diff --git a/app/cli/internal/action/ocirepository_save.go b/app/cli/internal/action/ocirepository_save.go
index 7e235efc4..3ac5c6c6b 100644
--- a/app/cli/internal/action/ocirepository_save.go
+++ b/app/cli/internal/action/ocirepository_save.go
@@ -36,6 +36,8 @@ type NewOCIRepositorySaveOpts struct {
 func (action *OCIRepositorySave) Run(opts *NewOCIRepositorySaveOpts) error {
 	client := pb.NewOCIRepositoryServiceClient(action.cfg.CPConnection)
 
+	// Disable SA1019: client.Save is deprecated: Do not use. Save the OCI repository overriding the existing one (for now) (staticcheck)
+	//nolint:staticcheck
 	_, err := client.Save(context.Background(), &pb.OCIRepositoryServiceSaveRequest{
 		Repository: opts.Repo,
 		// We currently only support raw keypairs, which does not include AWS keyparis
diff --git a/app/controlplane/Makefile b/app/controlplane/Makefile
index b8ad1b353..49281eb77 100644
--- a/app/controlplane/Makefile
+++ b/app/controlplane/Makefile
@@ -37,6 +37,10 @@ migration_apply: check-atlas-tool
 migration_new: check-atlas-tool
 	atlas migrate diff --dir ${local_migrations_dir} --to "ent://internal/data/ent/schema" --dev-url "docker://postgres/15/test?search_path=public"
 
+.PHONY: migration_hash
+migration_hash: check-atlas-tool
+	atlas migrate hash --dir ${local_migrations_dir}
+
 .PHONY: test
 # All tests, both unit and integration
 test: 
diff --git a/app/controlplane/api/buf.gen.yaml b/app/controlplane/api/buf.gen.yaml
index c8317fd56..9ff440fd1 100644
--- a/app/controlplane/api/buf.gen.yaml
+++ b/app/controlplane/api/buf.gen.yaml
@@ -16,7 +16,7 @@ plugins:
   - name: validate
     out: .
     opt: paths=source_relative,lang=go
-  - remote: buf.build/stephenh/plugins/ts-proto
+  - plugin: buf.build/community/stephenh-ts-proto:v1.151.1
     out: ./gen/frontend
     opt:
       - outputClientImpl=grpc-web # client implementation it generates
diff --git a/app/controlplane/api/controlplane/v1/oci_repository.pb.go b/app/controlplane/api/controlplane/v1/oci_repository.pb.go
index 439f7ddc9..be434f6d5 100644
--- a/app/controlplane/api/controlplane/v1/oci_repository.pb.go
+++ b/app/controlplane/api/controlplane/v1/oci_repository.pb.go
@@ -297,21 +297,21 @@ var file_controlplane_v1_oci_repository_proto_rawDesc = []byte{
 	0x45, 0x93, 0x03, 0x12, 0x2d, 0x0a, 0x23, 0x4f, 0x43, 0x49, 0x5f, 0x52, 0x45, 0x50, 0x4f, 0x53,
 	0x49, 0x54, 0x4f, 0x52, 0x59, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53,
 	0x4f, 0x4e, 0x5f, 0x49, 0x4e, 0x56, 0x41, 0x4c, 0x49, 0x44, 0x10, 0x02, 0x1a, 0x04, 0xb0, 0x45,
-	0x93, 0x03, 0x1a, 0x04, 0xa8, 0x45, 0xf4, 0x03, 0x32, 0x83, 0x01, 0x0a, 0x14, 0x4f, 0x43, 0x49,
+	0x93, 0x03, 0x1a, 0x04, 0xa8, 0x45, 0xf4, 0x03, 0x32, 0x88, 0x01, 0x0a, 0x14, 0x4f, 0x43, 0x49,
 	0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x6b, 0x0a, 0x04, 0x53, 0x61, 0x76, 0x65, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x12, 0x70, 0x0a, 0x04, 0x53, 0x61, 0x76, 0x65, 0x12, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
 	0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x43, 0x49, 0x52,
 	0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
 	0x53, 0x61, 0x76, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x31, 0x2e, 0x63, 0x6f,
 	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x43,
 	0x49, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x53, 0x61, 0x76, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x4c,
-	0x5a, 0x4a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x68, 0x61,
-	0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76, 0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e,
-	0x6c, 0x6f, 0x6f, 0x70, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
-	0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
-	0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x63, 0x65, 0x53, 0x61, 0x76, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03,
+	0x88, 0x02, 0x01, 0x42, 0x4c, 0x5a, 0x4a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76, 0x2f,
+	0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x76,
+	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/app/controlplane/api/controlplane/v1/oci_repository.proto b/app/controlplane/api/controlplane/v1/oci_repository.proto
index 7156c57d2..b65963101 100644
--- a/app/controlplane/api/controlplane/v1/oci_repository.proto
+++ b/app/controlplane/api/controlplane/v1/oci_repository.proto
@@ -23,7 +23,11 @@ import "errors/v1/errors.proto";
 
 service OCIRepositoryService {
 	// Save the OCI repository overriding the existing one (for now)
-	rpc Save (OCIRepositoryServiceSaveRequest) returns (OCIRepositoryServiceSaveResponse);
+	rpc Save (OCIRepositoryServiceSaveRequest) returns (OCIRepositoryServiceSaveResponse) {
+		// Will get replaced by CASBackends API endpoint
+		// We are maintaining this for compatibility reasons with old CLIs
+		option deprecated = true;
+	}
 }
 
 message OCIRepositoryServiceSaveRequest {
diff --git a/app/controlplane/api/controlplane/v1/oci_repository_grpc.pb.go b/app/controlplane/api/controlplane/v1/oci_repository_grpc.pb.go
index eac3cfb4d..ca314d73a 100644
--- a/app/controlplane/api/controlplane/v1/oci_repository_grpc.pb.go
+++ b/app/controlplane/api/controlplane/v1/oci_repository_grpc.pb.go
@@ -41,6 +41,7 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type OCIRepositoryServiceClient interface {
+	// Deprecated: Do not use.
 	// Save the OCI repository overriding the existing one (for now)
 	Save(ctx context.Context, in *OCIRepositoryServiceSaveRequest, opts ...grpc.CallOption) (*OCIRepositoryServiceSaveResponse, error)
 }
@@ -53,6 +54,7 @@ func NewOCIRepositoryServiceClient(cc grpc.ClientConnInterface) OCIRepositorySer
 	return &oCIRepositoryServiceClient{cc}
 }
 
+// Deprecated: Do not use.
 func (c *oCIRepositoryServiceClient) Save(ctx context.Context, in *OCIRepositoryServiceSaveRequest, opts ...grpc.CallOption) (*OCIRepositoryServiceSaveResponse, error) {
 	out := new(OCIRepositoryServiceSaveResponse)
 	err := c.cc.Invoke(ctx, OCIRepositoryService_Save_FullMethodName, in, out, opts...)
@@ -66,6 +68,7 @@ func (c *oCIRepositoryServiceClient) Save(ctx context.Context, in *OCIRepository
 // All implementations must embed UnimplementedOCIRepositoryServiceServer
 // for forward compatibility
 type OCIRepositoryServiceServer interface {
+	// Deprecated: Do not use.
 	// Save the OCI repository overriding the existing one (for now)
 	Save(context.Context, *OCIRepositoryServiceSaveRequest) (*OCIRepositoryServiceSaveResponse, error)
 	mustEmbedUnimplementedOCIRepositoryServiceServer()
diff --git a/app/controlplane/api/controlplane/v1/status_http.pb.go b/app/controlplane/api/controlplane/v1/status_http.pb.go
index d5b35a971..c9fc1fe05 100644
--- a/app/controlplane/api/controlplane/v1/status_http.pb.go
+++ b/app/controlplane/api/controlplane/v1/status_http.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-http. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-http v2.6.2
+// - protoc-gen-go-http v2.6.3
 // - protoc             (unknown)
 // source: controlplane/v1/status.proto
 
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/auth.ts b/app/controlplane/api/gen/frontend/controlplane/v1/auth.ts
index 7b76bfd53..9367fa24f 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/auth.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/auth.ts
@@ -30,7 +30,7 @@ export const AuthServiceDeleteAccountRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -74,7 +74,7 @@ export const AuthServiceDeleteAccountResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/cas_credentials.ts b/app/controlplane/api/gen/frontend/controlplane/v1/cas_credentials.ts
index d404ddbe3..0408ce65e 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/cas_credentials.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/cas_credentials.ts
@@ -76,14 +76,14 @@ export const CASCredentialsServiceGetRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.role = reader.int32() as any;
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -134,14 +134,14 @@ export const CASCredentialsServiceGetResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = CASCredentialsServiceGetResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -199,14 +199,14 @@ export const CASCredentialsServiceGetResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.token = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/context.ts b/app/controlplane/api/gen/frontend/controlplane/v1/context.ts
index 89e4cf2f7..2757bb89b 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/context.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/context.ts
@@ -36,7 +36,7 @@ export const ContextServiceCurrentRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -83,14 +83,14 @@ export const ContextServiceCurrentResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = ContextServiceCurrentResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -150,28 +150,28 @@ export const ContextServiceCurrentResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.currentUser = User.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.currentOrg = Org.decode(reader, reader.uint32());
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.currentOciRepo = OCIRepositoryItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/integrations.ts b/app/controlplane/api/gen/frontend/controlplane/v1/integrations.ts
index d70f67855..33c1dd533 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/integrations.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/integrations.ts
@@ -145,28 +145,28 @@ export const IntegrationsServiceRegisterRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.pluginId = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.config = Struct.unwrap(Struct.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.description = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -227,14 +227,14 @@ export const IntegrationsServiceRegisterResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = RegisteredIntegrationItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -296,28 +296,28 @@ export const IntegrationsServiceAttachRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.integrationId = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.config = Struct.unwrap(Struct.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -378,14 +378,14 @@ export const IntegrationsServiceAttachResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = IntegrationAttachmentItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -438,7 +438,7 @@ export const IntegrationsServiceListAvailableRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -489,14 +489,14 @@ export const IntegrationsServiceListAvailableResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(IntegrationAvailableItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -564,35 +564,35 @@ export const IntegrationAvailableItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.version = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.description = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.fanout = PluginFanout.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -635,7 +635,7 @@ export const IntegrationAvailableItem = {
 };
 
 function createBasePluginFanout(): PluginFanout {
-  return { registrationSchema: new Uint8Array(), attachmentSchema: new Uint8Array(), subscribedMaterials: [] };
+  return { registrationSchema: new Uint8Array(0), attachmentSchema: new Uint8Array(0), subscribedMaterials: [] };
 }
 
 export const PluginFanout = {
@@ -660,28 +660,28 @@ export const PluginFanout = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.registrationSchema = reader.bytes();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.attachmentSchema = reader.bytes();
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.subscribedMaterials.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -693,8 +693,8 @@ export const PluginFanout = {
     return {
       registrationSchema: isSet(object.registrationSchema)
         ? bytesFromBase64(object.registrationSchema)
-        : new Uint8Array(),
-      attachmentSchema: isSet(object.attachmentSchema) ? bytesFromBase64(object.attachmentSchema) : new Uint8Array(),
+        : new Uint8Array(0),
+      attachmentSchema: isSet(object.attachmentSchema) ? bytesFromBase64(object.attachmentSchema) : new Uint8Array(0),
       subscribedMaterials: Array.isArray(object?.subscribedMaterials)
         ? object.subscribedMaterials.map((e: any) => String(e))
         : [],
@@ -705,11 +705,11 @@ export const PluginFanout = {
     const obj: any = {};
     message.registrationSchema !== undefined &&
       (obj.registrationSchema = base64FromBytes(
-        message.registrationSchema !== undefined ? message.registrationSchema : new Uint8Array(),
+        message.registrationSchema !== undefined ? message.registrationSchema : new Uint8Array(0),
       ));
     message.attachmentSchema !== undefined &&
       (obj.attachmentSchema = base64FromBytes(
-        message.attachmentSchema !== undefined ? message.attachmentSchema : new Uint8Array(),
+        message.attachmentSchema !== undefined ? message.attachmentSchema : new Uint8Array(0),
       ));
     if (message.subscribedMaterials) {
       obj.subscribedMaterials = message.subscribedMaterials.map((e) => e);
@@ -725,8 +725,8 @@ export const PluginFanout = {
 
   fromPartial<I extends Exact<DeepPartial<PluginFanout>, I>>(object: I): PluginFanout {
     const message = createBasePluginFanout();
-    message.registrationSchema = object.registrationSchema ?? new Uint8Array();
-    message.attachmentSchema = object.attachmentSchema ?? new Uint8Array();
+    message.registrationSchema = object.registrationSchema ?? new Uint8Array(0);
+    message.attachmentSchema = object.attachmentSchema ?? new Uint8Array(0);
     message.subscribedMaterials = object.subscribedMaterials?.map((e) => e) || [];
     return message;
   },
@@ -749,7 +749,7 @@ export const IntegrationsServiceListRegistrationsRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -800,14 +800,14 @@ export const IntegrationsServiceListRegistrationsResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(RegisteredIntegrationItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -869,14 +869,14 @@ export const IntegrationsServiceDescribeRegistrationRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -932,14 +932,14 @@ export const IntegrationsServiceDescribeRegistrationResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = RegisteredIntegrationItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -995,14 +995,14 @@ export const IntegrationsServiceDetachRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1052,7 +1052,7 @@ export const IntegrationsServiceDetachResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1103,14 +1103,14 @@ export const ListAttachmentsRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1159,14 +1159,14 @@ export const ListAttachmentsResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(IntegrationAttachmentItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1202,7 +1202,7 @@ export const ListAttachmentsResponse = {
 };
 
 function createBaseRegisteredIntegrationItem(): RegisteredIntegrationItem {
-  return { id: "", kind: "", description: "", createdAt: undefined, config: new Uint8Array() };
+  return { id: "", kind: "", description: "", createdAt: undefined, config: new Uint8Array(0) };
 }
 
 export const RegisteredIntegrationItem = {
@@ -1233,42 +1233,42 @@ export const RegisteredIntegrationItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.kind = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.description = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.config = reader.bytes();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1282,7 +1282,7 @@ export const RegisteredIntegrationItem = {
       kind: isSet(object.kind) ? String(object.kind) : "",
       description: isSet(object.description) ? String(object.description) : "",
       createdAt: isSet(object.createdAt) ? fromJsonTimestamp(object.createdAt) : undefined,
-      config: isSet(object.config) ? bytesFromBase64(object.config) : new Uint8Array(),
+      config: isSet(object.config) ? bytesFromBase64(object.config) : new Uint8Array(0),
     };
   },
 
@@ -1293,7 +1293,7 @@ export const RegisteredIntegrationItem = {
     message.description !== undefined && (obj.description = message.description);
     message.createdAt !== undefined && (obj.createdAt = message.createdAt.toISOString());
     message.config !== undefined &&
-      (obj.config = base64FromBytes(message.config !== undefined ? message.config : new Uint8Array()));
+      (obj.config = base64FromBytes(message.config !== undefined ? message.config : new Uint8Array(0)));
     return obj;
   },
 
@@ -1307,13 +1307,13 @@ export const RegisteredIntegrationItem = {
     message.kind = object.kind ?? "";
     message.description = object.description ?? "";
     message.createdAt = object.createdAt ?? undefined;
-    message.config = object.config ?? new Uint8Array();
+    message.config = object.config ?? new Uint8Array(0);
     return message;
   },
 };
 
 function createBaseIntegrationAttachmentItem(): IntegrationAttachmentItem {
-  return { id: "", createdAt: undefined, config: new Uint8Array(), integration: undefined, workflow: undefined };
+  return { id: "", createdAt: undefined, config: new Uint8Array(0), integration: undefined, workflow: undefined };
 }
 
 export const IntegrationAttachmentItem = {
@@ -1344,42 +1344,42 @@ export const IntegrationAttachmentItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.config = reader.bytes();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.integration = RegisteredIntegrationItem.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.workflow = WorkflowItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1391,7 +1391,7 @@ export const IntegrationAttachmentItem = {
     return {
       id: isSet(object.id) ? String(object.id) : "",
       createdAt: isSet(object.createdAt) ? fromJsonTimestamp(object.createdAt) : undefined,
-      config: isSet(object.config) ? bytesFromBase64(object.config) : new Uint8Array(),
+      config: isSet(object.config) ? bytesFromBase64(object.config) : new Uint8Array(0),
       integration: isSet(object.integration) ? RegisteredIntegrationItem.fromJSON(object.integration) : undefined,
       workflow: isSet(object.workflow) ? WorkflowItem.fromJSON(object.workflow) : undefined,
     };
@@ -1402,7 +1402,7 @@ export const IntegrationAttachmentItem = {
     message.id !== undefined && (obj.id = message.id);
     message.createdAt !== undefined && (obj.createdAt = message.createdAt.toISOString());
     message.config !== undefined &&
-      (obj.config = base64FromBytes(message.config !== undefined ? message.config : new Uint8Array()));
+      (obj.config = base64FromBytes(message.config !== undefined ? message.config : new Uint8Array(0)));
     message.integration !== undefined &&
       (obj.integration = message.integration ? RegisteredIntegrationItem.toJSON(message.integration) : undefined);
     message.workflow !== undefined &&
@@ -1418,7 +1418,7 @@ export const IntegrationAttachmentItem = {
     const message = createBaseIntegrationAttachmentItem();
     message.id = object.id ?? "";
     message.createdAt = object.createdAt ?? undefined;
-    message.config = object.config ?? new Uint8Array();
+    message.config = object.config ?? new Uint8Array(0);
     message.integration = (object.integration !== undefined && object.integration !== null)
       ? RegisteredIntegrationItem.fromPartial(object.integration)
       : undefined;
@@ -1449,14 +1449,14 @@ export const IntegrationsServiceDeregisterRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1506,7 +1506,7 @@ export const IntegrationsServiceDeregisterResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2006,8 +2006,8 @@ function toTimestamp(date: Date): Timestamp {
 }
 
 function fromTimestamp(t: Timestamp): Date {
-  let millis = t.seconds * 1_000;
-  millis += t.nanos / 1_000_000;
+  let millis = (t.seconds || 0) * 1_000;
+  millis += (t.nanos || 0) / 1_000_000;
   return new Date(millis);
 }
 
