feat(cordis): add OpenFlare Cordis 架构改造设计

docs(changelog): 修正表述笔误

refactor(cordis): 磁盘缓存改用上上游能力并清理本地副本

按上游/下游归属规约：类型断言守卫已回流 Wavelet（f3d85d5，附回归用例），
本仓库删除 OpenFlare/plugins/server/pkg/cache 整包并改 import 到
Wavelet/pkg/cache/disk，同步后与上游零漂移。

验证：go build 通过；go test ./... exit 0（137 包 ok）；256 条路由对拍与
232 条 swagger 操作均零差异；make build-all 四进制；前端零改动。

docs(cordis): 记录 T1 清理结果与五个复用阻塞点

refactor(cordis): server 复用上游 pkg 能力并删除等价本地副本

按上游/下游归属规约清理重复实现，删除 7 个与上游等价的本地包并改 import：
shared/response→pkg/response、pkg/{logger,mail,trace,httppool,cache/ram}→
上游同名包、infra/persistence/batchwriter→pkg/batchwriter。逐项核过差异：
httppool 逐字节相同；logger 的 Config 字段完全一致；response 的 7 个 Abort*
一致；cache/ram 换过去顺带把裸 go 变回带 panic 恢复的 util.Go。

两处非等价差异按语义处理：
- batchwriter.Stats 与 status DTO 原为类型别名，改为消费侧逐字段转换，
  避免 model 反向依赖基础设施类型；
- 上游 pkg/idgen 要求显式 Init（本地副本为懒加载自动初始化），本次保留本地
  副本，待与 infra 初始化一并迁移（已登记在清理计划）。

验证：go build 通过；go test ./... exit 0（138 包 ok）；256 条路由对拍零差异；
make swagger 232 条操作零增减，且归一化后与旧文档深度相等——差异仅为
response.Any / logger.LogEntry 两个定义名随包路径改名，接口形状未变。

chore(cordis): 回流内核与 pkg/util 通用能力并清理 vendoring 污染

按新增的上游/下游归属规约：HandleRaw/BasePath 与版本比较、网络、格式化助手
属通用能力，已提交到 Wavelet 分支 feat/cordis-router-raw-routes，本仓库改为
纯同步获取（pkg/util 已零漂移），补丁登记保留至上游合并。

同时修掉我此前 git add -A 造成的污染：首次 vendoring 把上游工作区里被
gitignore 的运行期产物一起提交进来（upload 的 diskcache 缓存块 650 个与
driver_http/dist 前端构建物 380 个，共 12872 行/1030 文件）。sync-upstream.sh
现显式排除 uploads/dist/data/*.db，.gitignore 补上对应兜底规则。

AGENTS.md 增加上游/下游改动归属规约，并把仍指向前 Cordis 布局的硬性约束
（internal/router + Serve、internal/repository/logstore、internal/platform/bootstrap、
internal/cmd）改到当前插件路径。

验证：go build 通过；go test ./... exit 0（144 包 ok）；make swagger 232 条
操作与基线逐条一致；make build-all 四进制；gofmt 干净。

feat(cordis): server 插件化并改由内核挂载控制面路由

新增 plugins/server/plugin.go：Apply 以 ctx.Router().Group(app.api_prefix)
声明根级与 /v1 全部路由；33 个注册函数由 *gin.RouterGroup 改为
core.RouterExtension，RegisterCollection 改用内核新增的 HandleRaw 保留
尾部斜杠变体，AdminMiddlewares 返回 []any（Go 不允许把 []T 展开为 ...any）。
删除 router.Serve 与 registerRoutes，装配根改为 core.App +
driver_http.New(WithEngine(router.BuildEngine()))，监听、信号与优雅退出归内核；
前端 SPA 的 NoRoute 兜底因内核暂无贡献点而保留在引擎层。

路由保真证据：plugin_parity_test 对拍 baseline/routes-engine.txt 的 256 条
(方法 路径) 零差异；go test ./... exit 0（144 包 ok，含真实 handler 的
openflare/integration 用例走同一条挂载路径）；make swagger 232 条操作与基线
逐条一致；golangci-lint 0 issues；make build-all 四进制；embed_frontend
标签编译通过；前端零改动。

已知待补：带 Redis 的实机 HTTP 冒烟（本机 6379 未启动，session store 与
改造前一样在建店阶段即 fatal），以及 bootstrap 的任务/设置/迁移注册迁入 Apply。

feat(core): RouterExtension 增加 HandleRaw 与 BasePath 以保真尾部斜杠路由

server 插件化的前置：Handle 经 cleanPath 会剥掉尾部斜杠，无法表达
/resource 与 /resource/ 两条不同路由，而 OpenFlare 有 20 个历史 list
端点两者都注册且部署关闭了 RedirectTrailingSlash，缺失即 404。新增
HandleRaw 与 BasePath（作用域包装器同样登记反注册），补 extpoints 用例；
并把 router.Serve 拆出 BuildEngine 以便交给 driver_http.WithEngine 复用，
新增路由表导出 harness，固化 256 条 (方法 路径) 基线供插件化对拍。
上游补丁登记于 backend/OpenFlare/upstream-patches.md，同步脚本改为按目录
前缀输出差异并在同步后提醒确认补丁是否仍在。

验证：go build 通过；go test ./... exit 0（143 包 ok）；gofmt 干净。

docs(cordis): 记录 server 插件接入内核的可行路径与内核能力缺口

feat(cordis): agent/relay/flared 落地为内核驱动插件

三个边缘守护进程各新增 plugin.go，实现 core.Plugin + core.Driver
（自定义 DriverType 与同名 profile），装配与生命周期从 main 迁入
Apply/Start/Stop：Apply 负责 JSON 配置加载、运行环境与用户确保、
openresty/frps/frpc 管理器与各服务装配；Start 以 util.Go 拉起阻塞式
runner 与 GeoIP 周期更新；Stop 收敛主循环结果并在超时时报错而非静默。

入口改为 core.NewApp(core.WithProfile(...)) + Prepare/Run，保持
-config 旗标、默认路径、退出码与启动/停止日志不变。

