6 +17,7 @@
   import RecentItems from '$lib/components/storage/landing/RecentItems.svelte';
   import AddBucketModal from '$lib/components/storage/landing/AddBucketModal.svelte';
   import IconAdd from 'virtual:icons/material-symbols/add';
+  import StorageSearch from '$lib/components/storage/StorageSearch.svelte';
 
   let { data } = $props();
   const storage = getStorageState();
@@ -136,15 +137,18 @@
     <div class="mb-6">
       <div class="mb-1 flex items-center justify-between gap-4">
         <h1 class="text-xl font-semibold">{m.storage_buckets_label()}</h1>
-        <button
-          type="button"
-          class="btn btn-primary btn-sm shrink-0"
-          onclick={() => (addBucketOpen = true)}
-          aria-label={m.storage_add_bucket()}
-        >
-          <IconAdd class="size-4" aria-hidden="true" />
-          {m.storage_add_bucket()}
-        </button>
+        <div class="flex shrink-0 items-center gap-1">
+          <StorageSearch />
+          <button
+            type="button"
+            class="btn btn-primary btn-sm"
+            onclick={() => (addBucketOpen = true)}
+            aria-label={m.storage_add_bucket()}
+          >
+            <IconAdd class="size-4" aria-hidden="true" />
+            {m.storage_add_bucket()}
+          </button>
+        </div>
       </div>
       <p class="text-base-content/60 text-sm">{m.storage_buckets_subtitle()}</p>
     </div>