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/oci_repository.ts b/app/controlplane/api/gen/frontend/controlplane/v1/oci_repository.ts
index f2f66f636..2da421255 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/oci_repository.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/oci_repository.ts
@@ -86,21 +86,21 @@ export const OCIRepositoryServiceSaveRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.repository = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.keyPair = OCIRepositoryServiceSaveRequest_Keypair.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -162,21 +162,21 @@ export const OCIRepositoryServiceSaveRequest_Keypair = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.username = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.password = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -231,7 +231,7 @@ export const OCIRepositoryServiceSaveResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -263,7 +263,11 @@ export const OCIRepositoryServiceSaveResponse = {
 };
 
 export interface OCIRepositoryService {
-  /** Save the OCI repository overriding the existing one (for now) */
+  /**
+   * Save the OCI repository overriding the existing one (for now)
+   *
+   * @deprecated
+   */
   Save(
     request: DeepPartial<OCIRepositoryServiceSaveRequest>,
     metadata?: grpc.Metadata,
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/org_metrics.ts b/app/controlplane/api/gen/frontend/controlplane/v1/org_metrics.ts
index 1018dbfa2..ad12ded1d 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/org_metrics.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/org_metrics.ts
@@ -118,14 +118,14 @@ export const OrgMetricsServiceTotalsRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.timeWindow = reader.int32() as any;
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -179,21 +179,21 @@ export const TopWorkflowsByRunsCountRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.numWorkflows = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.timeWindow = reader.int32() as any;
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -249,14 +249,14 @@ export const TopWorkflowsByRunsCountResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(TopWorkflowsByRunsCountResponse_TotalByStatus.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -321,14 +321,14 @@ export const TopWorkflowsByRunsCountResponse_TotalByStatus = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflow = WorkflowItem.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
@@ -341,7 +341,7 @@ export const TopWorkflowsByRunsCountResponse_TotalByStatus = {
           }
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -429,21 +429,21 @@ export const TopWorkflowsByRunsCountResponse_TotalByStatus_RunsTotalByStatusEntr
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.key = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.value = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -498,14 +498,14 @@ export const OrgMetricsServiceTotalsResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = OrgMetricsServiceTotalsResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -573,14 +573,14 @@ export const OrgMetricsServiceTotalsResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.runsTotal = reader.int32();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
@@ -590,7 +590,7 @@ export const OrgMetricsServiceTotalsResponse_Result = {
           }
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
@@ -603,7 +603,7 @@ export const OrgMetricsServiceTotalsResponse_Result = {
           }
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -708,21 +708,21 @@ export const OrgMetricsServiceTotalsResponse_Result_RunsTotalByStatusEntry = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.key = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.value = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -786,21 +786,21 @@ export const OrgMetricsServiceTotalsResponse_Result_RunsTotalByRunnerTypeEntry =
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.key = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.value = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/organization.ts b/app/controlplane/api/gen/frontend/controlplane/v1/organization.ts
index c38c34618..ec44d600f 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/organization.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/organization.ts
@@ -38,7 +38,7 @@ export const OrganizationServiceListMembershipsRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -89,14 +89,14 @@ export const OrganizationServiceListMembershipsResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(OrgMembershipItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -155,14 +155,14 @@ export const SetCurrentMembershipRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.membershipId = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -211,14 +211,14 @@ export const SetCurrentMembershipResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = OrgMembershipItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/pagination.ts b/app/controlplane/api/gen/frontend/controlplane/v1/pagination.ts
index 7d4fc53e0..d31071e24 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/pagination.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/pagination.ts
@@ -33,14 +33,14 @@ export const PaginationResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.nextCursor = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -92,21 +92,21 @@ export const PaginationRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.cursor = reader.string();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.limit = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts b/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts
index b6557c465..acc7ee42c 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/response_messages.ts
@@ -221,63 +221,63 @@ export const WorkflowItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.project = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.team = reader.string();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 48) {
+          if (tag !== 48) {
             break;
           }
 
           message.runsCount = reader.int32();
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.lastRun = WorkflowRunItem.decode(reader, reader.uint32());
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.contractId = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -386,70 +386,70 @@ export const WorkflowRunItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.finishedAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.state = reader.string();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.reason = reader.string();
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.workflow = WorkflowItem.decode(reader, reader.uint32());
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.jobUrl = reader.string();
           continue;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.runnerType = reader.int32() as any;
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.contractVersion = WorkflowContractVersionItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -514,7 +514,7 @@ export const WorkflowRunItem = {
 };
 
 function createBaseAttestationItem(): AttestationItem {
-  return { id: "", createdAt: undefined, envelope: new Uint8Array(), envVars: [], materials: [] };
+  return { id: "", createdAt: undefined, envelope: new Uint8Array(0), envVars: [], materials: [] };
 }
 
 export const AttestationItem = {
@@ -545,42 +545,42 @@ export const AttestationItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.envelope = reader.bytes();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.envVars.push(AttestationItem_EnvVariable.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.materials.push(AttestationItem_Material.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -592,7 +592,7 @@ export const AttestationItem = {
     return {
       id: isSet(object.id) ? String(object.id) : "",
       createdAt: isSet(object.createdAt) ? fromJsonTimestamp(object.createdAt) : undefined,
-      envelope: isSet(object.envelope) ? bytesFromBase64(object.envelope) : new Uint8Array(),
+      envelope: isSet(object.envelope) ? bytesFromBase64(object.envelope) : new Uint8Array(0),
       envVars: Array.isArray(object?.envVars)
         ? object.envVars.map((e: any) => AttestationItem_EnvVariable.fromJSON(e))
         : [],
@@ -607,7 +607,7 @@ export const AttestationItem = {
     message.id !== undefined && (obj.id = message.id);
     message.createdAt !== undefined && (obj.createdAt = message.createdAt.toISOString());
     message.envelope !== undefined &&
-      (obj.envelope = base64FromBytes(message.envelope !== undefined ? message.envelope : new Uint8Array()));
+      (obj.envelope = base64FromBytes(message.envelope !== undefined ? message.envelope : new Uint8Array(0)));
     if (message.envVars) {
       obj.envVars = message.envVars.map((e) => e ? AttestationItem_EnvVariable.toJSON(e) : undefined);
     } else {
@@ -629,7 +629,7 @@ export const AttestationItem = {
     const message = createBaseAttestationItem();
     message.id = object.id ?? "";
     message.createdAt = object.createdAt ?? undefined;
-    message.envelope = object.envelope ?? new Uint8Array();
+    message.envelope = object.envelope ?? new Uint8Array(0);
     message.envVars = object.envVars?.map((e) => AttestationItem_EnvVariable.fromPartial(e)) || [];
     message.materials = object.materials?.map((e) => AttestationItem_Material.fromPartial(e)) || [];
     return message;
@@ -659,21 +659,21 @@ export const AttestationItem_EnvVariable = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.value = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -733,28 +733,28 @@ export const AttestationItem_Material = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.value = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.type = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -823,42 +823,42 @@ export const WorkflowContractItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.latestRevision = reader.int32();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.workflowIds.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -934,35 +934,35 @@ export const WorkflowContractVersionItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.revision = reader.int32();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.v1 = CraftingSchema.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1028,28 +1028,28 @@ export const User = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.email = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1118,42 +1118,42 @@ export const OrgMembershipItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.org = Org.decode(reader, reader.uint32());
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.current = reader.bool();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.updatedAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1222,28 +1222,28 @@ export const Org = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1309,35 +1309,35 @@ export const OCIRepositoryItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.repo = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.validationStatus = reader.int32() as any;
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1442,8 +1442,8 @@ function toTimestamp(date: Date): Timestamp {
 }
 
 function fromTimestamp(t: Timestamp): Date {
-  let millis = t.seconds * 1_000;
-  millis += t.nanos / 1_000_000;
+  let millis = (t.seconds || 0) * 1_000;
+  millis += (t.nanos || 0) / 1_000_000;
   return new Date(millis);
 }
 
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/robot_accounts.ts b/app/controlplane/api/gen/frontend/controlplane/v1/robot_accounts.ts
index 79dd53992..714f758d9 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/robot_accounts.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/robot_accounts.ts
@@ -72,21 +72,21 @@ export const RobotAccountServiceCreateRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -144,14 +144,14 @@ export const RobotAccountServiceCreateResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = RobotAccountServiceCreateResponse_RobotAccountFull.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -230,49 +230,49 @@ export const RobotAccountServiceCreateResponse_RobotAccountFull = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.revokedAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.key = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -342,14 +342,14 @@ export const RobotAccountServiceRevokeRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -399,7 +399,7 @@ export const RobotAccountServiceRevokeResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -453,21 +453,21 @@ export const RobotAccountServiceListRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.includeRevoked = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -523,14 +523,14 @@ export const RobotAccountServiceListResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(RobotAccountServiceListResponse_RobotAccountItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -606,42 +606,42 @@ export const RobotAccountServiceListResponse_RobotAccountItem = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.createdAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.revokedAt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -919,8 +919,8 @@ function toTimestamp(date: Date): Timestamp {
 }
 
 function fromTimestamp(t: Timestamp): Date {
-  let millis = t.seconds * 1_000;
-  millis += t.nanos / 1_000_000;
+  let millis = (t.seconds || 0) * 1_000;
+  millis += (t.nanos || 0) / 1_000_000;
   return new Date(millis);
 }
 
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/status.ts b/app/controlplane/api/gen/frontend/controlplane/v1/status.ts
index bb4f5ddbb..8f3a5f38a 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/status.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/status.ts
@@ -42,7 +42,7 @@ export const InfozRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -89,14 +89,14 @@ export const StatuszRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.readiness = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -148,21 +148,21 @@ export const InfozResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.loginUrl = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.version = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -213,7 +213,7 @@ export const StatuszResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/workflow.ts b/app/controlplane/api/gen/frontend/controlplane/v1/workflow.ts
index a612942fa..e77f588ae 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/workflow.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/workflow.ts
@@ -61,35 +61,35 @@ export const WorkflowServiceCreateRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.project = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.schemaId = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.team = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -149,14 +149,14 @@ export const WorkflowServiceCreateResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = WorkflowItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -209,14 +209,14 @@ export const WorkflowServiceDeleteRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -262,7 +262,7 @@ export const WorkflowServiceDeleteResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -306,7 +306,7 @@ export const WorkflowServiceListRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -353,14 +353,14 @@ export const WorkflowServiceListResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(WorkflowItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/workflow_contract.ts b/app/controlplane/api/gen/frontend/controlplane/v1/workflow_contract.ts
index 854f530b6..f0977c0c4 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/workflow_contract.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/workflow_contract.ts
@@ -76,7 +76,7 @@ export const WorkflowContractServiceListRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -127,14 +127,14 @@ export const WorkflowContractServiceListResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(WorkflowContractItem.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -196,21 +196,21 @@ export const WorkflowContractServiceCreateRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.v1 = CraftingSchema.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -268,14 +268,14 @@ export const WorkflowContractServiceCreateResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = WorkflowContractItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -337,28 +337,28 @@ export const WorkflowContractServiceUpdateRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.v1 = CraftingSchema.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -419,14 +419,14 @@ export const WorkflowContractServiceUpdateResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = WorkflowContractServiceUpdateResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -487,21 +487,21 @@ export const WorkflowContractServiceUpdateResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.contract = WorkflowContractItem.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.revision = WorkflowContractVersionItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -568,21 +568,21 @@ export const WorkflowContractServiceDescribeRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.revision = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -640,14 +640,14 @@ export const WorkflowContractServiceDescribeResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = WorkflowContractServiceDescribeResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -711,21 +711,21 @@ export const WorkflowContractServiceDescribeResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.contract = WorkflowContractItem.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.revision = WorkflowContractVersionItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -789,14 +789,14 @@ export const WorkflowContractServiceDeleteRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -846,7 +846,7 @@ export const WorkflowContractServiceDeleteResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts b/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts
index 8e202ca8e..cb53cc5fb 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/workflow_run.ts
@@ -149,14 +149,14 @@ export const AttestationServiceGetContractRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.contractRevision = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -209,14 +209,14 @@ export const AttestationServiceGetContractResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = AttestationServiceGetContractResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -277,21 +277,21 @@ export const AttestationServiceGetContractResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflow = WorkflowItem.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.contract = WorkflowContractVersionItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -358,21 +358,21 @@ export const AttestationServiceInitRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.contractRevision = reader.int32();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.jobUrl = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -428,14 +428,14 @@ export const AttestationServiceInitResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = AttestationServiceInitResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -489,14 +489,14 @@ export const AttestationServiceInitResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.workflowRun = WorkflowRunItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -533,7 +533,7 @@ export const AttestationServiceInitResponse_Result = {
 };
 
 function createBaseAttestationServiceStoreRequest(): AttestationServiceStoreRequest {
-  return { attestation: new Uint8Array(), workflowRunId: "" };
+  return { attestation: new Uint8Array(0), workflowRunId: "" };
 }
 
 export const AttestationServiceStoreRequest = {
@@ -555,21 +555,21 @@ export const AttestationServiceStoreRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.attestation = reader.bytes();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.workflowRunId = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -579,7 +579,7 @@ export const AttestationServiceStoreRequest = {
 
   fromJSON(object: any): AttestationServiceStoreRequest {
     return {
-      attestation: isSet(object.attestation) ? bytesFromBase64(object.attestation) : new Uint8Array(),
+      attestation: isSet(object.attestation) ? bytesFromBase64(object.attestation) : new Uint8Array(0),
       workflowRunId: isSet(object.workflowRunId) ? String(object.workflowRunId) : "",
     };
   },
@@ -587,7 +587,7 @@ export const AttestationServiceStoreRequest = {
   toJSON(message: AttestationServiceStoreRequest): unknown {
     const obj: any = {};
     message.attestation !== undefined &&
-      (obj.attestation = base64FromBytes(message.attestation !== undefined ? message.attestation : new Uint8Array()));
+      (obj.attestation = base64FromBytes(message.attestation !== undefined ? message.attestation : new Uint8Array(0)));
     message.workflowRunId !== undefined && (obj.workflowRunId = message.workflowRunId);
     return obj;
   },
@@ -600,7 +600,7 @@ export const AttestationServiceStoreRequest = {
     object: I,
   ): AttestationServiceStoreRequest {
     const message = createBaseAttestationServiceStoreRequest();
-    message.attestation = object.attestation ?? new Uint8Array();
+    message.attestation = object.attestation ?? new Uint8Array(0);
     message.workflowRunId = object.workflowRunId ?? "";
     return message;
   },
@@ -623,7 +623,7 @@ export const AttestationServiceStoreResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -676,28 +676,28 @@ export const AttestationServiceCancelRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowRunId = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.trigger = reader.int32() as any;
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.reason = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -753,7 +753,7 @@ export const AttestationServiceCancelResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -807,21 +807,21 @@ export const WorkflowRunServiceListRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowId = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.pagination = PaginationRequest.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -883,21 +883,21 @@ export const WorkflowRunServiceListResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result.push(WorkflowRunItem.decode(reader, reader.uint32()));
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.pagination = PaginationResponse.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -960,14 +960,14 @@ export const WorkflowRunServiceViewRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.id = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1018,14 +1018,14 @@ export const WorkflowRunServiceViewResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = WorkflowRunServiceViewResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1082,21 +1082,21 @@ export const WorkflowRunServiceViewResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.workflowRun = WorkflowRunItem.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.attestation = AttestationItem.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1157,7 +1157,7 @@ export const AttestationServiceGetUploadCredsRequest = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1208,14 +1208,14 @@ export const AttestationServiceGetUploadCredsResponse = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.result = AttestationServiceGetUploadCredsResponse_Result.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1280,14 +1280,14 @@ export const AttestationServiceGetUploadCredsResponse_Result = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.token = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/google/api/http.ts b/app/controlplane/api/gen/frontend/google/api/http.ts
index 45a9fc51c..afd536d74 100644
--- a/app/controlplane/api/gen/frontend/google/api/http.ts
+++ b/app/controlplane/api/gen/frontend/google/api/http.ts
@@ -392,21 +392,21 @@ export const Http = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.rules.push(HttpRule.decode(reader, reader.uint32()));
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.fullyDecodeReservedExpansion = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -505,77 +505,77 @@ export const HttpRule = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.selector = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.get = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.put = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.post = reader.string();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.delete = reader.string();
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.patch = reader.string();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.custom = CustomHttpPattern.decode(reader, reader.uint32());
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.body = reader.string();
           continue;
         case 12:
-          if (tag != 98) {
+          if (tag !== 98) {
             break;
           }
 
           message.responseBody = reader.string();
           continue;
         case 11:
-          if (tag != 90) {
+          if (tag !== 90) {
             break;
           }
 
           message.additionalBindings.push(HttpRule.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -665,21 +665,21 @@ export const CustomHttpPattern = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.kind = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.path = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/google/protobuf/descriptor.ts b/app/controlplane/api/gen/frontend/google/protobuf/descriptor.ts
index 55b43237a..b961385bd 100644
--- a/app/controlplane/api/gen/frontend/google/protobuf/descriptor.ts
+++ b/app/controlplane/api/gen/frontend/google/protobuf/descriptor.ts
@@ -1148,14 +1148,14 @@ export const FileDescriptorSet = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.file.push(FileDescriptorProto.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1258,33 +1258,34 @@ export const FileDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.package = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.dependency.push(reader.string());
           continue;
         case 10:
-          if (tag == 80) {
+          if (tag === 80) {
             message.publicDependency.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 82) {
+          if (tag === 82) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.publicDependency.push(reader.int32());
@@ -1295,12 +1296,13 @@ export const FileDescriptorProto = {
 
           break;
         case 11:
-          if (tag == 88) {
+          if (tag === 88) {
             message.weakDependency.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 90) {
+          if (tag === 90) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.weakDependency.push(reader.int32());
@@ -1311,56 +1313,56 @@ export const FileDescriptorProto = {
 
           break;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.messageType.push(DescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.enumType.push(EnumDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.service.push(ServiceDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.extension.push(FieldDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.options = FileOptions.decode(reader, reader.uint32());
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.sourceCodeInfo = SourceCodeInfo.decode(reader, reader.uint32());
           continue;
         case 12:
-          if (tag != 98) {
+          if (tag !== 98) {
             break;
           }
 
           message.syntax = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1521,77 +1523,77 @@ export const DescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.field.push(FieldDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.extension.push(FieldDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.nestedType.push(DescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.enumType.push(EnumDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.extensionRange.push(DescriptorProto_ExtensionRange.decode(reader, reader.uint32()));
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.oneofDecl.push(OneofDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.options = MessageOptions.decode(reader, reader.uint32());
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.reservedRange.push(DescriptorProto_ReservedRange.decode(reader, reader.uint32()));
           continue;
         case 10:
-          if (tag != 82) {
+          if (tag !== 82) {
             break;
           }
 
           message.reservedName.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1720,28 +1722,28 @@ export const DescriptorProto_ExtensionRange = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.start = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.end = reader.int32();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.options = ExtensionRangeOptions.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1806,21 +1808,21 @@ export const DescriptorProto_ReservedRange = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.start = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.end = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1873,14 +1875,14 @@ export const ExtensionRangeOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1979,84 +1981,84 @@ export const FieldDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.number = reader.int32();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.label = reader.int32() as any;
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.type = reader.int32() as any;
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.typeName = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.extendee = reader.string();
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.defaultValue = reader.string();
           continue;
         case 9:
-          if (tag != 72) {
+          if (tag !== 72) {
             break;
           }
 
           message.oneofIndex = reader.int32();
           continue;
         case 10:
-          if (tag != 82) {
+          if (tag !== 82) {
             break;
           }
 
           message.jsonName = reader.string();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.options = FieldOptions.decode(reader, reader.uint32());
           continue;
         case 17:
-          if (tag != 136) {
+          if (tag !== 136) {
             break;
           }
 
           message.proto3Optional = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2142,21 +2144,21 @@ export const OneofDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.options = OneofOptions.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2224,42 +2226,42 @@ export const EnumDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.value.push(EnumValueDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.options = EnumOptions.decode(reader, reader.uint32());
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.reservedRange.push(EnumDescriptorProto_EnumReservedRange.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.reservedName.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2344,21 +2346,21 @@ export const EnumDescriptorProto_EnumReservedRange = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.start = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.end = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2419,28 +2421,28 @@ export const EnumValueDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.number = reader.int32();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.options = EnumValueOptions.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2506,28 +2508,28 @@ export const ServiceDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.method.push(MethodDescriptorProto.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.options = ServiceOptions.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2613,49 +2615,49 @@ export const MethodDescriptorProto = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.inputType = reader.string();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.outputType = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.options = MethodOptions.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.clientStreaming = reader.bool();
           continue;
         case 6:
-          if (tag != 48) {
+          if (tag !== 48) {
             break;
           }
 
           message.serverStreaming = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2806,154 +2808,154 @@ export const FileOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.javaPackage = reader.string();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.javaOuterClassname = reader.string();
           continue;
         case 10:
-          if (tag != 80) {
+          if (tag !== 80) {
             break;
           }
 
           message.javaMultipleFiles = reader.bool();
           continue;
         case 20:
-          if (tag != 160) {
+          if (tag !== 160) {
             break;
           }
 
           message.javaGenerateEqualsAndHash = reader.bool();
           continue;
         case 27:
-          if (tag != 216) {
+          if (tag !== 216) {
             break;
           }
 
           message.javaStringCheckUtf8 = reader.bool();
           continue;
         case 9:
-          if (tag != 72) {
+          if (tag !== 72) {
             break;
           }
 
           message.optimizeFor = reader.int32() as any;
           continue;
         case 11:
-          if (tag != 90) {
+          if (tag !== 90) {
             break;
           }
 
           message.goPackage = reader.string();
           continue;
         case 16:
-          if (tag != 128) {
+          if (tag !== 128) {
             break;
           }
 
           message.ccGenericServices = reader.bool();
           continue;
         case 17:
-          if (tag != 136) {
+          if (tag !== 136) {
             break;
           }
 
           message.javaGenericServices = reader.bool();
           continue;
         case 18:
-          if (tag != 144) {
+          if (tag !== 144) {
             break;
           }
 
           message.pyGenericServices = reader.bool();
           continue;
         case 42:
-          if (tag != 336) {
+          if (tag !== 336) {
             break;
           }
 
           message.phpGenericServices = reader.bool();
           continue;
         case 23:
-          if (tag != 184) {
+          if (tag !== 184) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 31:
-          if (tag != 248) {
+          if (tag !== 248) {
             break;
           }
 
           message.ccEnableArenas = reader.bool();
           continue;
         case 36:
-          if (tag != 290) {
+          if (tag !== 290) {
             break;
           }
 
           message.objcClassPrefix = reader.string();
           continue;
         case 37:
-          if (tag != 298) {
+          if (tag !== 298) {
             break;
           }
 
           message.csharpNamespace = reader.string();
           continue;
         case 39:
-          if (tag != 314) {
+          if (tag !== 314) {
             break;
           }
 
           message.swiftPrefix = reader.string();
           continue;
         case 40:
-          if (tag != 322) {
+          if (tag !== 322) {
             break;
           }
 
           message.phpClassPrefix = reader.string();
           continue;
         case 41:
-          if (tag != 330) {
+          if (tag !== 330) {
             break;
           }
 
           message.phpNamespace = reader.string();
           continue;
         case 44:
-          if (tag != 354) {
+          if (tag !== 354) {
             break;
           }
 
           message.phpMetadataNamespace = reader.string();
           continue;
         case 45:
-          if (tag != 362) {
+          if (tag !== 362) {
             break;
           }
 
           message.rubyPackage = reader.string();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3091,42 +3093,42 @@ export const MessageOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.messageSetWireFormat = reader.bool();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.noStandardDescriptorAccessor = reader.bool();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 7:
-          if (tag != 56) {
+          if (tag !== 56) {
             break;
           }
 
           message.mapEntry = reader.bool();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3228,63 +3230,63 @@ export const FieldOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.ctype = reader.int32() as any;
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.packed = reader.bool();
           continue;
         case 6:
-          if (tag != 48) {
+          if (tag !== 48) {
             break;
           }
 
           message.jstype = reader.int32() as any;
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.lazy = reader.bool();
           continue;
         case 15:
-          if (tag != 120) {
+          if (tag !== 120) {
             break;
           }
 
           message.unverifiedLazy = reader.bool();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 10:
-          if (tag != 80) {
+          if (tag !== 80) {
             break;
           }
 