验证：go build 通过；go test ./... exit 0（143 包 ok，含 3 个插件身份
与配置失败路径测试）；make build-all 四进制产出；三进制实跑缺失配置
均 exit 1 且错误链保留 load {agent,relay,flared} config 原因；gofmt 干净。

refactor(cordis): 按功能职责拆分为 4 个插件与 share 共享层

backend/OpenFlare 不再平铺遗留分层，改为 plugins/{server,agent,relay,flared}
加 share/：控制面业务（openflare/admin/oauth/user/upload/cap/config/health 与
repository/model/infra/router 等支撑层）归 server；三个边缘守护进程各自成插件；
被两个以上插件消费的 protocol/geoip/wsclient/render/pagesarchive/edge 归 share。
同时把 pkg/util 与 buildinfo 合并回上游 pkg（上游已覆盖全部符号，仅 8 个函数与
2 个类型为 OpenFlare 独有，已一并迁入），装配根统一到 backend/cmd（含三个 daemon
入口），Dockerfile 与 release 工作流的构建路径和 -X 注入路径同步更新。

验证：go build 通过；go test ./... exit 0（141 包 ok）；make swagger exit 0 且
232 条 API 操作与基线逐条一致；make build-all 产出 4 进制；-X 注入经二进制
strings 实测生效；日志后端直连门禁改写为按 server 插件业务域扫描并在扫描数为 0
时报错（防门禁静默失效）；前端零改动。

feat(cordis): 落地 backend/share 共享层与上游同步脚本

跨插件共享资源（控制消息协议、GeoIP+iputil、边缘守护进程日志）从下游包
移入 backend/share，并声明其只能依赖 core/pkg 与标准/第三方库，禁止反向
引用下游业务与具体插件实现；新增 scripts/sync-upstream.sh 只覆盖
backend/{core,pkg,plugins}，同步后 --check 报告零差异，证明与上游逐字一致。

go build 通过，go test ./... exit 0（142 包 ok），前端零改动。

refactor(cordis): 采用与 Wavelet 同构的单模块布局并引入上游内核

按上游结构落位：backend/{core,pkg,plugins} 为 Wavelet 上游拷贝，OpenFlare
全部业务收拢到上游 downstream 所对应的位置 backend/OpenFlare/，模块名保持
Wavelet 以保证上游 import 路径逐字一致、同步零改写；三个 daemon 入口移至
backend/OpenFlare/cmd，backend/cmd 与 main.go 作为控制面装配根。

行为不变：go build 通过，142 个测试包全绿（含上游插件测试），232 条 API
操作与改造前逐条一致，四进制产物正常，前端零改动。swagger 暂只扫描下游代码，
待 P4 挂载上游路由后再纳入 plugins/。

style: 修正模块路径改写导致的 import 分组排序漂移

refactor(layout): Go 代码迁入 backend/ 并将模块名简化为 OpenFlare

对齐上游 Wavelet 的仓库布局，为以第二 module 形态 vendoring Cordis 内核与
平台插件做准备：模块路径整体改写为 OpenFlare，Go 目标加 cd backend，
swaggo 产物移至 backend/docs 并把 json/yaml 复制回 docs/ 供站点消费，
Dockerfile 与 release 工作流的构建目录、ldflags 模块路径同步更新。

行为保持不变：232 条路由与改造前逐条一致，95 个测试包全绿，
四进制产物正常，前端零改动。

chore(cordis): 落地改造计划与 schema/路由基线

新增 legacy_dump_test 迁移快照 harness：在临时 sqlite 库上按生产顺序
（goose.UpTo → zone 导入 → goose.Up）跑完 76 个历史迁移并导出 schema 与
版本序列，作为改造前后一致性门禁的唯一事实来源。同时记录 232 条路由清单
与 foundation 实施计划。

docs(cordis): add OpenFlare Cordis 架构改造设计

明确上游以第二 module 形态 vendoring 进 backend/Wavelet、4 个插件
(server/agent/relay/flared) 全部装载内核，并规定保留 76 个历史 goose
迁移 + 一次性版本 stamp 桥接的迁移方案，配套三方 schema 一致性门禁，
确保已部署库不重跑历史、不丢数据。

backend/plugins/infra/storage/objectstore/config.go

@@ -0,0 +1,258 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package objectstore provides dynamically configured file storage backends.
+package objectstore
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+// Driver identifies a supported storage backend.
+type Driver string
+
+const (
+	// DriverLocal stores files on the local filesystem.
+	DriverLocal Driver = "local"
+	// DriverS3 stores files in an S3-compatible object store.
+	DriverS3 Driver = "s3"
+	// DriverR2 stores files in Cloudflare R2.
+	DriverR2 Driver = "r2"
+	// DriverMinIO stores files in MinIO.
+	DriverMinIO Driver = "minio"
+	// DriverOSS stores files in Aliyun OSS.
+	DriverOSS Driver = "oss"
+	// DriverWebDAV stores files through WebDAV.
+	DriverWebDAV Driver = "webdav"
+
+	// ConfigMask replaces secrets returned to the frontend.
+	ConfigMask = "******"
+)
+
+// LocalConfig configures local filesystem storage.
+type LocalConfig struct {
+	Root string `json:"root"`
+}
+
+// ObjectConfig configures S3-compatible or OSS object storage.
+type ObjectConfig struct {
+	Endpoint        string `json:"endpoint"`
+	Region          string `json:"region"`
+	Bucket          string `json:"bucket"`
+	AccessKeyID     string `json:"access_key_id"`
+	SecretAccessKey string `json:"secret_access_key"`
+	AccountID       string `json:"account_id,omitempty"`
+	PathStyle       bool   `json:"path_style"`
+	KeyPrefix       string `json:"key_prefix"`
+	CDNURL          string `json:"cdn_url"`
+}
+
+// WebDAVConfig configures WebDAV storage.
+type WebDAVConfig struct {
+	Endpoint string `json:"endpoint"`
+	Username string `json:"username"`
+	Password string `json:"password"`
+	BasePath string `json:"base_path"`
+}
+
+// Config contains all storage backends and the currently active driver.
+type Config struct {
+	Driver Driver       `json:"driver"`
+	Local  LocalConfig  `json:"local"`
+	S3     ObjectConfig `json:"s3"`
+	R2     ObjectConfig `json:"r2"`
+	MinIO  ObjectConfig `json:"minio"`
+	OSS    ObjectConfig `json:"oss"`
+	WebDAV WebDAVConfig `json:"webdav"`
+}
+
+// DefaultConfig returns the local-storage default configuration.
+func DefaultConfig() Config {
+	return Config{
+		Driver: DriverLocal,
+		Local:  LocalConfig{Root: "."},
+		S3:     ObjectConfig{Region: "us-east-1"},
+		R2:     ObjectConfig{Region: "auto"},
+		MinIO:  ObjectConfig{Region: "us-east-1", PathStyle: true},
+	}
+}
+
+// LoadConfig loads the active storage configuration.
+func LoadConfig(ctx context.Context) (Config, error) {
+	pubSubOnce.Do(startPubSubListener)
+
+	cacheMutex.RLock()
+	isCacheValid := time.Since(lastChecked) < 5*time.Second && activeConfigJSON != ""
+	configJSON := activeConfigJSON
+	cacheMutex.RUnlock()
+
+	if isCacheValid {
+		cfg := DefaultConfig()
+		if strings.TrimSpace(configJSON) != "" {
+			if err := json.Unmarshal([]byte(configJSON), &cfg); err != nil {
+				return Config{}, fmt.Errorf("parse storage config from cache: %w", err)
+			}
+		}
+		return cfg, nil
+	}
+
+	return loadConfigByKey(ctx, "storage_config", DefaultConfig())
+}
+
+func loadConfigByKey(ctx context.Context, key string, fallback Config) (Config, error) {
+	var val string
+	db := getDB(ctx)
+	if db != nil {
+		err := db.Table("w_system_configs").Where("key = ?", key).Pluck("value", &val).Error
+		if err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return fallback, nil
+			}
+			return Config{}, err
+		}
+	}
+	if strings.TrimSpace(val) == "" {
+		return fallback, nil
+	}
+	if err := json.Unmarshal([]byte(val), &fallback); err != nil {
+		return Config{}, fmt.Errorf("parse %s: %w", key, err)
+	}
+	return fallback, nil
+}
+
+// ValidateConfig validates the selected backend configuration.
+func ValidateConfig(cfg Config) error {
+	switch cfg.Driver {
+	case DriverLocal:
+		if strings.TrimSpace(cfg.Local.Root) == "" {
+			return errors.New("local root is required")
+		}
+	case DriverS3:
+		return validateObjectConfig(cfg.S3, false)
+	case DriverR2:
+		if strings.TrimSpace(cfg.R2.AccountID) == "" && strings.TrimSpace(cfg.R2.Endpoint) == "" {
+			return errors.New("R2 account ID or endpoint is required")
+		}
+		return validateObjectConfig(cfg.R2, false)
+	case DriverMinIO:
+		if strings.TrimSpace(cfg.MinIO.Endpoint) == "" {
+			return errors.New("MinIO endpoint is required")
+		}
+		return validateObjectConfig(cfg.MinIO, true)
+	case DriverOSS:
+		if strings.TrimSpace(cfg.OSS.Endpoint) == "" {
+			return errors.New("OSS endpoint is required")
+		}
+		return validateObjectConfig(cfg.OSS, true)
+	case DriverWebDAV:
+		if strings.TrimSpace(cfg.WebDAV.Endpoint) == "" {
+			return errors.New("WebDAV endpoint is required")
+		}
+	default:
+		return fmt.Errorf("unsupported storage driver %q", cfg.Driver)
+	}
+	return nil
+}
+
+func validateObjectConfig(cfg ObjectConfig, endpointRequired bool) error {
+	if endpointRequired && strings.TrimSpace(cfg.Endpoint) == "" {
+		return errors.New("endpoint is required")
+	}
+	if strings.TrimSpace(cfg.Region) == "" {
+		return errors.New("region is required")
+	}
+	if strings.TrimSpace(cfg.Bucket) == "" {
+		return errors.New("bucket is required")
+	}
+	if strings.TrimSpace(cfg.AccessKeyID) == "" || strings.TrimSpace(cfg.SecretAccessKey) == "" {
+		return errors.New("access key ID and secret access key are required")
+	}
+	return nil
+}
+
+// SaveActiveConfig persists the active storage configuration.
+func SaveActiveConfig(ctx context.Context, cfg Config) error {
+	return saveSystemConfig(ctx, "storage_config", cfg, "文件存储驱动及连接配置（JSON）")
+}
+
+func saveSystemConfig(ctx context.Context, key string, value any, description string) error {
+	err := getDB(ctx).Transaction(func(tx *gorm.DB) error {
+		return upsertSystemConfig(ctx, tx, key, value, description)
+	})
+	if err == nil && key == "storage_config" {
+		ResetCache()
+		PublishCacheInvalidation(ctx)
+	}
+	return err
+}
+
+func upsertSystemConfig(_ context.Context, tx *gorm.DB, key string, value any, description string) error {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("marshal %s: %w", key, err)
+	}
+	type sysConfig struct {
+		Key         string `gorm:"primaryKey"`
+		Value       string
+		Type        string
+		Visibility  string
+		Description string
+	}
+	sc := sysConfig{
+		Key:         key,
+		Value:       string(data),
+		Type:        "system",
+		Visibility:  "hidden",
+		Description: description,
+	}
+	return tx.Table("w_system_configs").Where("key = ?", key).
+		Assign(map[string]any{"value": sc.Value, "description": description, "visibility": "hidden"}).
+		FirstOrCreate(&sc).Error
+}
+
+// MergeMaskedSecrets restores unchanged secrets from the current configuration.
+func MergeMaskedSecrets(next, current Config) Config {
+	mergeObjectSecret := func(dst *ObjectConfig, src ObjectConfig) {
+		if dst.AccessKeyID == ConfigMask {
+			dst.AccessKeyID = src.AccessKeyID
+		}
+		if dst.SecretAccessKey == ConfigMask {
+			dst.SecretAccessKey = src.SecretAccessKey
+		}
+	}
+	mergeObjectSecret(&next.S3, current.S3)
+	mergeObjectSecret(&next.R2, current.R2)
+	mergeObjectSecret(&next.MinIO, current.MinIO)
+	mergeObjectSecret(&next.OSS, current.OSS)
+	if next.WebDAV.Password == ConfigMask {
+		next.WebDAV.Password = current.WebDAV.Password
+	}
+	return next
+}
+
+// MaskSecrets replaces stored credentials with placeholders for API responses.
+func MaskSecrets(cfg Config) Config {
+	maskObject := func(value *ObjectConfig) {
+		if value.AccessKeyID != "" {
+			value.AccessKeyID = ConfigMask
+		}
+		if value.SecretAccessKey != "" {
+			value.SecretAccessKey = ConfigMask
+		}
+	}
+	maskObject(&cfg.S3)
+	maskObject(&cfg.R2)
+	maskObject(&cfg.MinIO)
+	maskObject(&cfg.OSS)
+	if cfg.WebDAV.Password != "" {
+		cfg.WebDAV.Password = ConfigMask
+	}
+	return cfg
+}