           message.weak = reader.bool();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3362,14 +3364,14 @@ export const OneofOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3432,28 +3434,28 @@ export const EnumOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.allowAlias = reader.bool();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3519,21 +3521,21 @@ export const EnumValueOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3596,21 +3598,21 @@ export const ServiceOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 33:
-          if (tag != 264) {
+          if (tag !== 264) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3676,28 +3678,28 @@ export const MethodOptions = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 33:
-          if (tag != 264) {
+          if (tag !== 264) {
             break;
           }
 
           message.deprecated = reader.bool();
           continue;
         case 34:
-          if (tag != 272) {
+          if (tag !== 272) {
             break;
           }
 
           message.idempotencyLevel = reader.int32() as any;
           continue;
         case 999:
-          if (tag != 7994) {
+          if (tag !== 7994) {
             break;
           }
 
           message.uninterpretedOption.push(UninterpretedOption.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3750,7 +3752,7 @@ function createBaseUninterpretedOption(): UninterpretedOption {
     positiveIntValue: 0,
     negativeIntValue: 0,
     doubleValue: 0,
-    stringValue: new Uint8Array(),
+    stringValue: new Uint8Array(0),
     aggregateValue: "",
   };
 }
@@ -3789,56 +3791,56 @@ export const UninterpretedOption = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name.push(UninterpretedOption_NamePart.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.identifierValue = reader.string();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.positiveIntValue = longToNumber(reader.uint64() as Long);
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.negativeIntValue = longToNumber(reader.int64() as Long);
           continue;
         case 6:
-          if (tag != 49) {
+          if (tag !== 49) {
             break;
           }
 
           message.doubleValue = reader.double();
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.stringValue = reader.bytes();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.aggregateValue = reader.string();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3853,7 +3855,7 @@ export const UninterpretedOption = {
       positiveIntValue: isSet(object.positiveIntValue) ? Number(object.positiveIntValue) : 0,
       negativeIntValue: isSet(object.negativeIntValue) ? Number(object.negativeIntValue) : 0,
       doubleValue: isSet(object.doubleValue) ? Number(object.doubleValue) : 0,
-      stringValue: isSet(object.stringValue) ? bytesFromBase64(object.stringValue) : new Uint8Array(),
+      stringValue: isSet(object.stringValue) ? bytesFromBase64(object.stringValue) : new Uint8Array(0),
       aggregateValue: isSet(object.aggregateValue) ? String(object.aggregateValue) : "",
     };
   },
@@ -3870,7 +3872,7 @@ export const UninterpretedOption = {
     message.negativeIntValue !== undefined && (obj.negativeIntValue = Math.round(message.negativeIntValue));
     message.doubleValue !== undefined && (obj.doubleValue = message.doubleValue);
     message.stringValue !== undefined &&
-      (obj.stringValue = base64FromBytes(message.stringValue !== undefined ? message.stringValue : new Uint8Array()));
+      (obj.stringValue = base64FromBytes(message.stringValue !== undefined ? message.stringValue : new Uint8Array(0)));
     message.aggregateValue !== undefined && (obj.aggregateValue = message.aggregateValue);
     return obj;
   },
@@ -3886,7 +3888,7 @@ export const UninterpretedOption = {
     message.positiveIntValue = object.positiveIntValue ?? 0;
     message.negativeIntValue = object.negativeIntValue ?? 0;
     message.doubleValue = object.doubleValue ?? 0;
-    message.stringValue = object.stringValue ?? new Uint8Array();
+    message.stringValue = object.stringValue ?? new Uint8Array(0);
     message.aggregateValue = object.aggregateValue ?? "";
     return message;
   },
@@ -3915,21 +3917,21 @@ export const UninterpretedOption_NamePart = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.namePart = reader.string();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.isExtension = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3983,14 +3985,14 @@ export const SourceCodeInfo = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.location.push(SourceCodeInfo_Location.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4063,12 +4065,13 @@ export const SourceCodeInfo_Location = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag == 8) {
+          if (tag === 8) {
             message.path.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 10) {
+          if (tag === 10) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.path.push(reader.int32());
@@ -4079,12 +4082,13 @@ export const SourceCodeInfo_Location = {
 
           break;
         case 2:
-          if (tag == 16) {
+          if (tag === 16) {
             message.span.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 18) {
+          if (tag === 18) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.span.push(reader.int32());
@@ -4095,28 +4099,28 @@ export const SourceCodeInfo_Location = {
 
           break;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.leadingComments = reader.string();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.trailingComments = reader.string();
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.leadingDetachedComments.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4193,14 +4197,14 @@ export const GeneratedCodeInfo = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.annotation.push(GeneratedCodeInfo_Annotation.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4268,12 +4272,13 @@ export const GeneratedCodeInfo_Annotation = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag == 8) {
+          if (tag === 8) {
             message.path.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 10) {
+          if (tag === 10) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.path.push(reader.int32());
@@ -4284,28 +4289,28 @@ export const GeneratedCodeInfo_Annotation = {
 
           break;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.sourceFile = reader.string();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.begin = reader.int32();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.end = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/google/protobuf/duration.ts b/app/controlplane/api/gen/frontend/google/protobuf/duration.ts
index ab3ebdbb5..4096c0638 100644
--- a/app/controlplane/api/gen/frontend/google/protobuf/duration.ts
+++ b/app/controlplane/api/gen/frontend/google/protobuf/duration.ts
@@ -105,21 +105,21 @@ export const Duration = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.seconds = longToNumber(reader.int64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.nanos = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/google/protobuf/struct.ts b/app/controlplane/api/gen/frontend/google/protobuf/struct.ts
index c5f7165b9..5ae39a0c5 100644
--- a/app/controlplane/api/gen/frontend/google/protobuf/struct.ts
+++ b/app/controlplane/api/gen/frontend/google/protobuf/struct.ts
@@ -120,7 +120,7 @@ export const Struct = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
@@ -130,7 +130,7 @@ export const Struct = {
           }
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -219,21 +219,21 @@ export const Struct_FieldsEntry = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.key = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.value = Value.unwrap(Value.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -306,49 +306,49 @@ export const Value = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.nullValue = reader.int32() as any;
           continue;
         case 2:
-          if (tag != 17) {
+          if (tag !== 17) {
             break;
           }
 
           message.numberValue = reader.double();
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.stringValue = reader.string();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.boolValue = reader.bool();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.structValue = Struct.unwrap(Struct.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.listValue = ListValue.unwrap(ListValue.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -452,14 +452,14 @@ export const ListValue = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.values.push(Value.unwrap(Value.decode(reader, reader.uint32())));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/google/protobuf/timestamp.ts b/app/controlplane/api/gen/frontend/google/protobuf/timestamp.ts
index e7b94af23..5438fe0d0 100644
--- a/app/controlplane/api/gen/frontend/google/protobuf/timestamp.ts
+++ b/app/controlplane/api/gen/frontend/google/protobuf/timestamp.ts
@@ -134,21 +134,21 @@ export const Timestamp = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.seconds = longToNumber(reader.int64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.nanos = reader.int32();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/api/gen/frontend/validate/validate.ts b/app/controlplane/api/gen/frontend/validate/validate.ts
index 0d3b531b0..531009a51 100644
--- a/app/controlplane/api/gen/frontend/validate/validate.ts
+++ b/app/controlplane/api/gen/frontend/validate/validate.ts
@@ -1143,161 +1143,161 @@ export const FieldRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 17:
-          if (tag != 138) {
+          if (tag !== 138) {
             break;
           }
 
           message.message = MessageRules.decode(reader, reader.uint32());
           continue;
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.float = FloatRules.decode(reader, reader.uint32());
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.double = DoubleRules.decode(reader, reader.uint32());
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.int32 = Int32Rules.decode(reader, reader.uint32());
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.int64 = Int64Rules.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.uint32 = UInt32Rules.decode(reader, reader.uint32());
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.uint64 = UInt64Rules.decode(reader, reader.uint32());
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.sint32 = SInt32Rules.decode(reader, reader.uint32());
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.sint64 = SInt64Rules.decode(reader, reader.uint32());
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.fixed32 = Fixed32Rules.decode(reader, reader.uint32());
           continue;
         case 10:
-          if (tag != 82) {
+          if (tag !== 82) {
             break;
           }
 
           message.fixed64 = Fixed64Rules.decode(reader, reader.uint32());
           continue;
         case 11:
-          if (tag != 90) {
+          if (tag !== 90) {
             break;
           }
 
           message.sfixed32 = SFixed32Rules.decode(reader, reader.uint32());
           continue;
         case 12:
-          if (tag != 98) {
+          if (tag !== 98) {
             break;
           }
 
           message.sfixed64 = SFixed64Rules.decode(reader, reader.uint32());
           continue;
         case 13:
-          if (tag != 106) {
+          if (tag !== 106) {
             break;
           }
 
           message.bool = BoolRules.decode(reader, reader.uint32());
           continue;
         case 14:
-          if (tag != 114) {
+          if (tag !== 114) {
             break;
           }
 
           message.string = StringRules.decode(reader, reader.uint32());
           continue;
         case 15:
-          if (tag != 122) {
+          if (tag !== 122) {
             break;
           }
 
           message.bytes = BytesRules.decode(reader, reader.uint32());
           continue;
         case 16:
-          if (tag != 130) {
+          if (tag !== 130) {
             break;
           }
 
           message.enum = EnumRules.decode(reader, reader.uint32());
           continue;
         case 18:
-          if (tag != 146) {
+          if (tag !== 146) {
             break;
           }
 
           message.repeated = RepeatedRules.decode(reader, reader.uint32());
           continue;
         case 19:
-          if (tag != 154) {
+          if (tag !== 154) {
             break;
           }
 
           message.map = MapRules.decode(reader, reader.uint32());
           continue;
         case 20:
-          if (tag != 162) {
+          if (tag !== 162) {
             break;
           }
 
           message.any = AnyRules.decode(reader, reader.uint32());
           continue;
         case 21:
-          if (tag != 170) {
+          if (tag !== 170) {
             break;
           }
 
           message.duration = DurationRules.decode(reader, reader.uint32());
           continue;
         case 22:
-          if (tag != 178) {
+          if (tag !== 178) {
             break;
           }
 
           message.timestamp = TimestampRules.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1477,47 +1477,48 @@ export const FloatRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 13) {
+          if (tag !== 13) {
             break;
           }
 
           message.const = reader.float();
           continue;
         case 2:
-          if (tag != 21) {
+          if (tag !== 21) {
             break;
           }
 
           message.lt = reader.float();
           continue;
         case 3:
-          if (tag != 29) {
+          if (tag !== 29) {
             break;
           }
 
           message.lte = reader.float();
           continue;
         case 4:
-          if (tag != 37) {
+          if (tag !== 37) {
             break;
           }
 
           message.gt = reader.float();
           continue;
         case 5:
-          if (tag != 45) {
+          if (tag !== 45) {
             break;
           }
 
           message.gte = reader.float();
           continue;
         case 6:
-          if (tag == 53) {
+          if (tag === 53) {
             message.in.push(reader.float());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.float());
@@ -1528,12 +1529,13 @@ export const FloatRules = {
 
           break;
         case 7:
-          if (tag == 61) {
+          if (tag === 61) {
             message.notIn.push(reader.float());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.float());
@@ -1544,14 +1546,14 @@ export const FloatRules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1656,47 +1658,48 @@ export const DoubleRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 9) {
+          if (tag !== 9) {
             break;
           }
 
           message.const = reader.double();
           continue;
         case 2:
-          if (tag != 17) {
+          if (tag !== 17) {
             break;
           }
 
           message.lt = reader.double();
           continue;
         case 3:
-          if (tag != 25) {
+          if (tag !== 25) {
             break;
           }
 
           message.lte = reader.double();
           continue;
         case 4:
-          if (tag != 33) {
+          if (tag !== 33) {
             break;
           }
 
           message.gt = reader.double();
           continue;
         case 5:
-          if (tag != 41) {
+          if (tag !== 41) {
             break;
           }
 
           message.gte = reader.double();
           continue;
         case 6:
-          if (tag == 49) {
+          if (tag === 49) {
             message.in.push(reader.double());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.double());
@@ -1707,12 +1710,13 @@ export const DoubleRules = {
 
           break;
         case 7:
-          if (tag == 57) {
+          if (tag === 57) {
             message.notIn.push(reader.double());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.double());
@@ -1723,14 +1727,14 @@ export const DoubleRules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -1835,47 +1839,48 @@ export const Int32Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = reader.int32();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = reader.int32();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = reader.int32();
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = reader.int32();
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.int32());
@@ -1886,12 +1891,13 @@ export const Int32Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.int32());
@@ -1902,14 +1908,14 @@ export const Int32Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2014,47 +2020,48 @@ export const Int64Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = longToNumber(reader.int64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = longToNumber(reader.int64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = longToNumber(reader.int64() as Long);
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = longToNumber(reader.int64() as Long);
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = longToNumber(reader.int64() as Long);
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(longToNumber(reader.int64() as Long));
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(longToNumber(reader.int64() as Long));
@@ -2065,12 +2072,13 @@ export const Int64Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(longToNumber(reader.int64() as Long));
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(longToNumber(reader.int64() as Long));
@@ -2081,14 +2089,14 @@ export const Int64Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2193,47 +2201,48 @@ export const UInt32Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = reader.uint32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = reader.uint32();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = reader.uint32();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = reader.uint32();
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = reader.uint32();
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(reader.uint32());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.uint32());
@@ -2244,12 +2253,13 @@ export const UInt32Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(reader.uint32());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.uint32());
@@ -2260,14 +2270,14 @@ export const UInt32Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2372,47 +2382,48 @@ export const UInt64Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = longToNumber(reader.uint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = longToNumber(reader.uint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = longToNumber(reader.uint64() as Long);
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = longToNumber(reader.uint64() as Long);
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = longToNumber(reader.uint64() as Long);
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(longToNumber(reader.uint64() as Long));
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(longToNumber(reader.uint64() as Long));
@@ -2423,12 +2434,13 @@ export const UInt64Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(longToNumber(reader.uint64() as Long));
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(longToNumber(reader.uint64() as Long));
@@ -2439,14 +2451,14 @@ export const UInt64Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2551,47 +2563,48 @@ export const SInt32Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = reader.sint32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = reader.sint32();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = reader.sint32();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = reader.sint32();
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = reader.sint32();
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(reader.sint32());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.sint32());
@@ -2602,12 +2615,13 @@ export const SInt32Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(reader.sint32());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.sint32());
@@ -2618,14 +2632,14 @@ export const SInt32Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2730,47 +2744,48 @@ export const SInt64Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = longToNumber(reader.sint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.lt = longToNumber(reader.sint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.lte = longToNumber(reader.sint64() as Long);
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.gt = longToNumber(reader.sint64() as Long);
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.gte = longToNumber(reader.sint64() as Long);
           continue;
         case 6:
-          if (tag == 48) {
+          if (tag === 48) {
             message.in.push(longToNumber(reader.sint64() as Long));
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(longToNumber(reader.sint64() as Long));
@@ -2781,12 +2796,13 @@ export const SInt64Rules = {
 
           break;
         case 7:
-          if (tag == 56) {
+          if (tag === 56) {
             message.notIn.push(longToNumber(reader.sint64() as Long));
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(longToNumber(reader.sint64() as Long));
@@ -2797,14 +2813,14 @@ export const SInt64Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -2909,47 +2925,48 @@ export const Fixed32Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 13) {
+          if (tag !== 13) {
             break;
           }
 
           message.const = reader.fixed32();
           continue;
         case 2:
-          if (tag != 21) {
+          if (tag !== 21) {
             break;
           }
 
           message.lt = reader.fixed32();
           continue;
         case 3:
-          if (tag != 29) {
+          if (tag !== 29) {
             break;
           }
 
           message.lte = reader.fixed32();
           continue;
         case 4:
-          if (tag != 37) {
+          if (tag !== 37) {
             break;
           }
 
           message.gt = reader.fixed32();
           continue;
         case 5:
-          if (tag != 45) {
+          if (tag !== 45) {
             break;
           }
 
           message.gte = reader.fixed32();
           continue;
         case 6:
-          if (tag == 53) {
+          if (tag === 53) {
             message.in.push(reader.fixed32());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.fixed32());
@@ -2960,12 +2977,13 @@ export const Fixed32Rules = {
 
           break;
         case 7:
-          if (tag == 61) {
+          if (tag === 61) {
             message.notIn.push(reader.fixed32());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.fixed32());
@@ -2976,14 +2994,14 @@ export const Fixed32Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3088,47 +3106,48 @@ export const Fixed64Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 9) {
+          if (tag !== 9) {
             break;
           }
 
           message.const = longToNumber(reader.fixed64() as Long);
           continue;
         case 2:
-          if (tag != 17) {
+          if (tag !== 17) {
             break;
           }
 
           message.lt = longToNumber(reader.fixed64() as Long);
           continue;
         case 3:
-          if (tag != 25) {
+          if (tag !== 25) {
             break;
           }
 
           message.lte = longToNumber(reader.fixed64() as Long);
           continue;
         case 4:
-          if (tag != 33) {
+          if (tag !== 33) {
             break;
           }
 
           message.gt = longToNumber(reader.fixed64() as Long);
           continue;
         case 5:
-          if (tag != 41) {
+          if (tag !== 41) {
             break;
           }
 
           message.gte = longToNumber(reader.fixed64() as Long);
           continue;
         case 6:
-          if (tag == 49) {
+          if (tag === 49) {
             message.in.push(longToNumber(reader.fixed64() as Long));
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(longToNumber(reader.fixed64() as Long));
@@ -3139,12 +3158,13 @@ export const Fixed64Rules = {
 
           break;
         case 7:
-          if (tag == 57) {
+          if (tag === 57) {
             message.notIn.push(longToNumber(reader.fixed64() as Long));
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(longToNumber(reader.fixed64() as Long));
@@ -3155,14 +3175,14 @@ export const Fixed64Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3267,47 +3287,48 @@ export const SFixed32Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 13) {
+          if (tag !== 13) {
             break;
           }
 
           message.const = reader.sfixed32();
           continue;
         case 2:
-          if (tag != 21) {
+          if (tag !== 21) {
             break;
           }
 
           message.lt = reader.sfixed32();
           continue;
         case 3:
-          if (tag != 29) {
+          if (tag !== 29) {
             break;
           }
 
           message.lte = reader.sfixed32();
           continue;
         case 4:
-          if (tag != 37) {
+          if (tag !== 37) {
             break;
           }
 
           message.gt = reader.sfixed32();
           continue;
         case 5:
-          if (tag != 45) {
+          if (tag !== 45) {
             break;
           }
 
           message.gte = reader.sfixed32();
           continue;
         case 6:
-          if (tag == 53) {
+          if (tag === 53) {
             message.in.push(reader.sfixed32());
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.sfixed32());
@@ -3318,12 +3339,13 @@ export const SFixed32Rules = {
 
           break;
         case 7:
-          if (tag == 61) {
+          if (tag === 61) {
             message.notIn.push(reader.sfixed32());
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.sfixed32());
@@ -3334,14 +3356,14 @@ export const SFixed32Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3446,47 +3468,48 @@ export const SFixed64Rules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 9) {
+          if (tag !== 9) {
             break;
           }
 
           message.const = longToNumber(reader.sfixed64() as Long);
           continue;
         case 2:
-          if (tag != 17) {
+          if (tag !== 17) {
             break;
           }
 
           message.lt = longToNumber(reader.sfixed64() as Long);
           continue;
         case 3:
-          if (tag != 25) {
+          if (tag !== 25) {
             break;
           }
 
           message.lte = longToNumber(reader.sfixed64() as Long);
           continue;
         case 4:
-          if (tag != 33) {
+          if (tag !== 33) {
             break;
           }
 
           message.gt = longToNumber(reader.sfixed64() as Long);
           continue;
         case 5:
-          if (tag != 41) {
+          if (tag !== 41) {
             break;
           }
 
           message.gte = longToNumber(reader.sfixed64() as Long);
           continue;
         case 6:
-          if (tag == 49) {
+          if (tag === 49) {
             message.in.push(longToNumber(reader.sfixed64() as Long));
+
             continue;
           }
 
-          if (tag == 50) {
+          if (tag === 50) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(longToNumber(reader.sfixed64() as Long));
@@ -3497,12 +3520,13 @@ export const SFixed64Rules = {
 
           break;
         case 7:
-          if (tag == 57) {
+          if (tag === 57) {
             message.notIn.push(longToNumber(reader.sfixed64() as Long));
+
             continue;
           }
 