backend/plugins/infra/storage/objectstore/db_helper.go

@@ -0,0 +1,61 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"Wavelet/core"
+	"Wavelet/core/contracts"
+	"context"
+	"sync"
+
+	"gorm.io/gorm"
+)
+
+var (
+	dbMu     sync.RWMutex
+	dbSvc    contracts.DBService
+	cacheMu  sync.RWMutex
+	cacheSvc contracts.CacheService
+)
+
+// SetDBService sets the DBService instance for objectstore.
+func SetDBService(s contracts.DBService) {
+	dbMu.Lock()
+	defer dbMu.Unlock()
+	dbSvc = s
+}
+
+// SetCacheService sets the CacheService instance for objectstore.
+func SetCacheService(s contracts.CacheService) {
+	cacheMu.Lock()
+	defer cacheMu.Unlock()
+	cacheSvc = s
+}
+
+func getDB(ctx context.Context) *gorm.DB {
+	if c, ok := ctx.(*core.Context); ok && c != nil {
+		if s, err := core.Inject[contracts.DBService](c); err == nil && s != nil {
+			return s.DB(ctx)
+		}
+	}
+	dbMu.RLock()
+	s := dbSvc
+	dbMu.RUnlock()
+	if s != nil {
+		return s.DB(ctx)
+	}
+	return nil
+}
+
+func getCache(ctx context.Context) contracts.CacheService {
+	if c, ok := ctx.(*core.Context); ok && c != nil {
+		if s, err := core.Inject[contracts.CacheService](c); err == nil && s != nil {
+			return s
+		}
+	}
+	cacheMu.RLock()
+	s := cacheSvc
+	cacheMu.RUnlock()
+	return s
+}

backend/plugins/infra/storage/objectstore/http.go

@@ -0,0 +1,43 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"Wavelet/pkg/httppool"
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+func getHTTPObject(ctx context.Context, baseURL, key string) (*Object, error) {
+	objectURL, err := url.JoinPath(baseURL, key)
+	if err != nil {
+		return nil, fmt.Errorf("build CDN object URL: %w", err)
+	}
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, objectURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create CDN request: %w", err)
+	}
+	const cdnRequestTimeout = 30 * time.Second
+	client := httppool.NewClient(cdnRequestTimeout)
+	response, err := client.Do(request)
+	if err != nil {
+		return nil, fmt.Errorf("get CDN object: %w", err)
+	}
+	if response.StatusCode != http.StatusOK {
+		_ = response.Body.Close()
+		return nil, fmt.Errorf("get CDN object: unexpected status %d", response.StatusCode)
+	}
+	contentType := response.Header.Get("Content-Type")
+	if contentType == "" {
+		contentType = defaultContentType
+	}
+	return &Object{
+		Body:          response.Body,
+		ContentLength: response.ContentLength,
+		ContentType:   contentType,
+	}, nil
+}

backend/plugins/infra/storage/objectstore/local.go

@@ -0,0 +1,120 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type localBackend struct {
+	root string
+}
+
+func newLocalBackend(cfg LocalConfig) (*localBackend, error) {
+	root := filepath.Clean(cfg.Root)
+	if root == "" {
+		return nil, fmt.Errorf("local root is required")
+	}
+	return &localBackend{root: root}, nil
+}
+
+func (b *localBackend) Put(_ context.Context, key string, body io.Reader, _ int64, _ string) (PutResult, error) {
+	path, err := b.path(key)
+	if err != nil {
+		return PutResult{}, err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), storageDirPerm); err != nil {
+		return PutResult{}, err
+	}
+	file, err := os.OpenFile( //nolint:gosec // path is constrained to the configured storage root.
+		path,
+		os.O_CREATE|os.O_TRUNC|os.O_WRONLY,
+		storageFilePerm,
+	)
+	if err != nil {
+		return PutResult{}, err
+	}
+	if _, err := io.Copy(file, body); err != nil {
+		_ = file.Close()
+		_ = os.Remove(path)
+		return PutResult{}, err
+	}
+	if err := file.Close(); err != nil {
+		_ = os.Remove(path)
+		return PutResult{}, err
+	}
+	return PutResult{Key: filepath.ToSlash(key)}, nil
+}
+
+func (b *localBackend) Get(_ context.Context, key string) (*Object, error) {
+	path, err := b.path(key)
+	if err != nil {
+		return nil, err
+	}
+	file, err := os.Open(path) //nolint:gosec // path is constrained to the configured storage root.
+	if err != nil {
+		return nil, err
+	}
+	info, err := file.Stat()
+	if err != nil {
+		_ = file.Close()
+		return nil, err
+	}
+	contentType := mime.TypeByExtension(filepath.Ext(path))
+	if contentType == "" {
+		contentType = defaultContentType
+	}
+	return &Object{Body: file, ContentLength: info.Size(), ContentType: contentType}, nil
+}
+
+func (b *localBackend) Delete(_ context.Context, key string) error {
+	path, err := b.path(key)
+	if err != nil {
+		return err
+	}
+	err = os.Remove(path)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	return err
+}
+
+func (b *localBackend) Test(_ context.Context) error {
+	return os.MkdirAll(b.root, storageDirPerm)
+}
+
+func (b *localBackend) path(key string) (string, error) {
+	if filepath.IsAbs(key) {
+		cleanPath := filepath.Clean(key)
+		absRoot, err := filepath.Abs(b.root)
+		if err != nil {
+			return "", err
+		}
+		absPath, err := filepath.Abs(cleanPath)
+		if err != nil {
+			return "", err
+		}
+		rel, err := filepath.Rel(absRoot, absPath)
+		if err != nil || strings.HasPrefix(rel, "..") {
+			return "", fmt.Errorf("storage key escapes local root")
+		}
+		return cleanPath, nil
+	}
+	cleanKey := filepath.Clean(filepath.FromSlash(strings.TrimPrefix(key, "/")))
+	if cleanKey == "." || cleanKey == "" || strings.HasPrefix(cleanKey, "..") {
+		return "", fmt.Errorf("invalid local storage key %q", key)
+	}
+	path := filepath.Join(b.root, cleanKey)
+	rel, err := filepath.Rel(b.root, path)
+	if err != nil || strings.HasPrefix(rel, "..") {
+		return "", fmt.Errorf("storage key escapes local root")
+	}
+	return path, nil
+}

backend/plugins/infra/storage/objectstore/local_test.go

@@ -0,0 +1,51 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"testing"
+)
+
+func TestLocalBackendRoundTrip(t *testing.T) {
+	backend, err := newLocalBackend(LocalConfig{Root: t.TempDir()})
+	if err != nil {
+		t.Fatalf("newLocalBackend() returned error: %v", err)
+	}
+	ctx := context.Background()
+	const key = "uploads/2026/06/13/test.txt"
+	const content = "wavelet storage"
+
+	storedResult, err := backend.Put(ctx, key, bytes.NewBufferString(content), int64(len(content)), "text/plain")
+	if err != nil {
+		t.Fatalf("Put(%q) returned error: %v", key, err)
+	}
+	if storedResult.Key != key {
+		t.Errorf("Put(%q) key = %q, want %q", key, storedResult.Key, key)
+	}
+
+	object, err := backend.Get(ctx, key)
+	if err != nil {
+		t.Fatalf("Get(%q) returned error: %v", key, err)
+	}
+	got, err := io.ReadAll(object.Body)
+	if err != nil {
+		t.Fatalf("ReadAll(Get(%q)) returned error: %v", key, err)
+	}
+	if err := object.Body.Close(); err != nil {
+		t.Fatalf("Close(Get(%q)) returned error: %v", key, err)
+	}
+	if string(got) != content {
+		t.Errorf("Get(%q) content = %q, want %q", key, got, content)
+	}
+
+	if err := backend.Delete(ctx, key); err != nil {
+		t.Fatalf("Delete(%q) returned error: %v", key, err)
+	}
+	if _, err := backend.Get(ctx, key); err == nil {
+		t.Errorf("Get(%q) after Delete() returned nil error", key)
+	}
+}

backend/plugins/infra/storage/objectstore/oss.go

@@ -0,0 +1,98 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
+	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
+)
+
+type ossBackend struct {
+	client    *oss.Client
+	bucket    string
+	keyPrefix string
+	cdnURL    string
+}
+
+func newOSSBackend(cfg ObjectConfig) (*ossBackend, error) {
+	options := oss.LoadDefaultConfig().
+		WithCredentialsProvider(credentials.NewStaticCredentialsProvider(cfg.AccessKeyID, cfg.SecretAccessKey)).
+		WithRegion(cfg.Region)
+	if cfg.Endpoint != "" {
+		options.WithEndpoint(cfg.Endpoint)
+	}
+	return &ossBackend{
+		client:    oss.NewClient(options),
+		bucket:    cfg.Bucket,
+		keyPrefix: strings.Trim(cfg.KeyPrefix, "/"),
+		cdnURL:    strings.TrimRight(cfg.CDNURL, "/"),
+	}, nil
+}
+
+func (b *ossBackend) Put(ctx context.Context, key string, body io.Reader, _ int64, _ string) (PutResult, error) {
+	key = b.key(key)
+	_, err := b.client.PutObject(ctx, &oss.PutObjectRequest{
+		Bucket: oss.Ptr(b.bucket),
+		Key:    oss.Ptr(key),
+		Body:   body,
+	})
+	if err != nil {
+		return PutResult{}, fmt.Errorf("put OSS object: %w", err)
+	}
+	return PutResult{Key: key, Bucket: b.bucket}, nil
+}
+
+func (b *ossBackend) Get(ctx context.Context, key string) (*Object, error) {
+	key = b.key(key)
+	if b.cdnURL != "" {
+		return getHTTPObject(ctx, b.cdnURL, key)
+	}
+	output, err := b.client.GetObject(ctx, &oss.GetObjectRequest{
+		Bucket: oss.Ptr(b.bucket),
+		Key:    oss.Ptr(key),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("get OSS object: %w", err)
+	}
+	contentType := defaultContentType
+	if output.ContentType != nil {
+		contentType = *output.ContentType
+	}
+	return &Object{Body: output.Body, ContentLength: output.ContentLength, ContentType: contentType}, nil
+}
+
+func (b *ossBackend) Delete(ctx context.Context, key string) error {
+	_, err := b.client.DeleteObject(ctx, &oss.DeleteObjectRequest{
+		Bucket: oss.Ptr(b.bucket),
+		Key:    oss.Ptr(b.key(key)),
+	})
+	if err != nil {
+		return fmt.Errorf("delete OSS object: %w", err)
+	}
+	return nil
+}
+
+func (b *ossBackend) Test(ctx context.Context) error {
+	ok, err := b.client.IsBucketExist(ctx, b.bucket)
+	if err != nil {
+		return fmt.Errorf("access OSS bucket: %w", err)
+	}
+	if !ok {
+		return fmt.Errorf("OSS bucket %q does not exist", b.bucket)
+	}
+	return nil
+}
+
+func (b *ossBackend) key(key string) string {
+	key = strings.TrimLeft(key, "/")
+	if b.keyPrefix == "" || strings.HasPrefix(key, b.keyPrefix+"/") {
+		return key
+	}
+	return b.keyPrefix + "/" + key
+}