-          if (tag == 58) {
+          if (tag === 58) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(longToNumber(reader.sfixed64() as Long));
@@ -3513,14 +3537,14 @@ export const SFixed64Rules = {
 
           break;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3600,14 +3624,14 @@ export const BoolRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -3758,189 +3782,189 @@ export const StringRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.const = reader.string();
           continue;
         case 19:
-          if (tag != 152) {
+          if (tag !== 152) {
             break;
           }
 
           message.len = longToNumber(reader.uint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.minLen = longToNumber(reader.uint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.maxLen = longToNumber(reader.uint64() as Long);
           continue;
         case 20:
-          if (tag != 160) {
+          if (tag !== 160) {
             break;
           }
 
           message.lenBytes = longToNumber(reader.uint64() as Long);
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.minBytes = longToNumber(reader.uint64() as Long);
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.maxBytes = longToNumber(reader.uint64() as Long);
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.pattern = reader.string();
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.prefix = reader.string();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.suffix = reader.string();
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.contains = reader.string();
           continue;
         case 23:
-          if (tag != 186) {
+          if (tag !== 186) {
             break;
           }
 
           message.notContains = reader.string();
           continue;
         case 10:
-          if (tag != 82) {
+          if (tag !== 82) {
             break;
           }
 
           message.in.push(reader.string());
           continue;
         case 11:
-          if (tag != 90) {
+          if (tag !== 90) {
             break;
           }
 
           message.notIn.push(reader.string());
           continue;
         case 12:
-          if (tag != 96) {
+          if (tag !== 96) {
             break;
           }
 
           message.email = reader.bool();
           continue;
         case 13:
-          if (tag != 104) {
+          if (tag !== 104) {
             break;
           }
 
           message.hostname = reader.bool();
           continue;
         case 14:
-          if (tag != 112) {
+          if (tag !== 112) {
             break;
           }
 
           message.ip = reader.bool();
           continue;
         case 15:
-          if (tag != 120) {
+          if (tag !== 120) {
             break;
           }
 
           message.ipv4 = reader.bool();
           continue;
         case 16:
-          if (tag != 128) {
+          if (tag !== 128) {
             break;
           }
 
           message.ipv6 = reader.bool();
           continue;
         case 17:
-          if (tag != 136) {
+          if (tag !== 136) {
             break;
           }
 
           message.uri = reader.bool();
           continue;
         case 18:
-          if (tag != 144) {
+          if (tag !== 144) {
             break;
           }
 
           message.uriRef = reader.bool();
           continue;
         case 21:
-          if (tag != 168) {
+          if (tag !== 168) {
             break;
           }
 
           message.address = reader.bool();
           continue;
         case 22:
-          if (tag != 176) {
+          if (tag !== 176) {
             break;
           }
 
           message.uuid = reader.bool();
           continue;
         case 24:
-          if (tag != 192) {
+          if (tag !== 192) {
             break;
           }
 
           message.wellKnownRegex = reader.int32() as any;
           continue;
         case 25:
-          if (tag != 200) {
+          if (tag !== 200) {
             break;
           }
 
           message.strict = reader.bool();
           continue;
         case 26:
-          if (tag != 208) {
+          if (tag !== 208) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4059,14 +4083,14 @@ export const StringRules = {
 
 function createBaseBytesRules(): BytesRules {
   return {
-    const: new Uint8Array(),
+    const: new Uint8Array(0),
     len: 0,
     minLen: 0,
     maxLen: 0,
     pattern: "",
-    prefix: new Uint8Array(),
-    suffix: new Uint8Array(),
-    contains: new Uint8Array(),
+    prefix: new Uint8Array(0),
+    suffix: new Uint8Array(0),
+    contains: new Uint8Array(0),
     in: [],
     notIn: [],
     ip: undefined,
@@ -4131,105 +4155,105 @@ export const BytesRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.const = reader.bytes();
           continue;
         case 13:
-          if (tag != 104) {
+          if (tag !== 104) {
             break;
           }
 
           message.len = longToNumber(reader.uint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.minLen = longToNumber(reader.uint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.maxLen = longToNumber(reader.uint64() as Long);
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.pattern = reader.string();
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.prefix = reader.bytes();
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.suffix = reader.bytes();
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.contains = reader.bytes();
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.in.push(reader.bytes());
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.notIn.push(reader.bytes());
           continue;
         case 10:
-          if (tag != 80) {
+          if (tag !== 80) {
             break;
           }
 
           message.ip = reader.bool();
           continue;
         case 11:
-          if (tag != 88) {
+          if (tag !== 88) {
             break;
           }
 
           message.ipv4 = reader.bool();
           continue;
         case 12:
-          if (tag != 96) {
+          if (tag !== 96) {
             break;
           }
 
           message.ipv6 = reader.bool();
           continue;
         case 14:
-          if (tag != 112) {
+          if (tag !== 112) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4239,14 +4263,14 @@ export const BytesRules = {
 
   fromJSON(object: any): BytesRules {
     return {
-      const: isSet(object.const) ? bytesFromBase64(object.const) : new Uint8Array(),
+      const: isSet(object.const) ? bytesFromBase64(object.const) : new Uint8Array(0),
       len: isSet(object.len) ? Number(object.len) : 0,
       minLen: isSet(object.minLen) ? Number(object.minLen) : 0,
       maxLen: isSet(object.maxLen) ? Number(object.maxLen) : 0,
       pattern: isSet(object.pattern) ? String(object.pattern) : "",
-      prefix: isSet(object.prefix) ? bytesFromBase64(object.prefix) : new Uint8Array(),
-      suffix: isSet(object.suffix) ? bytesFromBase64(object.suffix) : new Uint8Array(),
-      contains: isSet(object.contains) ? bytesFromBase64(object.contains) : new Uint8Array(),
+      prefix: isSet(object.prefix) ? bytesFromBase64(object.prefix) : new Uint8Array(0),
+      suffix: isSet(object.suffix) ? bytesFromBase64(object.suffix) : new Uint8Array(0),
+      contains: isSet(object.contains) ? bytesFromBase64(object.contains) : new Uint8Array(0),
       in: Array.isArray(object?.in) ? object.in.map((e: any) => bytesFromBase64(e)) : [],
       notIn: Array.isArray(object?.notIn) ? object.notIn.map((e: any) => bytesFromBase64(e)) : [],
       ip: isSet(object.ip) ? Boolean(object.ip) : undefined,
@@ -4259,24 +4283,24 @@ export const BytesRules = {
   toJSON(message: BytesRules): unknown {
     const obj: any = {};
     message.const !== undefined &&
-      (obj.const = base64FromBytes(message.const !== undefined ? message.const : new Uint8Array()));
+      (obj.const = base64FromBytes(message.const !== undefined ? message.const : new Uint8Array(0)));
     message.len !== undefined && (obj.len = Math.round(message.len));
     message.minLen !== undefined && (obj.minLen = Math.round(message.minLen));
     message.maxLen !== undefined && (obj.maxLen = Math.round(message.maxLen));
     message.pattern !== undefined && (obj.pattern = message.pattern);
     message.prefix !== undefined &&
-      (obj.prefix = base64FromBytes(message.prefix !== undefined ? message.prefix : new Uint8Array()));
+      (obj.prefix = base64FromBytes(message.prefix !== undefined ? message.prefix : new Uint8Array(0)));
     message.suffix !== undefined &&
-      (obj.suffix = base64FromBytes(message.suffix !== undefined ? message.suffix : new Uint8Array()));
+      (obj.suffix = base64FromBytes(message.suffix !== undefined ? message.suffix : new Uint8Array(0)));
     message.contains !== undefined &&
-      (obj.contains = base64FromBytes(message.contains !== undefined ? message.contains : new Uint8Array()));
+      (obj.contains = base64FromBytes(message.contains !== undefined ? message.contains : new Uint8Array(0)));
     if (message.in) {
-      obj.in = message.in.map((e) => base64FromBytes(e !== undefined ? e : new Uint8Array()));
+      obj.in = message.in.map((e) => base64FromBytes(e !== undefined ? e : new Uint8Array(0)));
     } else {
       obj.in = [];
     }
     if (message.notIn) {
-      obj.notIn = message.notIn.map((e) => base64FromBytes(e !== undefined ? e : new Uint8Array()));
+      obj.notIn = message.notIn.map((e) => base64FromBytes(e !== undefined ? e : new Uint8Array(0)));
     } else {
       obj.notIn = [];
     }
@@ -4293,14 +4317,14 @@ export const BytesRules = {
 
   fromPartial<I extends Exact<DeepPartial<BytesRules>, I>>(object: I): BytesRules {
     const message = createBaseBytesRules();
-    message.const = object.const ?? new Uint8Array();
+    message.const = object.const ?? new Uint8Array(0);
     message.len = object.len ?? 0;
     message.minLen = object.minLen ?? 0;
     message.maxLen = object.maxLen ?? 0;
     message.pattern = object.pattern ?? "";
-    message.prefix = object.prefix ?? new Uint8Array();
-    message.suffix = object.suffix ?? new Uint8Array();
-    message.contains = object.contains ?? new Uint8Array();
+    message.prefix = object.prefix ?? new Uint8Array(0);
+    message.suffix = object.suffix ?? new Uint8Array(0);
+    message.contains = object.contains ?? new Uint8Array(0);
     message.in = object.in?.map((e) => e) || [];
     message.notIn = object.notIn?.map((e) => e) || [];
     message.ip = object.ip ?? undefined;
@@ -4344,26 +4368,27 @@ export const EnumRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.const = reader.int32();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.definedOnly = reader.bool();
           continue;
         case 3:
-          if (tag == 24) {
+          if (tag === 24) {
             message.in.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 26) {
+          if (tag === 26) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.in.push(reader.int32());
@@ -4374,12 +4399,13 @@ export const EnumRules = {
 
           break;
         case 4:
-          if (tag == 32) {
+          if (tag === 32) {
             message.notIn.push(reader.int32());
+
             continue;
           }
 
-          if (tag == 34) {
+          if (tag === 34) {
             const end2 = reader.uint32() + reader.pos;
             while (reader.pos < end2) {
               message.notIn.push(reader.int32());
@@ -4390,7 +4416,7 @@ export const EnumRules = {
 
           break;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4461,21 +4487,21 @@ export const MessageRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.skip = reader.bool();
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.required = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4541,42 +4567,42 @@ export const RepeatedRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.minItems = longToNumber(reader.uint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.maxItems = longToNumber(reader.uint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.unique = reader.bool();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.items = FieldRules.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 40) {
+          if (tag !== 40) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4656,49 +4682,49 @@ export const MapRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.minPairs = longToNumber(reader.uint64() as Long);
           continue;
         case 2:
-          if (tag != 16) {
+          if (tag !== 16) {
             break;
           }
 
           message.maxPairs = longToNumber(reader.uint64() as Long);
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.noSparse = reader.bool();
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.keys = FieldRules.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.values = FieldRules.decode(reader, reader.uint32());
           continue;
         case 6:
-          if (tag != 48) {
+          if (tag !== 48) {
             break;
           }
 
           message.ignoreEmpty = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4774,28 +4800,28 @@ export const AnyRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.required = reader.bool();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.in.push(reader.string());
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.notIn.push(reader.string());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -4890,63 +4916,63 @@ export const DurationRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.required = reader.bool();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.const = Duration.decode(reader, reader.uint32());
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.lt = Duration.decode(reader, reader.uint32());
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.lte = Duration.decode(reader, reader.uint32());
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.gt = Duration.decode(reader, reader.uint32());
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.gte = Duration.decode(reader, reader.uint32());
           continue;
         case 7:
-          if (tag != 58) {
+          if (tag !== 58) {
             break;
           }
 
           message.in.push(Duration.decode(reader, reader.uint32()));
           continue;
         case 8:
-          if (tag != 66) {
+          if (tag !== 66) {
             break;
           }
 
           message.notIn.push(Duration.decode(reader, reader.uint32()));
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -5062,70 +5088,70 @@ export const TimestampRules = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.required = reader.bool();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.const = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.lt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.lte = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 5:
-          if (tag != 42) {
+          if (tag !== 42) {
             break;
           }
 
           message.gt = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 6:
-          if (tag != 50) {
+          if (tag !== 50) {
             break;
           }
 
           message.gte = fromTimestamp(Timestamp.decode(reader, reader.uint32()));
           continue;
         case 7:
-          if (tag != 56) {
+          if (tag !== 56) {
             break;
           }
 
           message.ltNow = reader.bool();
           continue;
         case 8:
-          if (tag != 64) {
+          if (tag !== 64) {
             break;
           }
 
           message.gtNow = reader.bool();
           continue;
         case 9:
-          if (tag != 74) {
+          if (tag !== 74) {
             break;
           }
 
           message.within = Duration.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -5244,8 +5270,8 @@ function toTimestamp(date: Date): Timestamp {
 }
 
 function fromTimestamp(t: Timestamp): Date {
-  let millis = t.seconds * 1_000;
-  millis += t.nanos / 1_000_000;
+  let millis = (t.seconds || 0) * 1_000;
+  millis += (t.nanos || 0) / 1_000_000;
   return new Date(millis);
 }
 
diff --git a/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts b/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
index 830ddabcf..a585d9940 100644
--- a/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
+++ b/app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts
@@ -160,35 +160,35 @@ export const CraftingSchema = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 10) {
+          if (tag !== 10) {
             break;
           }
 
           message.schemaVersion = reader.string();
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.materials.push(CraftingSchema_Material.decode(reader, reader.uint32()));
           continue;
         case 3:
-          if (tag != 26) {
+          if (tag !== 26) {
             break;
           }
 
           message.envAllowList.push(reader.string());
           continue;
         case 4:
-          if (tag != 34) {
+          if (tag !== 34) {
             break;
           }
 
           message.runner = CraftingSchema_Runner.decode(reader, reader.uint32());
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -261,14 +261,14 @@ export const CraftingSchema_Runner = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.type = reader.int32() as any;
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
@@ -326,35 +326,35 @@ export const CraftingSchema_Material = {
       const tag = reader.uint32();
       switch (tag >>> 3) {
         case 1:
-          if (tag != 8) {
+          if (tag !== 8) {
             break;
           }
 
           message.type = reader.int32() as any;
           continue;
         case 2:
-          if (tag != 18) {
+          if (tag !== 18) {
             break;
           }
 
           message.name = reader.string();
           continue;
         case 3:
-          if (tag != 24) {
+          if (tag !== 24) {
             break;
           }
 
           message.optional = reader.bool();
           continue;
         case 4:
-          if (tag != 32) {
+          if (tag !== 32) {
             break;
           }
 