backend/plugins/infra/storage/objectstore/s3.go

@@ -0,0 +1,122 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+)
+
+type s3Backend struct {
+	client    *s3.Client
+	bucket    string
+	keyPrefix string
+	cdnURL    string
+}
+
+func newS3Backend(ctx context.Context, cfg ObjectConfig) (*s3Backend, error) {
+	awsCfg, err := awsconfig.LoadDefaultConfig(ctx,
+		awsconfig.WithRegion(cfg.Region),
+		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			cfg.AccessKeyID,
+			cfg.SecretAccessKey,
+			"",
+		)),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("load S3 config: %w", err)
+	}
+	client := s3.NewFromConfig(awsCfg, func(options *s3.Options) {
+		if cfg.Endpoint != "" {
+			options.BaseEndpoint = aws.String(strings.TrimRight(cfg.Endpoint, "/"))
+		}
+		options.UsePathStyle = cfg.PathStyle
+	})
+	return &s3Backend{
+		client:    client,
+		bucket:    cfg.Bucket,
+		keyPrefix: strings.Trim(cfg.KeyPrefix, "/"),
+		cdnURL:    strings.TrimRight(cfg.CDNURL, "/"),
+	}, nil
+}
+
+func newR2Backend(ctx context.Context, cfg ObjectConfig) (*s3Backend, error) {
+	if cfg.Endpoint == "" {
+		cfg.Endpoint = fmt.Sprintf("https://%s.r2.cloudflarestorage.com", cfg.AccountID)
+	}
+	cfg.Region = "auto"
+	return newS3Backend(ctx, cfg)
+}
+
+func (b *s3Backend) Put(ctx context.Context, key string, body io.Reader, size int64, contentType string) (PutResult, error) {
+	key = b.key(key)
+	_, err := b.client.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:        aws.String(b.bucket),
+		Key:           aws.String(key),
+		Body:          body,
+		ContentLength: aws.Int64(size),
+		ContentType:   aws.String(contentType),
+	})
+	if err != nil {
+		return PutResult{}, fmt.Errorf("put S3 object: %w", err)
+	}
+	return PutResult{Key: key, Bucket: b.bucket}, nil
+}
+
+func (b *s3Backend) Get(ctx context.Context, key string) (*Object, error) {
+	key = b.key(key)
+	if b.cdnURL != "" {
+		return getHTTPObject(ctx, b.cdnURL, key)
+	}
+	output, err := b.client.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(b.bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("get S3 object: %w", err)
+	}
+	contentType := defaultContentType
+	if output.ContentType != nil {
+		contentType = *output.ContentType
+	}
+	var size int64
+	if output.ContentLength != nil {
+		size = *output.ContentLength
+	}
+	return &Object{Body: output.Body, ContentLength: size, ContentType: contentType}, nil
+}
+
+func (b *s3Backend) Delete(ctx context.Context, key string) error {
+	_, err := b.client.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(b.bucket),
+		Key:    aws.String(b.key(key)),
+	})
+	if err != nil {
+		return fmt.Errorf("delete S3 object: %w", err)
+	}
+	return nil
+}
+
+func (b *s3Backend) Test(ctx context.Context) error {
+	_, err := b.client.HeadBucket(ctx, &s3.HeadBucketInput{Bucket: aws.String(b.bucket)})
+	if err != nil {
+		return fmt.Errorf("access S3 bucket: %w", err)
+	}
+	return nil
+}
+
+func (b *s3Backend) key(key string) string {
+	key = strings.TrimLeft(key, "/")
+	if b.keyPrefix == "" || strings.HasPrefix(key, b.keyPrefix+"/") {
+		return key
+	}
+	return b.keyPrefix + "/" + key
+}

backend/plugins/infra/storage/objectstore/storage.go

@@ -0,0 +1,212 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	defaultContentType = "application/octet-stream"
+	storageDirPerm     = 0o750
+	storageFilePerm    = 0o600
+)
+
+// Object describes a readable stored object.
+type Object struct {
+	Key           string
+	CachePath     string
+	Body          io.ReadCloser
+	ContentLength int64
+	ContentType   string
+}
+
+// PutResult describes the result of a successful Put operation.
+type PutResult struct {
+	Key    string
+	Bucket string
+}
+
+// Backend defines storage operations used by the upload domain.
+type Backend interface {
+	Put(ctx context.Context, key string, body io.Reader, size int64, contentType string) (PutResult, error)
+	Get(ctx context.Context, key string) (*Object, error)
+	Delete(ctx context.Context, key string) error
+	Test(ctx context.Context) error
+}
+
+var (
+	cacheMutex       sync.RWMutex
+	activeDriver     Driver
+	activeBackend    Backend
+	activeConfigJSON string
+	lastChecked      time.Time
+	pubSubOnce       sync.Once
+
+	mockBackend Backend
+
+	// IsEnabledFunc controls whether mock/in-memory backend is activated in tests.
+	IsEnabledFunc = func() bool { return false }
+)
+
+// ConfigInvalidationChannel is the Redis pub/sub channel used to evict storage caches cluster-wide.
+const ConfigInvalidationChannel = "storage:config_invalidation"
+
+// SetMockBackend forces an in-memory/mock backend for testing.
+func SetMockBackend(b Backend) {
+	mockBackend = b
+}
+
+// ResetCache clears cached driver and backend instances.
+func ResetCache() {
+	cacheMutex.Lock()
+	defer cacheMutex.Unlock()
+	activeBackend = nil
+	activeDriver = ""
+	activeConfigJSON = ""
+	lastChecked = time.Time{}
+}
+
+// PublishCacheInvalidation broadcasts cache eviction to all nodes in the cluster via Redis.
+func PublishCacheInvalidation(ctx context.Context) {
+	if cache := getCache(ctx); cache != nil {
+		_ = cache.Invalidate(ctx, ConfigInvalidationChannel)
+	}
+	ResetCache()
+}
+
+// startPubSubListener starts the background subscriber for cache invalidations.
+func startPubSubListener() {
+}
+
+// Active returns the configured active driver and backend, using an in-memory cache with 5s TTL.
+func Active(ctx context.Context) (Driver, Backend, error) {
+	if IsEnabledFunc() && mockBackend != nil {
+		return DriverS3, mockBackend, nil
+	}
+
+	pubSubOnce.Do(startPubSubListener)
+
+	cacheMutex.RLock()
+	isCacheValid := time.Since(lastChecked) < 5*time.Second && activeBackend != nil
+	if isCacheValid {
+		d, b := activeDriver, activeBackend
+		cacheMutex.RUnlock()
+		return d, b, nil
+	}
+	cacheMutex.RUnlock()
+
+	cacheMutex.Lock()
+	defer cacheMutex.Unlock()
+
+	// Double-check under write lock
+	if time.Since(lastChecked) < 5*time.Second && activeBackend != nil {
+		return activeDriver, activeBackend, nil
+	}
+
+	var val string
+	db := getDB(ctx)
+	if db != nil {
+		err := db.Table("w_system_configs").Where("key = ?", "storage_config").Pluck("value", &val).Error
+		if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+			return "", nil, err
+		}
+	}
+	sc := struct{ Value string }{Value: val}
+
+	lastChecked = time.Now()
+
+	// Reuse existing backend client singleton if configuration JSON matches
+	if sc.Value == activeConfigJSON && activeBackend != nil {
+		return activeDriver, activeBackend, nil
+	}
+
+	cfg := DefaultConfig()
+	if strings.TrimSpace(sc.Value) != "" {
+		if err := json.Unmarshal([]byte(sc.Value), &cfg); err != nil {
+			return "", nil, fmt.Errorf("parse storage config: %w", err)
+		}
+	}
+
+	backend, err := NewBackend(ctx, cfg, cfg.Driver)
+	if err != nil {
+		return "", nil, err
+	}
+
+	activeDriver = cfg.Driver
+	activeBackend = backend
+	activeConfigJSON = sc.Value
+
+	return activeDriver, activeBackend, nil
+}
+
+type functionBackend struct {
+	put    func(context.Context, string, io.Reader, int64, string) error
+	get    func(context.Context, string) (*Object, error)
+	delete func(context.Context, string) error
+}
+
+func (b *functionBackend) Put(ctx context.Context, key string, body io.Reader, size int64, contentType string) (PutResult, error) {
+	if err := b.put(ctx, key, body, size, contentType); err != nil {
+		return PutResult{}, err
+	}
+	return PutResult{Key: key}, nil
+}
+
+func (b *functionBackend) Get(ctx context.Context, key string) (*Object, error) {
+	return b.get(ctx, key)
+}
+
+func (b *functionBackend) Delete(ctx context.Context, key string) error {
+	return b.delete(ctx, key)
+}
+
+func (b *functionBackend) Test(context.Context) error {
+	return nil
+}
+
+// MockStorage replaces object operations for package tests and returns a restore function.
+func MockStorage(
+	put func(context.Context, string, io.Reader, int64, string) error,
+	get func(context.Context, string) (*Object, error),
+	deleteObject func(context.Context, string) error,
+) func() {
+	previous := mockBackend
+	mockBackend = &functionBackend{put: put, get: get, delete: deleteObject}
+	return func() {
+		mockBackend = previous
+	}
+}
+
+// NewBackend constructs a concrete backend from configuration.
+func NewBackend(ctx context.Context, cfg Config, driver Driver) (Backend, error) {
+	if driver == DriverS3 && mockBackend != nil {
+		return mockBackend, nil
+	}
+	switch driver {
+	case DriverLocal:
+		return newLocalBackend(cfg.Local)
+	case DriverS3:
+		return newS3Backend(ctx, cfg.S3)
+	case DriverR2:
+		return newR2Backend(ctx, cfg.R2)
+	case DriverMinIO:
+		return newS3Backend(ctx, cfg.MinIO)
+	case DriverOSS:
+		return newOSSBackend(cfg.OSS)
+	case DriverWebDAV:
+		return newWebDAVBackend(cfg.WebDAV)
+	default:
+		return nil, fmt.Errorf("unsupported storage driver %q", driver)
+	}
+}