           message.output = reader.bool();
           continue;
       }
-      if ((tag & 7) == 4 || tag == 0) {
+      if ((tag & 7) === 4 || tag === 0) {
         break;
       }
       reader.skipType(tag & 7);
diff --git a/app/controlplane/cmd/wire_gen.go b/app/controlplane/cmd/wire_gen.go
index dd4926add..670de1940 100644
--- a/app/controlplane/cmd/wire_gen.go
+++ b/app/controlplane/cmd/wire_gen.go
@@ -31,9 +31,9 @@ func wireApp(bootstrap *conf.Bootstrap, readerWriter credentials.ReaderWriter, l
 	membershipRepo := data.NewMembershipRepo(dataData, logger)
 	membershipUseCase := biz.NewMembershipUseCase(membershipRepo, logger)
 	organizationRepo := data.NewOrganizationRepo(dataData, logger)
-	ociRepositoryRepo := data.NewOCIRepositoryRepo(dataData, logger)
+	casBackendRepo := data.NewCASBackendRepo(dataData, logger)
 	backendProvider := oci.NewBackendProvider(readerWriter)
-	ociRepositoryUseCase := biz.NewOCIRepositoryUseCase(ociRepositoryRepo, readerWriter, backendProvider, logger)
+	casBackendUseCase := biz.NewCASBackendUseCase(casBackendRepo, readerWriter, backendProvider, logger)
 	integrationRepo := data.NewIntegrationRepo(dataData, logger)
 	integrationAttachmentRepo := data.NewIntegrationAttachmentRepo(dataData, logger)
 	workflowRepo := data.NewWorkflowRepo(dataData, logger)
@@ -45,7 +45,7 @@ func wireApp(bootstrap *conf.Bootstrap, readerWriter credentials.ReaderWriter, l
 		Logger:  logger,
 	}
 	integrationUseCase := biz.NewIntegrationUseCase(newIntegrationUseCaseOpts)
-	organizationUseCase := biz.NewOrganizationUseCase(organizationRepo, ociRepositoryUseCase, integrationUseCase, logger)
+	organizationUseCase := biz.NewOrganizationUseCase(organizationRepo, casBackendUseCase, integrationUseCase, logger)
 	newUserUseCaseParams := &biz.NewUserUseCaseParams{
 		UserRepo:            userRepo,
 		MembershipUseCase:   membershipUseCase,
@@ -95,7 +95,7 @@ func wireApp(bootstrap *conf.Bootstrap, readerWriter credentials.ReaderWriter, l
 		WorkflowRunUC:      workflowRunUseCase,
 		WorkflowUC:         workflowUseCase,
 		WorkflowContractUC: workflowContractUseCase,
-		OCIUC:              ociRepositoryUseCase,
+		OCIUC:              casBackendUseCase,
 		CredsReader:        readerWriter,
 		IntegrationUseCase: integrationUseCase,
 		CasCredsUseCase:    casCredentialsUseCase,
@@ -104,8 +104,8 @@ func wireApp(bootstrap *conf.Bootstrap, readerWriter credentials.ReaderWriter, l
 	}
 	attestationService := service.NewAttestationService(newAttestationServiceOpts)
 	workflowContractService := service.NewWorkflowSchemaService(workflowContractUseCase, v2...)
-	contextService := service.NewContextService(ociRepositoryUseCase, v2...)
-	casCredentialsService := service.NewCASCredentialsService(casCredentialsUseCase, ociRepositoryUseCase, v2...)
+	contextService := service.NewContextService(casBackendUseCase, v2...)
+	casCredentialsService := service.NewCASCredentialsService(casCredentialsUseCase, casBackendUseCase, v2...)
 	orgMetricsRepo := data.NewOrgMetricsRepo(dataData, logger)
 	orgMetricsUseCase, err := biz.NewOrgMetricsUseCase(orgMetricsRepo, logger)
 	if err != nil {
@@ -113,31 +113,31 @@ func wireApp(bootstrap *conf.Bootstrap, readerWriter credentials.ReaderWriter, l
 		return nil, nil, err
 	}
 	orgMetricsService := service.NewOrgMetricsService(orgMetricsUseCase, v2...)
-	ociRepositoryService := service.NewOCIRepositoryService(ociRepositoryUseCase, v2...)
+	ociRepositoryService := service.NewOCIRepositoryService(casBackendUseCase, v2...)
 	integrationsService := service.NewIntegrationsService(integrationUseCase, workflowUseCase, availablePlugins, v2...)
 	organizationService := service.NewOrganizationService(membershipUseCase, v2...)
 	opts := &server.Opts{
-		UserUseCase:          userUseCase,
-		RobotAccountUseCase:  robotAccountUseCase,
-		OCIRepositoryUseCase: ociRepositoryUseCase,
-		CASClientUseCase:     casClientUseCase,
-		IntegrationUseCase:   integrationUseCase,
-		WorkflowSvc:          workflowService,
-		AuthSvc:              authService,
-		RobotAccountSvc:      robotAccountService,
-		WorkflowRunSvc:       workflowRunService,
-		AttesstationSvc:      attestationService,
-		WorkflowContractSvc:  workflowContractService,
-		ContextSvc:           contextService,
-		CASCredsSvc:          casCredentialsService,
-		OrgMetricsSvc:        orgMetricsService,
-		OCIRepositorySvc:     ociRepositoryService,
-		IntegrationsSvc:      integrationsService,
-		OrganizationSvc:      organizationService,
-		Logger:               logger,
-		ServerConfig:         confServer,
-		AuthConfig:           auth,
-		Credentials:          readerWriter,
+		UserUseCase:         userUseCase,
+		RobotAccountUseCase: robotAccountUseCase,
+		CASBackendUseCase:   casBackendUseCase,
+		CASClientUseCase:    casClientUseCase,
+		IntegrationUseCase:  integrationUseCase,
+		WorkflowSvc:         workflowService,
+		AuthSvc:             authService,
+		RobotAccountSvc:     robotAccountService,
+		WorkflowRunSvc:      workflowRunService,
+		AttestationSvc:      attestationService,
+		WorkflowContractSvc: workflowContractService,
+		ContextSvc:          contextService,
+		CASCredsSvc:         casCredentialsService,
+		OrgMetricsSvc:       orgMetricsService,
+		OCIRepositorySvc:    ociRepositoryService,
+		IntegrationsSvc:     integrationsService,
+		OrganizationSvc:     organizationService,
+		Logger:              logger,
+		ServerConfig:        confServer,
+		AuthConfig:          auth,
+		Credentials:         readerWriter,
 	}
 	grpcServer := server.NewGRPCServer(opts)
 	httpServer, err := server.NewHTTPServer(opts, grpcServer)
diff --git a/app/controlplane/internal/biz/biz.go b/app/controlplane/internal/biz/biz.go
index 131a95082..332481700 100644
--- a/app/controlplane/internal/biz/biz.go
+++ b/app/controlplane/internal/biz/biz.go
@@ -26,7 +26,7 @@ var ProviderSet = wire.NewSet(
 	NewOrganizationUseCase,
 	NewWorkflowContractUseCase,
 	NewCASCredentialsUseCase,
-	NewOCIRepositoryUseCase,
+	NewCASBackendUseCase,
 	NewOrgMetricsUseCase,
 	NewIntegrationUseCase,
 	NewMembershipUseCase,
diff --git a/app/controlplane/internal/biz/casbackend.go b/app/controlplane/internal/biz/casbackend.go
new file mode 100644
index 000000000..b76468315
--- /dev/null
+++ b/app/controlplane/internal/biz/casbackend.go
@@ -0,0 +1,272 @@
+//
+// Copyright 2023 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package biz
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	backend "github.com/chainloop-dev/chainloop/internal/blobmanager"
+	"github.com/chainloop-dev/chainloop/internal/credentials"
+	"github.com/chainloop-dev/chainloop/internal/servicelogger"
+	"github.com/go-kratos/kratos/v2/log"
+	"github.com/google/uuid"
+)
+
+type CASBackendProvider string
+
+const (
+	CASBackendOCI CASBackendProvider = "OCI"
+)
+
+type CASBackendValidationStatus string
+
+var CASBackendValidationOK CASBackendValidationStatus = "OK"
+var CASBackendValidationFailed CASBackendValidationStatus = "Invalid"
+
+type CASBackend struct {
+	ID, Name, SecretName   string
+	CreatedAt, ValidatedAt *time.Time
+	OrganizationID         string
+	ValidationStatus       CASBackendValidationStatus
+	// OCI, S3, ...
+	Provider CASBackendProvider
+	// Wether this is the default cas backend for the organization
+	Default bool
+}
+
+type CASBackendOpts struct {
+	Name, Username, Password, SecretName string
+	Provider                             CASBackendProvider
+	Default                              bool
+}
+
+type CASBackendCreateOpts struct {
+	*CASBackendOpts
+	OrgID uuid.UUID
+}
+
+type CASBackendUpdateOpts struct {
+	*CASBackendOpts
+	ID uuid.UUID
+}
+
+type CASBackendRepo interface {
+	FindDefaultBackend(ctx context.Context, orgID uuid.UUID) (*CASBackend, error)
+	FindByID(ctx context.Context, ID uuid.UUID) (*CASBackend, error)
+	UpdateValidationStatus(ctx context.Context, ID uuid.UUID, status CASBackendValidationStatus) error
+	Create(context.Context, *CASBackendCreateOpts) (*CASBackend, error)
+	Update(context.Context, *CASBackendUpdateOpts) (*CASBackend, error)
+	Delete(ctx context.Context, ID uuid.UUID) error
+}
+
+type CASBackendReader interface {
+	FindDefaultBackend(ctx context.Context, orgID string) (*CASBackend, error)
+	FindByID(ctx context.Context, ID string) (*CASBackend, error)
+	PerformValidation(ctx context.Context, ID string) error
+}
+
+type CASBackendUseCase struct {
+	repo               CASBackendRepo
+	logger             *log.Helper
+	credsRW            credentials.ReaderWriter
+	ociBackendProvider backend.Provider
+}
+
+func NewCASBackendUseCase(repo CASBackendRepo, credsRW credentials.ReaderWriter, p backend.Provider, l log.Logger) *CASBackendUseCase {
+	if l == nil {
+		l = log.NewStdLogger(io.Discard)
+	}
+
+	return &CASBackendUseCase{repo, servicelogger.ScopedHelper(l, "biz/CASBackend"), credsRW, p}
+}
+
+func (uc *CASBackendUseCase) FindDefaultBackend(ctx context.Context, orgID string) (*CASBackend, error) {
+	orgUUID, err := uuid.Parse(orgID)
+	if err != nil {
+		return nil, NewErrInvalidUUID(err)
+	}
+
+	return uc.repo.FindDefaultBackend(ctx, orgUUID)
+}
+
+func (uc *CASBackendUseCase) FindByID(ctx context.Context, id string) (*CASBackend, error) {
+	backendUUID, err := uuid.Parse(id)
+	if err != nil {
+		return nil, NewErrInvalidUUID(err)
+	}
+
+	backend, err := uc.repo.FindByID(ctx, backendUUID)
+	if err != nil {
+		return nil, err
+	} else if backend == nil {
+		return nil, NewErrNotFound("CAS Backend")
+	}
+
+	return backend, nil
+}
+
+// TODO(miguel): we need to think about the update mechanism and add some guardrails
+// for example, we might only allow updating credentials but not the repository itself or the provider
+func (uc *CASBackendUseCase) CreateOrUpdate(ctx context.Context, orgID, name, username, password string, provider CASBackendProvider, defaultB bool) (*CASBackend, error) {
+	orgUUID, err := uuid.Parse(orgID)
+	if err != nil {
+		return nil, NewErrInvalidUUID(err)
+	}
+
+	// Validate and store the secret in the external secrets manager
+	creds := &credentials.OCIKeypair{Repo: name, Username: username, Password: password}
+	if err := creds.Validate(); err != nil {
+		return nil, NewErrValidation(err)
+	}
+
+	secretName, err := uc.credsRW.SaveCredentials(ctx, orgID, creds)
+	if err != nil {
+		return nil, fmt.Errorf("storing the credentials: %w", err)
+	}
+
+	// Check if it already exists, if it does we update it
+	// We do not support more than one repository per organization yet
+	backend, err := uc.repo.FindDefaultBackend(ctx, orgUUID)
+	if err != nil {
+		return nil, fmt.Errorf("checking for existing CAS backends: %w", err)
+	}
+
+	if backend != nil {
+		backendUUID, err := uuid.Parse(backend.ID)
+		if err != nil {
+			return nil, NewErrInvalidUUID(err)
+		}
+
+		return uc.repo.Update(ctx, &CASBackendUpdateOpts{
+			CASBackendOpts: &CASBackendOpts{
+				Name: name, Username: username, Password: password, SecretName: secretName, Provider: provider, Default: defaultB,
+			},
+			ID: backendUUID,
+		})
+	}
+
+	return uc.repo.Create(ctx, &CASBackendCreateOpts{
+		OrgID: orgUUID,
+		CASBackendOpts: &CASBackendOpts{
+			Name: name, Username: username, Password: password, SecretName: secretName, Provider: provider,
+			Default: defaultB,
+		},
+	})
+}
+
+// Delete will delete the secret in the external secrets manager and the CAS backend from the database
+func (uc *CASBackendUseCase) Delete(ctx context.Context, id string) error {
+	uc.logger.Infow("msg", "deleting CAS Backend", "ID", id)
+
+	backendUUID, err := uuid.Parse(id)
+	if err != nil {
+		return NewErrInvalidUUID(err)
+	}
+
+	backend, err := uc.repo.FindByID(ctx, backendUUID)
+	if err != nil {
+		return err
+	} else if backend == nil {
+		return NewErrNotFound("CAS Backend")
+	}
+
+	uc.logger.Infow("msg", "deleting CAS backend external secrets", "ID", id, "secretName", backend.SecretName)
+	// Delete the secret in the external secrets manager
+	if err := uc.credsRW.DeleteCredentials(ctx, backend.SecretName); err != nil {
+		return fmt.Errorf("deleting the credentials: %w", err)
+	}
+
+	uc.logger.Infow("msg", "CAS Backend deleted", "ID", id)
+	return uc.repo.Delete(ctx, backendUUID)
+}
+
+// Implements https://pkg.go.dev/entgo.io/ent/schema/field#EnumValues
+func (CASBackendValidationStatus) Values() (kinds []string) {
+	for _, s := range []CASBackendValidationStatus{CASBackendValidationOK, CASBackendValidationFailed} {
+		kinds = append(kinds, string(s))
+	}
+
+	return
+}
+
+// Validate that the repository is valid and reachable
+// TODO: run this process periodically in the background
+// TODO: we need to support other kinds of repositories this is for the OCI type
+func (uc *CASBackendUseCase) PerformValidation(ctx context.Context, id string) (err error) {
+	validationStatus := CASBackendValidationFailed
+
+	backendUUID, err := uuid.Parse(id)
+	if err != nil {
+		return NewErrInvalidUUID(err)
+	}
+
+	backend, err := uc.repo.FindByID(ctx, backendUUID)
+	if err != nil {
+		return err
+	} else if backend == nil {
+		return NewErrNotFound("CAS Backend")
+	}
+
+	// Currently this code is just for OCI repositories
+	if backend.Provider != CASBackendOCI {
+		uc.logger.Warnw("msg", "validation not supported for this provider", "ID", id, "provider", backend.Provider)
+		return nil
+	}
+
+	defer func() {
+		// If the actual validation logic failed we do not update the underlying repository
+		if err != nil {
+			return
+		}
+
+		// Update the validation status
+		uc.logger.Infow("msg", "updating validation status", "ID", id, "status", validationStatus)
+		if err := uc.repo.UpdateValidationStatus(ctx, backendUUID, validationStatus); err != nil {
+			uc.logger.Errorw("msg", "updating validation status", "ID", id, "error", err)
+		}
+	}()
+
+	// 1 - Retrieve the credentials from the external secrets manager
+	b, err := uc.ociBackendProvider.FromCredentials(ctx, backend.SecretName)
+	if err != nil {
+		uc.logger.Infow("msg", "credentials not found or invalid", "ID", id)
+		return nil
+	}
+
+	// 2 - Perform a write validation
+	if err = b.CheckWritePermissions(context.TODO()); err != nil {
+		uc.logger.Infow("msg", "permissions validation failed", "ID", id)
+		return nil
+	}
+
+	// If everything went well, update the validation status to OK
+	validationStatus = CASBackendValidationOK
+	uc.logger.Infow("msg", "validation OK", "ID", id)
+
+	return nil
+}
+
+// Implements https://pkg.go.dev/entgo.io/ent/schema/field#EnumValues
+func (CASBackendProvider) Values() (kinds []string) {
+	for _, s := range []CASBackendProvider{CASBackendOCI} {
+		kinds = append(kinds, string(s))
+	}
+
+	return
+}
diff --git a/app/controlplane/internal/biz/ocirepository_test.go b/app/controlplane/internal/biz/casbackend_test.go
similarity index 65%
rename from app/controlplane/internal/biz/ocirepository_test.go
rename to app/controlplane/internal/biz/casbackend_test.go
index 431a28db3..b34dad0cf 100644
--- a/app/controlplane/internal/biz/ocirepository_test.go
+++ b/app/controlplane/internal/biz/casbackend_test.go
@@ -31,99 +31,99 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-type ociRepositoryTestSuite struct {
+type casBackendTestSuite struct {
 	suite.Suite
 	validUUID       uuid.UUID
 	invalidUUID     string
-	useCase         *biz.OCIRepositoryUseCase
-	repo            *bizMocks.OCIRepositoryRepo
+	useCase         *biz.CASBackendUseCase
+	repo            *bizMocks.CASBackendRepo
 	credsRW         *credentialsM.ReaderWriter
 	backendProvider *blobM.Provider
 }
 
-func (s *ociRepositoryTestSuite) TestFindMainRepoErr() {
-	repo, err := s.useCase.FindMainRepo(context.Background(), s.invalidUUID)
+func (s *casBackendTestSuite) TestFindDefaultBackendErr() {
+	repo, err := s.useCase.FindDefaultBackend(context.Background(), s.invalidUUID)
 	assert.True(s.T(), biz.IsErrInvalidUUID(err))
 	assert.Nil(s.T(), repo)
 }
 
-func (s *ociRepositoryTestSuite) TestFindMainRepoNotFound() {
+func (s *casBackendTestSuite) TestFindDefaultBackendNotFound() {
 	assert := assert.New(s.T())
 
 	// Not found
 	ctx := context.Background()
-	s.repo.On("FindMainRepo", ctx, s.validUUID).Return(nil, nil)
+	s.repo.On("FindDefaultBackend", ctx, s.validUUID).Return(nil, nil)
 
-	repo, err := s.useCase.FindMainRepo(ctx, s.validUUID.String())
+	repo, err := s.useCase.FindDefaultBackend(ctx, s.validUUID.String())
 	assert.NoError(err)
 	assert.Nil(repo)
 }
 
-func (s *ociRepositoryTestSuite) TestFindMainRepoFound() {
+func (s *casBackendTestSuite) TestFindDefaultBackendFound() {
 	assert := assert.New(s.T())
 
 	ctx := context.Background()
-	wantRepo := &biz.OCIRepository{}
-	s.repo.On("FindMainRepo", ctx, s.validUUID).Return(wantRepo, nil)
+	wantBackend := &biz.CASBackend{}
+	s.repo.On("FindDefaultBackend", ctx, s.validUUID).Return(wantBackend, nil)
 
-	repo, err := s.useCase.FindMainRepo(ctx, s.validUUID.String())
+	backend, err := s.useCase.FindDefaultBackend(ctx, s.validUUID.String())
 	assert.NoError(err)
-	assert.Equal(repo, wantRepo)
+	assert.Equal(backend, wantBackend)
 }
 
-func (s *ociRepositoryTestSuite) TestSaveInvalidUUID() {
-	repo, err := s.useCase.CreateOrUpdate(context.Background(), s.invalidUUID, "", "", "")
+func (s *casBackendTestSuite) TestSaveInvalidUUID() {
+	repo, err := s.useCase.CreateOrUpdate(context.Background(), s.invalidUUID, "", "", "", biz.CASBackendOCI, true)
 	assert.True(s.T(), biz.IsErrInvalidUUID(err))
 	assert.Nil(s.T(), repo)
 }
 
 // If a repo exists it will get updated
-func (s *ociRepositoryTestSuite) TestSaveMainRepoAlreadyExist() {
+func (s *casBackendTestSuite) TestSaveDefaultBackendAlreadyExist() {
 	assert := assert.New(s.T())
 	const repoName, username, password = "repo", "username", "pass"
 
-	r := &biz.OCIRepository{ID: s.validUUID.String()}
+	r := &biz.CASBackend{ID: s.validUUID.String()}
 	ctx := context.Background()
-	s.repo.On("FindMainRepo", ctx, s.validUUID).Return(r, nil)
+	s.repo.On("FindDefaultBackend", ctx, s.validUUID).Return(r, nil)
 	s.credsRW.On("SaveCredentials", ctx, s.validUUID.String(), mock.Anything).Return("secret-key", nil)
-	s.repo.On("Update", ctx, &biz.OCIRepoUpdateOpts{
+	s.repo.On("Update", ctx, &biz.CASBackendUpdateOpts{
 		ID: s.validUUID,
-		OCIRepoOpts: &biz.OCIRepoOpts{
-			Repository: repoName, Username: username, Password: password, SecretName: "secret-key",
+		CASBackendOpts: &biz.CASBackendOpts{
+			Name: repoName, Username: username, Password: password, SecretName: "secret-key", Default: true, Provider: biz.CASBackendOCI,
 		},
 	}).Return(r, nil)
 
-	gotRepo, err := s.useCase.CreateOrUpdate(ctx, s.validUUID.String(), repoName, username, password)
+	gotRepo, err := s.useCase.CreateOrUpdate(ctx, s.validUUID.String(), repoName, username, password, biz.CASBackendOCI, true)
 	assert.NoError(err)
 	assert.Equal(gotRepo, r)
 }
 
-func (s *ociRepositoryTestSuite) TestSaveMainRepoOk() {
+func (s *casBackendTestSuite) TestSaveDefaultBackendOk() {
 	assert := assert.New(s.T())
 
 	ctx := context.Background()
 	const repo, username, password = "repo", "username", "pass"
 
-	s.repo.On("FindMainRepo", ctx, s.validUUID).Return(nil, nil)
+	s.repo.On("FindDefaultBackend", ctx, s.validUUID).Return(nil, nil)
 	s.credsRW.On("SaveCredentials", ctx, s.validUUID.String(), mock.Anything).Return("secret-key", nil)
 
-	newRepo := &biz.OCIRepository{}
-	s.repo.On("Create", ctx, &biz.OCIRepoCreateOpts{
+	newRepo := &biz.CASBackend{}
+	s.repo.On("Create", ctx, &biz.CASBackendCreateOpts{
 		OrgID: s.validUUID,
-		OCIRepoOpts: &biz.OCIRepoOpts{
-			Repository: repo, Username: username, Password: password, SecretName: "secret-key",
+		CASBackendOpts: &biz.CASBackendOpts{
+			Name: repo, Username: username, Password: password, SecretName: "secret-key", Default: true, Provider: biz.CASBackendOCI,
 		},
 	}).Return(newRepo, nil)
 
-	gotRepo, err := s.useCase.CreateOrUpdate(ctx, s.validUUID.String(), repo, username, password)
+	gotRepo, err := s.useCase.CreateOrUpdate(ctx, s.validUUID.String(), repo, username, password, biz.CASBackendOCI, true)
 	assert.NoError(err)
 	assert.Equal(gotRepo, newRepo)
 }
 
-func (s *ociRepositoryTestSuite) TestPerformValidation() {
+func (s *casBackendTestSuite) TestPerformValidation() {
 	assert := assert.New(s.T())
 	t := s.T()
-	validRepo := &biz.OCIRepository{ID: s.validUUID.String(), ValidationStatus: biz.OCIRepoValidationOK}
+	validRepo := &biz.CASBackend{ID: s.validUUID.String(), ValidationStatus: biz.CASBackendValidationOK, Provider: biz.CASBackendOCI}
 
 	t.Run("invalid uuid", func(t *testing.T) {
 		err := s.useCase.PerformValidation(context.Background(), s.invalidUUID)
@@ -137,9 +137,9 @@ func (s *ociRepositoryTestSuite) TestPerformValidation() {
 		s.resetMock()
 	})
 
-	t.Run("credentials missing, set validation status => invalid", func(t *testing.T) {
+	t.Run("proper provider credentials missing, set validation status => invalid", func(t *testing.T) {
 		s.repo.On("FindByID", mock.Anything, s.validUUID).Return(validRepo, nil)
-		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.OCIRepoValidationFailed).Return(nil)
+		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.CASBackendValidationFailed).Return(nil)
 		s.backendProvider.On("FromCredentials", mock.Anything, mock.Anything).Return(nil, credentials.ErrNotFound)
 		err := s.useCase.PerformValidation(context.Background(), s.validUUID.String())
 		assert.NoError(err)
@@ -150,7 +150,7 @@ func (s *ociRepositoryTestSuite) TestPerformValidation() {
 		b := blobM.NewUploaderDownloader(t)
 
 		s.repo.On("FindByID", mock.Anything, s.validUUID).Return(validRepo, nil)
-		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.OCIRepoValidationFailed).Return(nil)
+		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.CASBackendValidationFailed).Return(nil)
 		s.backendProvider.On("FromCredentials", mock.Anything, mock.Anything).Return(b, nil)
 		b.On("CheckWritePermissions", mock.Anything).Return(errors.New("invalid credentials"))
 
@@ -163,7 +163,7 @@ func (s *ociRepositoryTestSuite) TestPerformValidation() {
 		b := blobM.NewUploaderDownloader(t)
 
 		s.repo.On("FindByID", mock.Anything, s.validUUID).Return(validRepo, nil)
-		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.OCIRepoValidationOK).Return(nil)
+		s.repo.On("UpdateValidationStatus", mock.Anything, s.validUUID, biz.CASBackendValidationOK).Return(nil)
 		s.backendProvider.On("FromCredentials", mock.Anything, mock.Anything).Return(b, nil)
 		b.On("CheckWritePermissions", mock.Anything).Return(nil)
 
@@ -174,21 +174,21 @@ func (s *ociRepositoryTestSuite) TestPerformValidation() {
 }
 
 // Run all the tests
-func TestOCIRepository(t *testing.T) {
-	suite.Run(t, new(ociRepositoryTestSuite))
+func TestCASBackend(t *testing.T) {
+	suite.Run(t, new(casBackendTestSuite))
 }
 
-func (s *ociRepositoryTestSuite) resetMock() {
+func (s *casBackendTestSuite) resetMock() {
 	s.repo.Mock = mock.Mock{}
 	s.credsRW.Mock = mock.Mock{}
 	s.backendProvider.Mock = mock.Mock{}
 }
 