backend/plugins/infra/storage/objectstore/storage_test.go

@@ -0,0 +1,144 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/redis/go-redis/v9"
+
+	cache "Wavelet/plugins/infra/cache"
+)
+
+func TestStorageCache(t *testing.T) {
+	// 1. Reset cache
+	ResetCache()
+
+	if activeConfigJSON != "" || activeDriver != "" || activeBackend != nil || !lastChecked.IsZero() {
+		t.Fatal("ResetCache did not clear cache variables")
+	}
+
+	// 2. Set up cache manually
+	expectedConfig := Config{
+		Driver: DriverLocal,
+		Local:  LocalConfig{Root: "/tmp/wavelet-test"},
+	}
+	cfgJSON, err := json.Marshal(expectedConfig)
+	if err != nil {
+		t.Fatalf("Marshal config failed: %v", err)
+	}
+
+	cacheMutex.Lock()
+	activeConfigJSON = string(cfgJSON)
+	lastChecked = time.Now()
+	cacheMutex.Unlock()
+
+	// 3. Call LoadConfig and verify it loads from cache (doesn't hit database, which would fail/panic because DB is not initialized)
+	ctx := context.Background()
+	loadedCfg, err := LoadConfig(ctx)
+	if err != nil {
+		t.Fatalf("LoadConfig failed: %v", err)
+	}
+
+	if loadedCfg.Driver != expectedConfig.Driver || loadedCfg.Local.Root != expectedConfig.Local.Root {
+		t.Errorf("Loaded config %+v, expected %+v", loadedCfg, expectedConfig)
+	}
+
+	// 4. Test Active() returns cached driver and backend
+	mockBnd := &functionBackend{
+		put:    func(context.Context, string, io.Reader, int64, string) error { return nil },
+		get:    func(context.Context, string) (*Object, error) { return nil, nil },
+		delete: func(context.Context, string) error { return nil },
+	}
+
+	cacheMutex.Lock()
+	activeBackend = mockBnd
+	activeDriver = DriverLocal
+	cacheMutex.Unlock()
+
+	drv, bnd, err := Active(ctx)
+	if err != nil {
+		t.Fatalf("Active failed: %v", err)
+	}
+	if drv != DriverLocal || bnd != mockBnd {
+		t.Errorf("Active returned driver %v, backend %v; expected %v, %v", drv, bnd, DriverLocal, mockBnd)
+	}
+
+	// 5. Test ResetCache again
+	ResetCache()
+	if activeConfigJSON != "" || activeDriver != "" || activeBackend != nil || !lastChecked.IsZero() {
+		t.Fatal("ResetCache did not clear cache variables after setting them")
+	}
+}
+
+func TestStorageCachePubSub(t *testing.T) {
+	// 1. Start miniredis
+	mr, err := miniredis.Run()
+	if err != nil {
+		t.Fatalf("Failed to run miniredis: %v", err)
+	}
+	defer mr.Close()
+
+	// 2. Initialize Redis client
+	rdb := redis.NewClient(&redis.Options{
+		Addr: mr.Addr(),
+	})
+	defer rdb.Close()
+
+	// 3. Set cache.Redis to our client
+	oldRedis := cache.Redis
+	cache.Redis = rdb
+	defer func() {
+		cache.Redis = oldRedis
+	}()
+
+	// Reset cache and set some cached config
+	ResetCache()
+	cacheMutex.Lock()
+	activeConfigJSON = "some_config"
+	lastChecked = time.Now()
+	cacheMutex.Unlock()
+
+	// 4. Force trigger lazy initialization of subscription
+	// Reset the once guard so it runs the listener
+	pubSubOnce = sync.Once{}
+	ctx := context.Background()
+
+	// Create mock backend for Active call
+	mockBnd := &functionBackend{
+		put:    func(context.Context, string, io.Reader, int64, string) error { return nil },
+		get:    func(context.Context, string) (*Object, error) { return nil, nil },
+		delete: func(context.Context, string) error { return nil },
+	}
+	cacheMutex.Lock()
+	activeBackend = mockBnd
+	activeDriver = DriverLocal
+	cacheMutex.Unlock()
+
+	_, _, _ = Active(ctx) // This calls startPubSubListener()
+
+	// Allow some time for subscriber connection
+	time.Sleep(100 * time.Millisecond)
+
+	// 5. Publish cache invalidation
+	PublishCacheInvalidation(ctx)
+
+	// Allow message propagation
+	time.Sleep(100 * time.Millisecond)
+
+	// 6. Verify cache was cleared
+	cacheMutex.RLock()
+	configJSON := activeConfigJSON
+	cacheMutex.RUnlock()
+
+	if configJSON != "" {
+		t.Error("Memory cache was not cleared after Redis Pub/Sub broadcast")
+	}
+}

backend/plugins/infra/storage/objectstore/webdav.go

@@ -0,0 +1,102 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package objectstore
+
+import (
+	"Wavelet/pkg/httppool"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/studio-b12/gowebdav"
+)
+
+type contextTransport struct {
+	ctx    context.Context
+	parent http.RoundTripper
+}
+
+func (t *contextTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return t.parent.RoundTrip(req.WithContext(t.ctx))
+}
+
+type webDAVBackend struct {
+	endpoint string
+	username string
+	password string
+	basePath string
+}
+
+func newWebDAVBackend(cfg WebDAVConfig) (*webDAVBackend, error) {
+	return &webDAVBackend{
+		endpoint: strings.TrimRight(cfg.Endpoint, "/"),
+		username: cfg.Username,
+		password: cfg.Password,
+		basePath: strings.Trim(cfg.BasePath, "/"),
+	}, nil
+}
+
+func (b *webDAVBackend) newClient(ctx context.Context) *gowebdav.Client {
+	client := gowebdav.NewClient(b.endpoint, b.username, b.password)
+	client.SetTransport(&contextTransport{
+		ctx:    ctx,
+		parent: httppool.DefaultTransport(),
+	})
+	return client
+}
+
+func (b *webDAVBackend) Put(ctx context.Context, key string, body io.Reader, size int64, _ string) (PutResult, error) {
+	key = b.key(key)
+	client := b.newClient(ctx)
+	if dir := path.Dir(key); dir != "." && dir != "/" {
+		if err := client.MkdirAll(dir, storageDirPerm); err != nil {
+			return PutResult{}, fmt.Errorf("create WebDAV directory: %w", err)
+		}
+	}
+	if err := client.WriteStreamWithLength(key, body, size, storageFilePerm); err != nil {
+		return PutResult{}, fmt.Errorf("put WebDAV object: %w", err)
+	}
+	return PutResult{Key: key}, nil
+}
+
+func (b *webDAVBackend) Get(ctx context.Context, key string) (*Object, error) {
+	key = b.key(key)
+	client := b.newClient(ctx)
+	info, err := client.Stat(key)
+	if err != nil {
+		return nil, fmt.Errorf("stat WebDAV object: %w", err)
+	}
+	body, err := client.ReadStream(key)
+	if err != nil {
+		return nil, fmt.Errorf("get WebDAV object: %w", err)
+	}
+	contentType := defaultContentType
+	if typed, ok := info.(interface{ ContentType() string }); ok && typed.ContentType() != "" {
+		contentType = typed.ContentType()
+	}
+	return &Object{Body: body, ContentLength: info.Size(), ContentType: contentType}, nil
+}
+
+func (b *webDAVBackend) Delete(ctx context.Context, key string) error {
+	client := b.newClient(ctx)
+	if err := client.Remove(b.key(key)); err != nil {
+		return fmt.Errorf("delete WebDAV object: %w", err)
+	}
+	return nil
+}
+
+func (b *webDAVBackend) Test(ctx context.Context) error {
+	client := b.newClient(ctx)
+	if err := client.Connect(); err != nil {
+		return fmt.Errorf("connect WebDAV: %w", err)
+	}
+	return nil
+}
+
+func (b *webDAVBackend) key(key string) string {
+	return "/" + path.Join(b.basePath, strings.TrimLeft(key, "/"))
+}