-func (s *ociRepositoryTestSuite) SetupTest() {
+func (s *casBackendTestSuite) SetupTest() {
 	s.validUUID = uuid.New()
 	s.invalidUUID = "deadbeef"
-	s.repo = bizMocks.NewOCIRepositoryRepo(s.T())
+	s.repo = bizMocks.NewCASBackendRepo(s.T())
 	s.credsRW = credentialsM.NewReaderWriter(s.T())
 	s.backendProvider = blobM.NewProvider(s.T())
-	s.useCase = biz.NewOCIRepositoryUseCase(s.repo, s.credsRW, s.backendProvider, nil)
+	s.useCase = biz.NewCASBackendUseCase(s.repo, s.credsRW, s.backendProvider, nil)
 }
diff --git a/app/controlplane/internal/biz/mocks/CASBackendReader.go b/app/controlplane/internal/biz/mocks/CASBackendReader.go
new file mode 100644
index 000000000..8ca1a72f4
--- /dev/null
+++ b/app/controlplane/internal/biz/mocks/CASBackendReader.go
@@ -0,0 +1,97 @@
+// Code generated by mockery v2.20.0. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	biz "github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// CASBackendReader is an autogenerated mock type for the CASBackendReader type
+type CASBackendReader struct {
+	mock.Mock
+}
+
+// FindByID provides a mock function with given fields: ctx, ID
+func (_m *CASBackendReader) FindByID(ctx context.Context, ID string) (*biz.CASBackend, error) {
+	ret := _m.Called(ctx, ID)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*biz.CASBackend, error)); ok {
+		return rf(ctx, ID)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) *biz.CASBackend); ok {
+		r0 = rf(ctx, ID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, ID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// FindDefaultBackend provides a mock function with given fields: ctx, orgID
+func (_m *CASBackendReader) FindDefaultBackend(ctx context.Context, orgID string) (*biz.CASBackend, error) {
+	ret := _m.Called(ctx, orgID)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) (*biz.CASBackend, error)); ok {
+		return rf(ctx, orgID)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) *biz.CASBackend); ok {
+		r0 = rf(ctx, orgID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, orgID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// PerformValidation provides a mock function with given fields: ctx, ID
+func (_m *CASBackendReader) PerformValidation(ctx context.Context, ID string) error {
+	ret := _m.Called(ctx, ID)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = rf(ctx, ID)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewCASBackendReader interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewCASBackendReader creates a new instance of CASBackendReader. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewCASBackendReader(t mockConstructorTestingTNewCASBackendReader) *CASBackendReader {
+	mock := &CASBackendReader{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/app/controlplane/internal/biz/mocks/CASBackendRepo.go b/app/controlplane/internal/biz/mocks/CASBackendRepo.go
new file mode 100644
index 000000000..aae205b65
--- /dev/null
+++ b/app/controlplane/internal/biz/mocks/CASBackendRepo.go
@@ -0,0 +1,165 @@
+// Code generated by mockery v2.20.0. DO NOT EDIT.
+
+package mocks
+
+import (
+	context "context"
+
+	biz "github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+
+	mock "github.com/stretchr/testify/mock"
+
+	uuid "github.com/google/uuid"
+)
+
+// CASBackendRepo is an autogenerated mock type for the CASBackendRepo type
+type CASBackendRepo struct {
+	mock.Mock
+}
+
+// Create provides a mock function with given fields: _a0, _a1
+func (_m *CASBackendRepo) Create(_a0 context.Context, _a1 *biz.CASBackendCreateOpts) (*biz.CASBackend, error) {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *biz.CASBackendCreateOpts) (*biz.CASBackend, error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *biz.CASBackendCreateOpts) *biz.CASBackend); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *biz.CASBackendCreateOpts) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Delete provides a mock function with given fields: ctx, ID
+func (_m *CASBackendRepo) Delete(ctx context.Context, ID uuid.UUID) error {
+	ret := _m.Called(ctx, ID)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) error); ok {
+		r0 = rf(ctx, ID)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// FindByID provides a mock function with given fields: ctx, ID
+func (_m *CASBackendRepo) FindByID(ctx context.Context, ID uuid.UUID) (*biz.CASBackend, error) {
+	ret := _m.Called(ctx, ID)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) (*biz.CASBackend, error)); ok {
+		return rf(ctx, ID)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) *biz.CASBackend); ok {
+		r0 = rf(ctx, ID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, uuid.UUID) error); ok {
+		r1 = rf(ctx, ID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// FindDefaultBackend provides a mock function with given fields: ctx, orgID
+func (_m *CASBackendRepo) FindDefaultBackend(ctx context.Context, orgID uuid.UUID) (*biz.CASBackend, error) {
+	ret := _m.Called(ctx, orgID)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) (*biz.CASBackend, error)); ok {
+		return rf(ctx, orgID)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) *biz.CASBackend); ok {
+		r0 = rf(ctx, orgID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, uuid.UUID) error); ok {
+		r1 = rf(ctx, orgID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Update provides a mock function with given fields: _a0, _a1
+func (_m *CASBackendRepo) Update(_a0 context.Context, _a1 *biz.CASBackendUpdateOpts) (*biz.CASBackend, error) {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 *biz.CASBackend
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *biz.CASBackendUpdateOpts) (*biz.CASBackend, error)); ok {
+		return rf(_a0, _a1)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *biz.CASBackendUpdateOpts) *biz.CASBackend); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*biz.CASBackend)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *biz.CASBackendUpdateOpts) error); ok {
+		r1 = rf(_a0, _a1)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// UpdateValidationStatus provides a mock function with given fields: ctx, ID, status
+func (_m *CASBackendRepo) UpdateValidationStatus(ctx context.Context, ID uuid.UUID, status biz.CASBackendValidationStatus) error {
+	ret := _m.Called(ctx, ID, status)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID, biz.CASBackendValidationStatus) error); ok {
+		r0 = rf(ctx, ID, status)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewCASBackendRepo interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewCASBackendRepo creates a new instance of CASBackendRepo. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewCASBackendRepo(t mockConstructorTestingTNewCASBackendRepo) *CASBackendRepo {
+	mock := &CASBackendRepo{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/app/controlplane/internal/biz/mocks/OCIRepositoryReader.go b/app/controlplane/internal/biz/mocks/OCIRepositoryReader.go
deleted file mode 100644
index 2c4ac32b0..000000000
--- a/app/controlplane/internal/biz/mocks/OCIRepositoryReader.go
+++ /dev/null
@@ -1,139 +0,0 @@
-//
-// Copyright 2023 The Chainloop Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by mockery v2.20.0. DO NOT EDIT.
-
-package mocks
-
-import (
-	biz "github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	backend "github.com/chainloop-dev/chainloop/internal/blobmanager"
-
-	context "context"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// OCIRepositoryReader is an autogenerated mock type for the OCIRepositoryReader type
-type OCIRepositoryReader struct {
-	mock.Mock
-}
-
-// FindByID provides a mock function with given fields: ctx, ID
-func (_m *OCIRepositoryReader) FindByID(ctx context.Context, ID string) (*biz.OCIRepository, error) {
-	ret := _m.Called(ctx, ID)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, string) (*biz.OCIRepository, error)); ok {
-		return rf(ctx, ID)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, string) *biz.OCIRepository); ok {
-		r0 = rf(ctx, ID)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
-		r1 = rf(ctx, ID)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// FindMainRepo provides a mock function with given fields: ctx, orgID
-func (_m *OCIRepositoryReader) FindMainRepo(ctx context.Context, orgID string) (*biz.OCIRepository, error) {
-	ret := _m.Called(ctx, orgID)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, string) (*biz.OCIRepository, error)); ok {
-		return rf(ctx, orgID)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, string) *biz.OCIRepository); ok {
-		r0 = rf(ctx, orgID)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
-		r1 = rf(ctx, orgID)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// PerformValidation provides a mock function with given fields: ctx, ID
-func (_m *OCIRepositoryReader) PerformValidation(ctx context.Context, ID string) error {
-	ret := _m.Called(ctx, ID)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, string) error); ok {
-		r0 = rf(ctx, ID)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// loadUploaderBackend provides a mock function with given fields: ctx, secretName
-func (_m *OCIRepositoryReader) loadUploaderBackend(ctx context.Context, secretName string) (backend.Uploader, error) {
-	ret := _m.Called(ctx, secretName)
-
-	var r0 backend.Uploader
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, string) (backend.Uploader, error)); ok {
-		return rf(ctx, secretName)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, string) backend.Uploader); ok {
-		r0 = rf(ctx, secretName)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(backend.Uploader)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
-		r1 = rf(ctx, secretName)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-type mockConstructorTestingTNewOCIRepositoryReader interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewOCIRepositoryReader creates a new instance of OCIRepositoryReader. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewOCIRepositoryReader(t mockConstructorTestingTNewOCIRepositoryReader) *OCIRepositoryReader {
-	mock := &OCIRepositoryReader{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/app/controlplane/internal/biz/mocks/OCIRepositoryRepo.go b/app/controlplane/internal/biz/mocks/OCIRepositoryRepo.go
deleted file mode 100644
index 617575e1a..000000000
--- a/app/controlplane/internal/biz/mocks/OCIRepositoryRepo.go
+++ /dev/null
@@ -1,180 +0,0 @@
-//
-// Copyright 2023 The Chainloop Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by mockery v2.20.0. DO NOT EDIT.
-
-package mocks
-
-import (
-	context "context"
-
-	biz "github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-
-	mock "github.com/stretchr/testify/mock"
-
-	uuid "github.com/google/uuid"
-)
-
-// OCIRepositoryRepo is an autogenerated mock type for the OCIRepositoryRepo type
-type OCIRepositoryRepo struct {
-	mock.Mock
-}
-
-// Create provides a mock function with given fields: _a0, _a1
-func (_m *OCIRepositoryRepo) Create(_a0 context.Context, _a1 *biz.OCIRepoCreateOpts) (*biz.OCIRepository, error) {
-	ret := _m.Called(_a0, _a1)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *biz.OCIRepoCreateOpts) (*biz.OCIRepository, error)); ok {
-		return rf(_a0, _a1)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, *biz.OCIRepoCreateOpts) *biz.OCIRepository); ok {
-		r0 = rf(_a0, _a1)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, *biz.OCIRepoCreateOpts) error); ok {
-		r1 = rf(_a0, _a1)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// Delete provides a mock function with given fields: ctx, ID
-func (_m *OCIRepositoryRepo) Delete(ctx context.Context, ID uuid.UUID) error {
-	ret := _m.Called(ctx, ID)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) error); ok {
-		r0 = rf(ctx, ID)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// FindByID provides a mock function with given fields: ctx, ID
-func (_m *OCIRepositoryRepo) FindByID(ctx context.Context, ID uuid.UUID) (*biz.OCIRepository, error) {
-	ret := _m.Called(ctx, ID)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) (*biz.OCIRepository, error)); ok {
-		return rf(ctx, ID)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) *biz.OCIRepository); ok {
-		r0 = rf(ctx, ID)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, uuid.UUID) error); ok {
-		r1 = rf(ctx, ID)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// FindMainRepo provides a mock function with given fields: ctx, orgID
-func (_m *OCIRepositoryRepo) FindMainRepo(ctx context.Context, orgID uuid.UUID) (*biz.OCIRepository, error) {
-	ret := _m.Called(ctx, orgID)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) (*biz.OCIRepository, error)); ok {
-		return rf(ctx, orgID)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID) *biz.OCIRepository); ok {
-		r0 = rf(ctx, orgID)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, uuid.UUID) error); ok {
-		r1 = rf(ctx, orgID)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// Update provides a mock function with given fields: _a0, _a1
-func (_m *OCIRepositoryRepo) Update(_a0 context.Context, _a1 *biz.OCIRepoUpdateOpts) (*biz.OCIRepository, error) {
-	ret := _m.Called(_a0, _a1)
-
-	var r0 *biz.OCIRepository
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, *biz.OCIRepoUpdateOpts) (*biz.OCIRepository, error)); ok {
-		return rf(_a0, _a1)
-	}
-	if rf, ok := ret.Get(0).(func(context.Context, *biz.OCIRepoUpdateOpts) *biz.OCIRepository); ok {
-		r0 = rf(_a0, _a1)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*biz.OCIRepository)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(context.Context, *biz.OCIRepoUpdateOpts) error); ok {
-		r1 = rf(_a0, _a1)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// UpdateValidationStatus provides a mock function with given fields: ctx, ID, status
-func (_m *OCIRepositoryRepo) UpdateValidationStatus(ctx context.Context, ID uuid.UUID, status biz.OCIRepoValidationStatus) error {
-	ret := _m.Called(ctx, ID, status)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(context.Context, uuid.UUID, biz.OCIRepoValidationStatus) error); ok {
-		r0 = rf(ctx, ID, status)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-type mockConstructorTestingTNewOCIRepositoryRepo interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewOCIRepositoryRepo creates a new instance of OCIRepositoryRepo. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewOCIRepositoryRepo(t mockConstructorTestingTNewOCIRepositoryRepo) *OCIRepositoryRepo {
-	mock := &OCIRepositoryRepo{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/app/controlplane/internal/biz/ocirepository.go b/app/controlplane/internal/biz/ocirepository.go
deleted file mode 100644
index 855048755..000000000
--- a/app/controlplane/internal/biz/ocirepository.go
+++ /dev/null
@@ -1,245 +0,0 @@
-//
-// Copyright 2023 The Chainloop Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package biz
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"time"
-
-	backend "github.com/chainloop-dev/chainloop/internal/blobmanager"
-	"github.com/chainloop-dev/chainloop/internal/credentials"
-	"github.com/chainloop-dev/chainloop/internal/servicelogger"
-	"github.com/go-kratos/kratos/v2/log"
-	"github.com/google/uuid"
-)
-
-type OCIRepository struct {
-	ID, Repo, SecretName   string
-	CreatedAt, ValidatedAt *time.Time
-	OrganizationID         string
-	ValidationStatus       OCIRepoValidationStatus
-}
-
-type OCIRepoOpts struct {
-	Repository, Username, Password, SecretName string
-}
-
-type OCIRepoCreateOpts struct {
-	*OCIRepoOpts
-	OrgID uuid.UUID
-}
-
-type OCIRepoUpdateOpts struct {
-	*OCIRepoOpts
-	ID uuid.UUID
-}
-
-type OCIRepositoryRepo interface {
-	FindMainRepo(ctx context.Context, orgID uuid.UUID) (*OCIRepository, error)
-	FindByID(ctx context.Context, ID uuid.UUID) (*OCIRepository, error)
-	UpdateValidationStatus(ctx context.Context, ID uuid.UUID, status OCIRepoValidationStatus) error
-	Create(context.Context, *OCIRepoCreateOpts) (*OCIRepository, error)
-	Update(context.Context, *OCIRepoUpdateOpts) (*OCIRepository, error)
-	Delete(ctx context.Context, ID uuid.UUID) error
-}
-
-type OCIRepositoryReader interface {
-	FindMainRepo(ctx context.Context, orgID string) (*OCIRepository, error)
-	FindByID(ctx context.Context, ID string) (*OCIRepository, error)
-	PerformValidation(ctx context.Context, ID string) error
-}
-
-type OCIRepositoryUseCase struct {
-	repo               OCIRepositoryRepo
-	logger             *log.Helper
-	credsRW            credentials.ReaderWriter
-	ociBackendProvider backend.Provider
-}
-
-func NewOCIRepositoryUseCase(repo OCIRepositoryRepo, credsRW credentials.ReaderWriter, p backend.Provider, l log.Logger) *OCIRepositoryUseCase {
-	if l == nil {
-		l = log.NewStdLogger(io.Discard)
-	}
-
-	return &OCIRepositoryUseCase{repo, servicelogger.ScopedHelper(l, "biz/ocirepository"), credsRW, p}
-}
-
-var ErrAlreadyRepoInOrg = errors.New("there is already an OCI repository associated with this organization")
-
-func (uc *OCIRepositoryUseCase) FindMainRepo(ctx context.Context, orgID string) (*OCIRepository, error) {
-	orgUUID, err := uuid.Parse(orgID)
-	if err != nil {
-		return nil, NewErrInvalidUUID(err)
-	}
-
-	return uc.repo.FindMainRepo(ctx, orgUUID)
-}
-
-func (uc *OCIRepositoryUseCase) FindByID(ctx context.Context, id string) (*OCIRepository, error) {
-	repoUUID, err := uuid.Parse(id)
-	if err != nil {
-		return nil, NewErrInvalidUUID(err)
-	}
-
-	repo, err := uc.repo.FindByID(ctx, repoUUID)
-	if err != nil {
-		return nil, err
-	} else if repo == nil {
-		return nil, NewErrNotFound("OCI repository")
-	}
-
-	return repo, nil
-}
-
-func (uc *OCIRepositoryUseCase) CreateOrUpdate(ctx context.Context, orgID, repoURL, username, password string) (*OCIRepository, error) {
-	orgUUID, err := uuid.Parse(orgID)
-	if err != nil {
-		return nil, NewErrInvalidUUID(err)
-	}
-
-	// Validate and store the secret in the external secrets manager
-	creds := &credentials.OCIKeypair{Repo: repoURL, Username: username, Password: password}
-	if err := creds.Validate(); err != nil {
-		return nil, NewErrValidation(err)
-	}
-
-	secretName, err := uc.credsRW.SaveCredentials(ctx, orgID, creds)
-	if err != nil {
-		return nil, fmt.Errorf("storing the credentials: %w", err)
-	}
-
-	// Check if it already exists, if it does we update it
-	// We do not support more than one repository per organization yet
-	repo, err := uc.repo.FindMainRepo(ctx, orgUUID)
-	if err != nil {
-		return nil, fmt.Errorf("checking for existing repositories: %w", err)
-	}
-
-	if repo != nil {
-		repoUUID, err := uuid.Parse(repo.ID)
-		if err != nil {
-			return nil, NewErrInvalidUUID(err)
-		}
-
-		return uc.repo.Update(ctx, &OCIRepoUpdateOpts{
-			OCIRepoOpts: &OCIRepoOpts{
-				Repository: repoURL, Username: username, Password: password, SecretName: secretName,
-			},
-			ID: repoUUID,
-		})
-	}
-
-	return uc.repo.Create(ctx, &OCIRepoCreateOpts{
-		OrgID: orgUUID,
-		OCIRepoOpts: &OCIRepoOpts{
-			Repository: repoURL, Username: username, Password: password, SecretName: secretName,
-		},
-	})
-}
-
-// Delete will delete the secret in the external secrets manager
-// and the repository in the database
-func (uc *OCIRepositoryUseCase) Delete(ctx context.Context, id string) error {
-	uc.logger.Infow("msg", "deleting OCI repository", "ID", id)
-
-	repoUUID, err := uuid.Parse(id)
-	if err != nil {
-		return NewErrInvalidUUID(err)
-	}
-
-	repo, err := uc.repo.FindByID(ctx, repoUUID)
-	if err != nil {
-		return err
-	} else if repo == nil {
-		return NewErrNotFound("OCI repository")
-	}
-
-	uc.logger.Infow("msg", "deleting OCI repository external secrets", "ID", id, "secretName", repo.SecretName)
-	// Delete the secret in the external secrets manager
-	if err := uc.credsRW.DeleteCredentials(ctx, repo.SecretName); err != nil {
-		return fmt.Errorf("deleting the credentials: %w", err)
-	}
-
-	uc.logger.Infow("msg", "OCI repository deleted", "ID", id)
-	return uc.repo.Delete(ctx, repoUUID)
-}
-
-type OCIRepoValidationStatus string
-
-var OCIRepoValidationOK OCIRepoValidationStatus = "OK"
-var OCIRepoValidationFailed OCIRepoValidationStatus = "Invalid"
-
-// Implements https://pkg.go.dev/entgo.io/ent/schema/field#EnumValues
-func (OCIRepoValidationStatus) Values() (kinds []string) {
-	for _, s := range []OCIRepoValidationStatus{OCIRepoValidationOK, OCIRepoValidationFailed} {
-		kinds = append(kinds, string(s))
-	}
-
-	return
-}
-
-// Validate that the repository is valid and reachable
-// TODO: run this process periodically in the background
-func (uc *OCIRepositoryUseCase) PerformValidation(ctx context.Context, id string) (err error) {
-	validationStatus := OCIRepoValidationFailed
-
-	repoUUID, err := uuid.Parse(id)
-	if err != nil {
-		return NewErrInvalidUUID(err)
-	}
-
-	repo, err := uc.repo.FindByID(ctx, repoUUID)
-	if err != nil {
-		return err
-	} else if repo == nil {
-		return NewErrNotFound("OCI repository")
-	}
-
-	defer func() {
-		// If the actual validation logic failed we do not update the underlying repository
-		if err != nil {
-			return
-		}
-
-		// Update the validation status
-		uc.logger.Infow("msg", "updating validation status", "ID", id, "status", validationStatus)
-		if err := uc.repo.UpdateValidationStatus(ctx, repoUUID, validationStatus); err != nil {
-			uc.logger.Errorw("msg", "updating validation status", "ID", id, "error", err)
-		}
-	}()
-
-	// 1 - Retrieve the credentials from the external secrets manager
-	b, err := uc.ociBackendProvider.FromCredentials(ctx, repo.SecretName)
-	if err != nil {
-		uc.logger.Infow("msg", "credentials not found or invalid", "ID", id)
-		return nil
-	}
-
-	// 2 - Perform a write validation
-	if err = b.CheckWritePermissions(context.TODO()); err != nil {
-		uc.logger.Infow("msg", "permissions validation failed", "ID", id)
-		return nil
-	}
-
-	// If everything went well, update the validation status to OK
-	validationStatus = OCIRepoValidationOK
-	uc.logger.Infow("msg", "validation OK", "ID", id)
-
-	return nil
-}
diff --git a/app/controlplane/internal/biz/organization.go b/app/controlplane/internal/biz/organization.go
index 41bc68b92..04aad07ee 100644
--- a/app/controlplane/internal/biz/organization.go
+++ b/app/controlplane/internal/biz/organization.go
@@ -36,17 +36,17 @@ type OrganizationRepo interface {
 }
 
 type OrganizationUseCase struct {
-	orgRepo       OrganizationRepo
-	logger        *log.Helper
-	ociUseCase    *OCIRepositoryUseCase
-	integrationUC *IntegrationUseCase
+	orgRepo           OrganizationRepo
+	logger            *log.Helper
+	casBackendUseCase *CASBackendUseCase
+	integrationUC     *IntegrationUseCase
 }
 
-func NewOrganizationUseCase(repo OrganizationRepo, repoUC *OCIRepositoryUseCase, iUC *IntegrationUseCase, logger log.Logger) *OrganizationUseCase {
+func NewOrganizationUseCase(repo OrganizationRepo, repoUC *CASBackendUseCase, iUC *IntegrationUseCase, logger log.Logger) *OrganizationUseCase {
 	return &OrganizationUseCase{orgRepo: repo,
-		logger:        log.NewHelper(logger),
-		ociUseCase:    repoUC,
-		integrationUC: iUC,
+		logger:            log.NewHelper(logger),
+		casBackendUseCase: repoUC,
+		integrationUC:     iUC,
 	}
 }
 
@@ -103,7 +103,7 @@ func (uc *OrganizationUseCase) Delete(ctx context.Context, id string) error {
 
 	// Delete the associated repository
 	// Currently there is only one repository per organization
-	ociRepository, err := uc.ociUseCase.FindMainRepo(ctx, org.ID)
+	ociRepository, err := uc.casBackendUseCase.FindDefaultBackend(ctx, org.ID)
 	if err != nil {
 		return err
 	}
@@ -111,7 +111,7 @@ func (uc *OrganizationUseCase) Delete(ctx context.Context, id string) error {
 	if ociRepository != nil {
 		// We make sure to call the OCI repository use case to delete the repository
 		// including the external secret
-		if err := uc.ociUseCase.Delete(ctx, ociRepository.ID); err != nil {
+		if err := uc.casBackendUseCase.Delete(ctx, ociRepository.ID); err != nil {
 			return err
 		}
 	}
diff --git a/app/controlplane/internal/biz/organization_integration_test.go b/app/controlplane/internal/biz/organization_integration_test.go
index 786a39f70..e6b6f4ec3 100644
--- a/app/controlplane/internal/biz/organization_integration_test.go
+++ b/app/controlplane/internal/biz/organization_integration_test.go
@@ -66,7 +66,7 @@ func (s *OrgIntegrationTestSuite) TestDeleteOrg() {
 		assert.NoError(err)
 		assert.Empty(integrations)
 
-		ociRepo, err := s.OCIRepo.FindMainRepo(ctx, s.org.ID)
+		ociRepo, err := s.CASBackendRepo.FindDefaultBackend(ctx, s.org.ID)
 		assert.NoError(err)
 		assert.Nil(ociRepo)
 
@@ -128,7 +128,7 @@ func (s *OrgIntegrationTestSuite) SetupTest() {
 	assert.NoError(err)
 
 	// OCI repository
-	_, err = s.OCIRepo.CreateOrUpdate(ctx, s.org.ID, "repo", "username", "pass")
+	_, err = s.CASBackendRepo.CreateOrUpdate(ctx, s.org.ID, "repo", "username", "pass", biz.CASBackendOCI, true)
 	assert.NoError(err)
 
 	// Workflow + contract
@@ -140,7 +140,7 @@ func (s *OrgIntegrationTestSuite) SetupTest() {
 	assert.NoError(err)
 	assert.Len(integrations, 1)
 
-	ociRepo, err := s.OCIRepo.FindMainRepo(ctx, s.org.ID)
+	ociRepo, err := s.CASBackendRepo.FindDefaultBackend(ctx, s.org.ID)
 	assert.NoError(err)
 	assert.NotNil(ociRepo)
 
diff --git a/app/controlplane/internal/biz/testhelpers/database.go b/app/controlplane/internal/biz/testhelpers/database.go
index 5444d3f16..82f15a226 100644
--- a/app/controlplane/internal/biz/testhelpers/database.go
+++ b/app/controlplane/internal/biz/testhelpers/database.go
@@ -52,7 +52,7 @@ type TestingUseCases struct {
 
 	// Use cases
 	Membership             *biz.MembershipUseCase
-	OCIRepo                *biz.OCIRepositoryUseCase
+	CASBackendRepo         *biz.CASBackendUseCase
 	Integration            *biz.IntegrationUseCase
 	Organization           *biz.OrganizationUseCase
 	WorkflowContract       *biz.WorkflowContractUseCase
diff --git a/app/controlplane/internal/biz/testhelpers/wire_gen.go b/app/controlplane/internal/biz/testhelpers/wire_gen.go
index 9a2aeab69..81bc35888 100644
--- a/app/controlplane/internal/biz/testhelpers/wire_gen.go
+++ b/app/controlplane/internal/biz/testhelpers/wire_gen.go
@@ -33,9 +33,9 @@ func WireTestData(testDatabase *TestDatabase, t *testing.T, logger log.Logger, r
 	}
 	membershipRepo := data.NewMembershipRepo(dataData, logger)
 	membershipUseCase := biz.NewMembershipUseCase(membershipRepo, logger)
-	ociRepositoryRepo := data.NewOCIRepositoryRepo(dataData, logger)
+	casBackendRepo := data.NewCASBackendRepo(dataData, logger)
 	backendProvider := oci.NewBackendProvider(readerWriter)
-	ociRepositoryUseCase := biz.NewOCIRepositoryUseCase(ociRepositoryRepo, readerWriter, backendProvider, logger)
+	casBackendUseCase := biz.NewCASBackendUseCase(casBackendRepo, readerWriter, backendProvider, logger)
 	integrationRepo := data.NewIntegrationRepo(dataData, logger)
 	integrationAttachmentRepo := data.NewIntegrationAttachmentRepo(dataData, logger)
 	workflowRepo := data.NewWorkflowRepo(dataData, logger)
@@ -48,7 +48,7 @@ func WireTestData(testDatabase *TestDatabase, t *testing.T, logger log.Logger, r
 	}
 	integrationUseCase := biz.NewIntegrationUseCase(newIntegrationUseCaseOpts)
 	organizationRepo := data.NewOrganizationRepo(dataData, logger)
-	organizationUseCase := biz.NewOrganizationUseCase(organizationRepo, ociRepositoryUseCase, integrationUseCase, logger)
+	organizationUseCase := biz.NewOrganizationUseCase(organizationRepo, casBackendUseCase, integrationUseCase, logger)
 	workflowContractRepo := data.NewWorkflowContractRepo(dataData, logger)
 	workflowContractUseCase := biz.NewWorkflowContractUseCase(workflowContractRepo, logger)
 	workflowUseCase := biz.NewWorkflowUsecase(workflowRepo, workflowContractUseCase, logger)
@@ -73,7 +73,7 @@ func WireTestData(testDatabase *TestDatabase, t *testing.T, logger log.Logger, r
 		Data:                   dataData,
 		L:                      logger,
 		Membership:             membershipUseCase,
-		OCIRepo:                ociRepositoryUseCase,
+		CASBackendRepo:         casBackendUseCase,
 		Integration:            integrationUseCase,
 		Organization:           organizationUseCase,
 		WorkflowContract:       workflowContractUseCase,
diff --git a/app/controlplane/internal/data/casbackend.go b/app/controlplane/internal/data/casbackend.go
new file mode 100644
index 000000000..c2dd04d14
--- /dev/null
+++ b/app/controlplane/internal/data/casbackend.go
@@ -0,0 +1,125 @@
+//
+// Copyright 2023 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package data
+
+import (
+	"context"
+	"time"
+
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/go-kratos/kratos/v2/log"
+	"github.com/google/uuid"
+)
+
+type CASBackendRepo struct {
+	data *Data
+	log  *log.Helper
+}
+
+func NewCASBackendRepo(data *Data, logger log.Logger) biz.CASBackendRepo {
+	return &CASBackendRepo{
+		data: data,
+		log:  log.NewHelper(logger),
+	}
+}
+
+func (r *CASBackendRepo) FindDefaultBackend(ctx context.Context, orgID uuid.UUID) (*biz.CASBackend, error) {
+	backend, err := orgScopedQuery(r.data.db, orgID).QueryCasBackends().Where(casbackend.Default(true)).Only(ctx)
+	if err != nil && !ent.IsNotFound(err) {
+		return nil, err
+	}
+
+	return entCASBackendToBiz(backend), nil
+}
+
+func (r *CASBackendRepo) Create(ctx context.Context, opts *biz.CASBackendCreateOpts) (*biz.CASBackend, error) {
+	backend, err := r.data.db.CASBackend.Create().
+		SetOrganizationID(opts.OrgID).
+		SetName(opts.Name).
+		SetProvider(opts.Provider).
+		SetDefault(opts.Default).
+		SetSecretName(opts.SecretName).
+		Save(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return entCASBackendToBiz(backend), nil
+}
+
+func (r *CASBackendRepo) Update(ctx context.Context, opts *biz.CASBackendUpdateOpts) (*biz.CASBackend, error) {
+	backend, err := r.data.db.CASBackend.UpdateOneID(opts.ID).
+		SetName(opts.Name).
+		SetProvider(opts.Provider).
+		SetDefault(opts.Default).
+		SetSecretName(opts.SecretName).
+		Save(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return entCASBackendToBiz(backend), nil
+}
+
+// FindByID finds a CAS backend by ID in the given organization.
+// If not found, returns nil and no error
+func (r *CASBackendRepo) FindByID(ctx context.Context, id uuid.UUID) (*biz.CASBackend, error) {
+	backend, err := r.data.db.CASBackend.Query().WithOrganization().Where(casbackend.ID(id)).Only(ctx)
+	if err != nil && !ent.IsNotFound(err) {
+		return nil, err
+	} else if backend == nil {
+		return nil, nil
+	}
+
+	return entCASBackendToBiz(backend), nil
+}
+
+func (r *CASBackendRepo) Delete(ctx context.Context, id uuid.UUID) error {
+	return r.data.db.CASBackend.DeleteOneID(id).Exec(ctx)
+}
+
+// UpdateValidationStatus updates the validation status of an OCI repository
+func (r *CASBackendRepo) UpdateValidationStatus(ctx context.Context, id uuid.UUID, status biz.CASBackendValidationStatus) error {
+	return r.data.db.CASBackend.UpdateOneID(id).
+		SetValidationStatus(status).
+		SetValidatedAt(time.Now()).
+		Exec(ctx)
+}
+
+func entCASBackendToBiz(backend *ent.CASBackend) *biz.CASBackend {
+	if backend == nil {
+		return nil
+	}
+
+	r := &biz.CASBackend{
+		ID:               backend.ID.String(),
+		Name:             backend.Name,
+		SecretName:       backend.SecretName,
+		CreatedAt:        toTimePtr(backend.CreatedAt),
+		ValidatedAt:      toTimePtr(backend.ValidatedAt),
+		ValidationStatus: backend.ValidationStatus,
+		Provider:         backend.Provider,
+		Default:          backend.Default,
+	}
+
+	if org := backend.Edges.Organization; org != nil {
+		r.OrganizationID = org.ID.String()
+	}
+
+	return r
+}
diff --git a/app/controlplane/internal/data/ocirepository_test.go b/app/controlplane/internal/data/casbackend_test.go
similarity index 76%
rename from app/controlplane/internal/data/ocirepository_test.go
rename to app/controlplane/internal/data/casbackend_test.go
index 4b69b73b6..4811dd268 100644
--- a/app/controlplane/internal/data/ocirepository_test.go
+++ b/app/controlplane/internal/data/casbackend_test.go
@@ -25,29 +25,33 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestEntOCIRepoTo(t *testing.T) {
-	testRepo := &ent.OCIRepository{
+func TestEntCASBackendTo(t *testing.T) {
+	testRepo := &ent.CASBackend{
 		ID:         uuid.New(),
-		Repo:       "test-repo",
+		Name:       "test-repo",
+		Provider:   "test-provider",
 		SecretName: "test-secret",
 		CreatedAt:  time.Now(),
+		Default:    true,
 	}
 
 	tests := []struct {
-		input  *ent.OCIRepository
-		output *biz.OCIRepository
+		input  *ent.CASBackend
+		output *biz.CASBackend
 	}{
 		{nil, nil},
-		{testRepo, &biz.OCIRepository{
+		{testRepo, &biz.CASBackend{
 			ID:         testRepo.ID.String(),
-			Repo:       testRepo.Repo,
+			Name:       testRepo.Name,
 			SecretName: testRepo.SecretName,
 			CreatedAt:  toTimePtr(testRepo.CreatedAt),
+			Provider:   testRepo.Provider,
+			Default:    true,
 		}},
 	}
 
 	for _, tc := range tests {
-		got := entOCIRepoToBiz(tc.input)
+		got := entCASBackendToBiz(tc.input)
 		assert.Equal(t, tc.output, got)
 	}
 }
diff --git a/app/controlplane/internal/data/data.go b/app/controlplane/internal/data/data.go
index 1ef2a0004..467c294d5 100644
--- a/app/controlplane/internal/data/data.go
+++ b/app/controlplane/internal/data/data.go
@@ -46,7 +46,7 @@ var ProviderSet = wire.NewSet(
 	NewWorkflowRunRepo,
 	NewOrganizationRepo,
 	NewWorkflowContractRepo,
-	NewOCIRepositoryRepo,
+	NewCASBackendRepo,
 	NewOrgMetricsRepo,
 	NewIntegrationRepo,
 	NewIntegrationAttachmentRepo,
diff --git a/app/controlplane/internal/data/ent/casbackend.go b/app/controlplane/internal/data/ent/casbackend.go
new file mode 100644
index 000000000..28005f16d
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend.go
@@ -0,0 +1,217 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect/sql"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
+	"github.com/google/uuid"
+)
+
+// CASBackend is the model entity for the CASBackend schema.
+type CASBackend struct {
+	config `json:"-"`
+	// ID of the ent.
+	ID uuid.UUID `json:"id,omitempty"`
+	// Name holds the value of the "name" field.
+	Name string `json:"name,omitempty"`
+	// SecretName holds the value of the "secret_name" field.
+	SecretName string `json:"secret_name,omitempty"`
+	// CreatedAt holds the value of the "created_at" field.
+	CreatedAt time.Time `json:"created_at,omitempty"`
+	// ValidationStatus holds the value of the "validation_status" field.
+	ValidationStatus biz.CASBackendValidationStatus `json:"validation_status,omitempty"`
+	// ValidatedAt holds the value of the "validated_at" field.
+	ValidatedAt time.Time `json:"validated_at,omitempty"`
+	// Provider holds the value of the "provider" field.
+	Provider biz.CASBackendProvider `json:"provider,omitempty"`
+	// Default holds the value of the "default" field.
+	Default bool `json:"default,omitempty"`
+	// Edges holds the relations/edges for other nodes in the graph.
+	// The values are being populated by the CASBackendQuery when eager-loading is set.
+	Edges                     CASBackendEdges `json:"edges"`
+	organization_cas_backends *uuid.UUID
+	selectValues              sql.SelectValues
+}
+
+// CASBackendEdges holds the relations/edges for other nodes in the graph.
+type CASBackendEdges struct {
+	// Organization holds the value of the organization edge.
+	Organization *Organization `json:"organization,omitempty"`
+	// loadedTypes holds the information for reporting if a
+	// type was loaded (or requested) in eager-loading or not.
+	loadedTypes [1]bool
+}
+
+// OrganizationOrErr returns the Organization value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e CASBackendEdges) OrganizationOrErr() (*Organization, error) {
+	if e.loadedTypes[0] {
+		if e.Organization == nil {
+			// Edge was loaded but was not found.
+			return nil, &NotFoundError{label: organization.Label}
+		}
+		return e.Organization, nil
+	}
+	return nil, &NotLoadedError{edge: "organization"}
+}
+
+// scanValues returns the types for scanning values from sql.Rows.
+func (*CASBackend) scanValues(columns []string) ([]any, error) {
+	values := make([]any, len(columns))
+	for i := range columns {
+		switch columns[i] {
+		case casbackend.FieldDefault:
+			values[i] = new(sql.NullBool)
+		case casbackend.FieldName, casbackend.FieldSecretName, casbackend.FieldValidationStatus, casbackend.FieldProvider:
+			values[i] = new(sql.NullString)
+		case casbackend.FieldCreatedAt, casbackend.FieldValidatedAt:
+			values[i] = new(sql.NullTime)
+		case casbackend.FieldID:
+			values[i] = new(uuid.UUID)
+		case casbackend.ForeignKeys[0]: // organization_cas_backends
+			values[i] = &sql.NullScanner{S: new(uuid.UUID)}
+		default:
+			values[i] = new(sql.UnknownType)
+		}
+	}
+	return values, nil
+}
+
+// assignValues assigns the values that were returned from sql.Rows (after scanning)
+// to the CASBackend fields.
+func (cb *CASBackend) assignValues(columns []string, values []any) error {
+	if m, n := len(values), len(columns); m < n {
+		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
+	}
+	for i := range columns {
+		switch columns[i] {
+		case casbackend.FieldID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field id", values[i])
+			} else if value != nil {
+				cb.ID = *value
+			}
+		case casbackend.FieldName:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field name", values[i])
+			} else if value.Valid {
+				cb.Name = value.String
+			}
+		case casbackend.FieldSecretName:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field secret_name", values[i])
+			} else if value.Valid {
+				cb.SecretName = value.String
+			}
+		case casbackend.FieldCreatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field created_at", values[i])
+			} else if value.Valid {
+				cb.CreatedAt = value.Time
+			}
+		case casbackend.FieldValidationStatus:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field validation_status", values[i])
+			} else if value.Valid {
+				cb.ValidationStatus = biz.CASBackendValidationStatus(value.String)
+			}
+		case casbackend.FieldValidatedAt:
+			if value, ok := values[i].(*sql.NullTime); !ok {
+				return fmt.Errorf("unexpected type %T for field validated_at", values[i])
+			} else if value.Valid {
+				cb.ValidatedAt = value.Time
+			}
+		case casbackend.FieldProvider:
+			if value, ok := values[i].(*sql.NullString); !ok {
+				return fmt.Errorf("unexpected type %T for field provider", values[i])
+			} else if value.Valid {
+				cb.Provider = biz.CASBackendProvider(value.String)
+			}
+		case casbackend.FieldDefault:
+			if value, ok := values[i].(*sql.NullBool); !ok {
+				return fmt.Errorf("unexpected type %T for field default", values[i])
+			} else if value.Valid {
+				cb.Default = value.Bool
+			}
+		case casbackend.ForeignKeys[0]:
+			if value, ok := values[i].(*sql.NullScanner); !ok {
+				return fmt.Errorf("unexpected type %T for field organization_cas_backends", values[i])
+			} else if value.Valid {
+				cb.organization_cas_backends = new(uuid.UUID)
+				*cb.organization_cas_backends = *value.S.(*uuid.UUID)
+			}
+		default:
+			cb.selectValues.Set(columns[i], values[i])
+		}
+	}
+	return nil
+}
+
+// Value returns the ent.Value that was dynamically selected and assigned to the CASBackend.
+// This includes values selected through modifiers, order, etc.
+func (cb *CASBackend) Value(name string) (ent.Value, error) {
+	return cb.selectValues.Get(name)
+}
+
+// QueryOrganization queries the "organization" edge of the CASBackend entity.
+func (cb *CASBackend) QueryOrganization() *OrganizationQuery {
+	return NewCASBackendClient(cb.config).QueryOrganization(cb)
+}
+
+// Update returns a builder for updating this CASBackend.
+// Note that you need to call CASBackend.Unwrap() before calling this method if this CASBackend
+// was returned from a transaction, and the transaction was committed or rolled back.
+func (cb *CASBackend) Update() *CASBackendUpdateOne {
+	return NewCASBackendClient(cb.config).UpdateOne(cb)
+}
+
+// Unwrap unwraps the CASBackend entity that was returned from a transaction after it was closed,
+// so that all future queries will be executed through the driver which created the transaction.
+func (cb *CASBackend) Unwrap() *CASBackend {
+	_tx, ok := cb.config.driver.(*txDriver)
+	if !ok {
+		panic("ent: CASBackend is not a transactional entity")
+	}
+	cb.config.driver = _tx.drv
+	return cb
+}
+
+// String implements the fmt.Stringer.
+func (cb *CASBackend) String() string {
+	var builder strings.Builder
+	builder.WriteString("CASBackend(")
+	builder.WriteString(fmt.Sprintf("id=%v, ", cb.ID))
+	builder.WriteString("name=")
+	builder.WriteString(cb.Name)
+	builder.WriteString(", ")
+	builder.WriteString("secret_name=")
+	builder.WriteString(cb.SecretName)
+	builder.WriteString(", ")
+	builder.WriteString("created_at=")
+	builder.WriteString(cb.CreatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("validation_status=")
+	builder.WriteString(fmt.Sprintf("%v", cb.ValidationStatus))
+	builder.WriteString(", ")
+	builder.WriteString("validated_at=")
+	builder.WriteString(cb.ValidatedAt.Format(time.ANSIC))
+	builder.WriteString(", ")
+	builder.WriteString("provider=")
+	builder.WriteString(fmt.Sprintf("%v", cb.Provider))
+	builder.WriteString(", ")
+	builder.WriteString("default=")
+	builder.WriteString(fmt.Sprintf("%v", cb.Default))
+	builder.WriteByte(')')
+	return builder.String()
+}
+
+// CASBackends is a parsable slice of CASBackend.
+type CASBackends []*CASBackend
diff --git a/app/controlplane/internal/data/ent/ocirepository/ocirepository.go b/app/controlplane/internal/data/ent/casbackend/casbackend.go
similarity index 66%
rename from app/controlplane/internal/data/ent/ocirepository/ocirepository.go
rename to app/controlplane/internal/data/ent/casbackend/casbackend.go
index ca530716c..c89270051 100644
--- a/app/controlplane/internal/data/ent/ocirepository/ocirepository.go
+++ b/app/controlplane/internal/data/ent/casbackend/casbackend.go
@@ -1,6 +1,6 @@
 // Code generated by ent, DO NOT EDIT.
 
-package ocirepository
+package casbackend
 
 import (
 	"fmt"
@@ -13,12 +13,12 @@ import (
 )
 
 const (
-	// Label holds the string label denoting the ocirepository type in the database.
-	Label = "oci_repository"
+	// Label holds the string label denoting the casbackend type in the database.
+	Label = "cas_backend"
 	// FieldID holds the string denoting the id field in the database.
 	FieldID = "id"
-	// FieldRepo holds the string denoting the repo field in the database.
-	FieldRepo = "repo"
+	// FieldName holds the string denoting the name field in the database.
+	FieldName = "name"
 	// FieldSecretName holds the string denoting the secret_name field in the database.
 	FieldSecretName = "secret_name"
 	// FieldCreatedAt holds the string denoting the created_at field in the database.
@@ -27,33 +27,39 @@ const (
 	FieldValidationStatus = "validation_status"
 	// FieldValidatedAt holds the string denoting the validated_at field in the database.
 	FieldValidatedAt = "validated_at"
+	// FieldProvider holds the string denoting the provider field in the database.
+	FieldProvider = "provider"
+	// FieldDefault holds the string denoting the default field in the database.
+	FieldDefault = "default"
 	// EdgeOrganization holds the string denoting the organization edge name in mutations.
 	EdgeOrganization = "organization"
-	// Table holds the table name of the ocirepository in the database.
-	Table = "oci_repositories"
+	// Table holds the table name of the casbackend in the database.
+	Table = "cas_backends"
 	// OrganizationTable is the table that holds the organization relation/edge.
-	OrganizationTable = "oci_repositories"
+	OrganizationTable = "cas_backends"
 	// OrganizationInverseTable is the table name for the Organization entity.
 	// It exists in this package in order to avoid circular dependency with the "organization" package.
 	OrganizationInverseTable = "organizations"
 	// OrganizationColumn is the table column denoting the organization relation/edge.
-	OrganizationColumn = "organization_oci_repositories"
+	OrganizationColumn = "organization_cas_backends"
 )
 
-// Columns holds all SQL columns for ocirepository fields.
+// Columns holds all SQL columns for casbackend fields.
 var Columns = []string{
 	FieldID,
-	FieldRepo,
+	FieldName,
 	FieldSecretName,
 	FieldCreatedAt,
 	FieldValidationStatus,
 	FieldValidatedAt,
+	FieldProvider,
+	FieldDefault,
 }
 
-// ForeignKeys holds the SQL foreign-keys that are owned by the "oci_repositories"
+// ForeignKeys holds the SQL foreign-keys that are owned by the "cas_backends"
 // table and are not defined as standalone fields in the schema.
 var ForeignKeys = []string{
-	"organization_oci_repositories",
+	"organization_cas_backends",
 }
 
 // ValidColumn reports if the column name is valid (part of the table columns).
@@ -76,23 +82,35 @@ var (
 	DefaultCreatedAt func() time.Time
 	// DefaultValidatedAt holds the default value on creation for the "validated_at" field.
 	DefaultValidatedAt func() time.Time
+	// DefaultDefault holds the default value on creation for the "default" field.
+	DefaultDefault bool
 	// DefaultID holds the default value on creation for the "id" field.
 	DefaultID func() uuid.UUID
 )
 
-const DefaultValidationStatus biz.OCIRepoValidationStatus = "OK"
+const DefaultValidationStatus biz.CASBackendValidationStatus = "OK"
 
 // ValidationStatusValidator is a validator for the "validation_status" field enum values. It is called by the builders before save.
-func ValidationStatusValidator(vs biz.OCIRepoValidationStatus) error {
+func ValidationStatusValidator(vs biz.CASBackendValidationStatus) error {
 	switch vs {
 	case "OK", "Invalid":
 		return nil
 	default:
-		return fmt.Errorf("ocirepository: invalid enum value for validation_status field: %q", vs)
+		return fmt.Errorf("casbackend: invalid enum value for validation_status field: %q", vs)
 	}
 }
 
-// OrderOption defines the ordering options for the OCIRepository queries.
+// ProviderValidator is a validator for the "provider" field enum values. It is called by the builders before save.
+func ProviderValidator(pr biz.CASBackendProvider) error {
+	switch pr {
+	case "OCI":
+		return nil
+	default:
+		return fmt.Errorf("casbackend: invalid enum value for provider field: %q", pr)
+	}
+}
+
+// OrderOption defines the ordering options for the CASBackend queries.
 type OrderOption func(*sql.Selector)
 
 // ByID orders the results by the id field.
@@ -100,9 +118,9 @@ func ByID(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldID, opts...).ToFunc()
 }
 
-// ByRepo orders the results by the repo field.
-func ByRepo(opts ...sql.OrderTermOption) OrderOption {
-	return sql.OrderByField(FieldRepo, opts...).ToFunc()
+// ByName orders the results by the name field.
+func ByName(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldName, opts...).ToFunc()
 }
 
 // BySecretName orders the results by the secret_name field.
@@ -125,6 +143,16 @@ func ByValidatedAt(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldValidatedAt, opts...).ToFunc()
 }
 
+// ByProvider orders the results by the provider field.
+func ByProvider(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldProvider, opts...).ToFunc()
+}
+
+// ByDefault orders the results by the default field.
+func ByDefault(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldDefault, opts...).ToFunc()
+}
+
 // ByOrganizationField orders the results by organization field.
 func ByOrganizationField(field string, opts ...sql.OrderTermOption) OrderOption {
 	return func(s *sql.Selector) {
diff --git a/app/controlplane/internal/data/ent/casbackend/where.go b/app/controlplane/internal/data/ent/casbackend/where.go
new file mode 100644
index 000000000..5fd1c5955
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend/where.go
@@ -0,0 +1,418 @@
+// Code generated by ent, DO NOT EDIT.
+
+package casbackend
+
+import (
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
+	"github.com/google/uuid"
+)
+
+// ID filters vertices based on their ID field.
+func ID(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldID, id))
+}
+
+// IDEQ applies the EQ predicate on the ID field.
+func IDEQ(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldID, id))
+}
+
+// IDNEQ applies the NEQ predicate on the ID field.
+func IDNEQ(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldID, id))
+}
+
+// IDIn applies the In predicate on the ID field.
+func IDIn(ids ...uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldIn(FieldID, ids...))
+}
+
+// IDNotIn applies the NotIn predicate on the ID field.
+func IDNotIn(ids ...uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNotIn(FieldID, ids...))
+}
+
+// IDGT applies the GT predicate on the ID field.
+func IDGT(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGT(FieldID, id))
+}
+
+// IDGTE applies the GTE predicate on the ID field.
+func IDGTE(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGTE(FieldID, id))
+}
+
+// IDLT applies the LT predicate on the ID field.
+func IDLT(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLT(FieldID, id))
+}
+
+// IDLTE applies the LTE predicate on the ID field.
+func IDLTE(id uuid.UUID) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLTE(FieldID, id))
+}
+
+// Name applies equality check predicate on the "name" field. It's identical to NameEQ.
+func Name(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldName, v))
+}
+
+// SecretName applies equality check predicate on the "secret_name" field. It's identical to SecretNameEQ.
+func SecretName(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldSecretName, v))
+}
+
+// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
+func CreatedAt(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// ValidatedAt applies equality check predicate on the "validated_at" field. It's identical to ValidatedAtEQ.
+func ValidatedAt(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldValidatedAt, v))
+}
+
+// Default applies equality check predicate on the "default" field. It's identical to DefaultEQ.
+func Default(v bool) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldDefault, v))
+}
+
+// NameEQ applies the EQ predicate on the "name" field.
+func NameEQ(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldName, v))
+}
+
+// NameNEQ applies the NEQ predicate on the "name" field.
+func NameNEQ(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldName, v))
+}
+
+// NameIn applies the In predicate on the "name" field.
+func NameIn(vs ...string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldIn(FieldName, vs...))
+}
+
+// NameNotIn applies the NotIn predicate on the "name" field.
+func NameNotIn(vs ...string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNotIn(FieldName, vs...))
+}
+
+// NameGT applies the GT predicate on the "name" field.
+func NameGT(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGT(FieldName, v))
+}
+
+// NameGTE applies the GTE predicate on the "name" field.
+func NameGTE(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGTE(FieldName, v))
+}
+
+// NameLT applies the LT predicate on the "name" field.
+func NameLT(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLT(FieldName, v))
+}
+
+// NameLTE applies the LTE predicate on the "name" field.
+func NameLTE(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLTE(FieldName, v))
+}
+
+// NameContains applies the Contains predicate on the "name" field.
+func NameContains(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldContains(FieldName, v))
+}
+
+// NameHasPrefix applies the HasPrefix predicate on the "name" field.
+func NameHasPrefix(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldHasPrefix(FieldName, v))
+}
+
+// NameHasSuffix applies the HasSuffix predicate on the "name" field.
+func NameHasSuffix(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldHasSuffix(FieldName, v))
+}
+
+// NameEqualFold applies the EqualFold predicate on the "name" field.
+func NameEqualFold(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEqualFold(FieldName, v))
+}
+
+// NameContainsFold applies the ContainsFold predicate on the "name" field.
+func NameContainsFold(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldContainsFold(FieldName, v))
+}
+
+// SecretNameEQ applies the EQ predicate on the "secret_name" field.
+func SecretNameEQ(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldSecretName, v))
+}
+
+// SecretNameNEQ applies the NEQ predicate on the "secret_name" field.
+func SecretNameNEQ(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldSecretName, v))
+}
+
+// SecretNameIn applies the In predicate on the "secret_name" field.
+func SecretNameIn(vs ...string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldIn(FieldSecretName, vs...))
+}
+
+// SecretNameNotIn applies the NotIn predicate on the "secret_name" field.
+func SecretNameNotIn(vs ...string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNotIn(FieldSecretName, vs...))
+}
+
+// SecretNameGT applies the GT predicate on the "secret_name" field.
+func SecretNameGT(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGT(FieldSecretName, v))
+}
+
+// SecretNameGTE applies the GTE predicate on the "secret_name" field.
+func SecretNameGTE(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGTE(FieldSecretName, v))
+}
+
+// SecretNameLT applies the LT predicate on the "secret_name" field.
+func SecretNameLT(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLT(FieldSecretName, v))
+}
+
+// SecretNameLTE applies the LTE predicate on the "secret_name" field.
+func SecretNameLTE(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLTE(FieldSecretName, v))
+}
+
+// SecretNameContains applies the Contains predicate on the "secret_name" field.
+func SecretNameContains(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldContains(FieldSecretName, v))
+}
+
+// SecretNameHasPrefix applies the HasPrefix predicate on the "secret_name" field.
+func SecretNameHasPrefix(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldHasPrefix(FieldSecretName, v))
+}
+
+// SecretNameHasSuffix applies the HasSuffix predicate on the "secret_name" field.
+func SecretNameHasSuffix(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldHasSuffix(FieldSecretName, v))
+}
+
+// SecretNameEqualFold applies the EqualFold predicate on the "secret_name" field.
+func SecretNameEqualFold(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEqualFold(FieldSecretName, v))
+}
+
+// SecretNameContainsFold applies the ContainsFold predicate on the "secret_name" field.
+func SecretNameContainsFold(v string) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldContainsFold(FieldSecretName, v))
+}
+
+// CreatedAtEQ applies the EQ predicate on the "created_at" field.
+func CreatedAtEQ(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
+func CreatedAtNEQ(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldCreatedAt, v))
+}
+
+// CreatedAtIn applies the In predicate on the "created_at" field.
+func CreatedAtIn(vs ...time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
+func CreatedAtNotIn(vs ...time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNotIn(FieldCreatedAt, vs...))
+}
+
+// CreatedAtGT applies the GT predicate on the "created_at" field.
+func CreatedAtGT(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGT(FieldCreatedAt, v))
+}
+
+// CreatedAtGTE applies the GTE predicate on the "created_at" field.
+func CreatedAtGTE(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGTE(FieldCreatedAt, v))
+}
+
+// CreatedAtLT applies the LT predicate on the "created_at" field.
+func CreatedAtLT(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLT(FieldCreatedAt, v))
+}
+
+// CreatedAtLTE applies the LTE predicate on the "created_at" field.
+func CreatedAtLTE(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLTE(FieldCreatedAt, v))
+}
+
+// ValidationStatusEQ applies the EQ predicate on the "validation_status" field.
+func ValidationStatusEQ(v biz.CASBackendValidationStatus) predicate.CASBackend {
+	vc := v
+	return predicate.CASBackend(sql.FieldEQ(FieldValidationStatus, vc))
+}
+
+// ValidationStatusNEQ applies the NEQ predicate on the "validation_status" field.
+func ValidationStatusNEQ(v biz.CASBackendValidationStatus) predicate.CASBackend {
+	vc := v
+	return predicate.CASBackend(sql.FieldNEQ(FieldValidationStatus, vc))
+}
+
+// ValidationStatusIn applies the In predicate on the "validation_status" field.
+func ValidationStatusIn(vs ...biz.CASBackendValidationStatus) predicate.CASBackend {
+	v := make([]any, len(vs))
+	for i := range v {
+		v[i] = vs[i]
+	}
+	return predicate.CASBackend(sql.FieldIn(FieldValidationStatus, v...))
+}
+
+// ValidationStatusNotIn applies the NotIn predicate on the "validation_status" field.
+func ValidationStatusNotIn(vs ...biz.CASBackendValidationStatus) predicate.CASBackend {
+	v := make([]any, len(vs))
+	for i := range v {
+		v[i] = vs[i]
+	}
+	return predicate.CASBackend(sql.FieldNotIn(FieldValidationStatus, v...))
+}
+
+// ValidatedAtEQ applies the EQ predicate on the "validated_at" field.
+func ValidatedAtEQ(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldValidatedAt, v))
+}
+
+// ValidatedAtNEQ applies the NEQ predicate on the "validated_at" field.
+func ValidatedAtNEQ(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldValidatedAt, v))
+}
+
+// ValidatedAtIn applies the In predicate on the "validated_at" field.
+func ValidatedAtIn(vs ...time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldIn(FieldValidatedAt, vs...))
+}
+
+// ValidatedAtNotIn applies the NotIn predicate on the "validated_at" field.
+func ValidatedAtNotIn(vs ...time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNotIn(FieldValidatedAt, vs...))
+}
+
+// ValidatedAtGT applies the GT predicate on the "validated_at" field.
+func ValidatedAtGT(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGT(FieldValidatedAt, v))
+}
+
+// ValidatedAtGTE applies the GTE predicate on the "validated_at" field.
+func ValidatedAtGTE(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldGTE(FieldValidatedAt, v))
+}
+
+// ValidatedAtLT applies the LT predicate on the "validated_at" field.
+func ValidatedAtLT(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLT(FieldValidatedAt, v))
+}
+
+// ValidatedAtLTE applies the LTE predicate on the "validated_at" field.
+func ValidatedAtLTE(v time.Time) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldLTE(FieldValidatedAt, v))
+}
+
+// ProviderEQ applies the EQ predicate on the "provider" field.
+func ProviderEQ(v biz.CASBackendProvider) predicate.CASBackend {
+	vc := v
+	return predicate.CASBackend(sql.FieldEQ(FieldProvider, vc))
+}
+
+// ProviderNEQ applies the NEQ predicate on the "provider" field.
+func ProviderNEQ(v biz.CASBackendProvider) predicate.CASBackend {
+	vc := v
+	return predicate.CASBackend(sql.FieldNEQ(FieldProvider, vc))
+}
+
+// ProviderIn applies the In predicate on the "provider" field.
+func ProviderIn(vs ...biz.CASBackendProvider) predicate.CASBackend {
+	v := make([]any, len(vs))
+	for i := range v {
+		v[i] = vs[i]
+	}
+	return predicate.CASBackend(sql.FieldIn(FieldProvider, v...))
+}
+
+// ProviderNotIn applies the NotIn predicate on the "provider" field.
+func ProviderNotIn(vs ...biz.CASBackendProvider) predicate.CASBackend {
+	v := make([]any, len(vs))
+	for i := range v {
+		v[i] = vs[i]
+	}
+	return predicate.CASBackend(sql.FieldNotIn(FieldProvider, v...))
+}
+
+// DefaultEQ applies the EQ predicate on the "default" field.
+func DefaultEQ(v bool) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldEQ(FieldDefault, v))
+}
+
+// DefaultNEQ applies the NEQ predicate on the "default" field.
+func DefaultNEQ(v bool) predicate.CASBackend {
+	return predicate.CASBackend(sql.FieldNEQ(FieldDefault, v))
+}
+
+// HasOrganization applies the HasEdge predicate on the "organization" edge.
+func HasOrganization() predicate.CASBackend {
+	return predicate.CASBackend(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, OrganizationTable, OrganizationColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasOrganizationWith applies the HasEdge predicate on the "organization" edge with a given conditions (other predicates).
+func HasOrganizationWith(preds ...predicate.Organization) predicate.CASBackend {
+	return predicate.CASBackend(func(s *sql.Selector) {
+		step := newOrganizationStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
+// And groups predicates with the AND operator between them.
+func And(predicates ...predicate.CASBackend) predicate.CASBackend {
+	return predicate.CASBackend(func(s *sql.Selector) {
+		s1 := s.Clone().SetP(nil)
+		for _, p := range predicates {
+			p(s1)
+		}
+		s.Where(s1.P())
+	})
+}
+
+// Or groups predicates with the OR operator between them.
+func Or(predicates ...predicate.CASBackend) predicate.CASBackend {
+	return predicate.CASBackend(func(s *sql.Selector) {
+		s1 := s.Clone().SetP(nil)
+		for i, p := range predicates {
+			if i > 0 {
+				s1.Or()
+			}
+			p(s1)
+		}
+		s.Where(s1.P())
+	})
+}
+
+// Not applies the not operator on the given predicate.
+func Not(p predicate.CASBackend) predicate.CASBackend {
+	return predicate.CASBackend(func(s *sql.Selector) {
+		p(s.Not())
+	})
+}
diff --git a/app/controlplane/internal/data/ent/casbackend_create.go b/app/controlplane/internal/data/ent/casbackend_create.go
new file mode 100644
index 000000000..2434c8d16
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend_create.go
@@ -0,0 +1,379 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
+	"github.com/google/uuid"
+)
+
+// CASBackendCreate is the builder for creating a CASBackend entity.
+type CASBackendCreate struct {
+	config
+	mutation *CASBackendMutation
+	hooks    []Hook
+}
+
+// SetName sets the "name" field.
+func (cbc *CASBackendCreate) SetName(s string) *CASBackendCreate {
+	cbc.mutation.SetName(s)
+	return cbc
+}
+
+// SetSecretName sets the "secret_name" field.
+func (cbc *CASBackendCreate) SetSecretName(s string) *CASBackendCreate {
+	cbc.mutation.SetSecretName(s)
+	return cbc
+}
+
+// SetCreatedAt sets the "created_at" field.
+func (cbc *CASBackendCreate) SetCreatedAt(t time.Time) *CASBackendCreate {
+	cbc.mutation.SetCreatedAt(t)
+	return cbc
+}
+
+// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
+func (cbc *CASBackendCreate) SetNillableCreatedAt(t *time.Time) *CASBackendCreate {
+	if t != nil {
+		cbc.SetCreatedAt(*t)
+	}
+	return cbc
+}
+
+// SetValidationStatus sets the "validation_status" field.
+func (cbc *CASBackendCreate) SetValidationStatus(bbvs biz.CASBackendValidationStatus) *CASBackendCreate {
+	cbc.mutation.SetValidationStatus(bbvs)
+	return cbc
+}
+
+// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
+func (cbc *CASBackendCreate) SetNillableValidationStatus(bbvs *biz.CASBackendValidationStatus) *CASBackendCreate {
+	if bbvs != nil {
+		cbc.SetValidationStatus(*bbvs)
+	}
+	return cbc
+}
+
+// SetValidatedAt sets the "validated_at" field.
+func (cbc *CASBackendCreate) SetValidatedAt(t time.Time) *CASBackendCreate {
+	cbc.mutation.SetValidatedAt(t)
+	return cbc
+}
+
+// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
+func (cbc *CASBackendCreate) SetNillableValidatedAt(t *time.Time) *CASBackendCreate {
+	if t != nil {
+		cbc.SetValidatedAt(*t)
+	}
+	return cbc
+}
+
+// SetProvider sets the "provider" field.
+func (cbc *CASBackendCreate) SetProvider(bbp biz.CASBackendProvider) *CASBackendCreate {
+	cbc.mutation.SetProvider(bbp)
+	return cbc
+}
+
+// SetDefault sets the "default" field.
+func (cbc *CASBackendCreate) SetDefault(b bool) *CASBackendCreate {
+	cbc.mutation.SetDefault(b)
+	return cbc
+}
+
+// SetNillableDefault sets the "default" field if the given value is not nil.
+func (cbc *CASBackendCreate) SetNillableDefault(b *bool) *CASBackendCreate {
+	if b != nil {
+		cbc.SetDefault(*b)
+	}
+	return cbc
+}
+
+// SetID sets the "id" field.
+func (cbc *CASBackendCreate) SetID(u uuid.UUID) *CASBackendCreate {
+	cbc.mutation.SetID(u)
+	return cbc
+}
+
+// SetNillableID sets the "id" field if the given value is not nil.
+func (cbc *CASBackendCreate) SetNillableID(u *uuid.UUID) *CASBackendCreate {
+	if u != nil {
+		cbc.SetID(*u)
+	}
+	return cbc
+}
+
+// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
+func (cbc *CASBackendCreate) SetOrganizationID(id uuid.UUID) *CASBackendCreate {
+	cbc.mutation.SetOrganizationID(id)
+	return cbc
+}
+
+// SetOrganization sets the "organization" edge to the Organization entity.
+func (cbc *CASBackendCreate) SetOrganization(o *Organization) *CASBackendCreate {
+	return cbc.SetOrganizationID(o.ID)
+}
+
+// Mutation returns the CASBackendMutation object of the builder.
+func (cbc *CASBackendCreate) Mutation() *CASBackendMutation {
+	return cbc.mutation
+}
+
+// Save creates the CASBackend in the database.
+func (cbc *CASBackendCreate) Save(ctx context.Context) (*CASBackend, error) {
+	cbc.defaults()
+	return withHooks(ctx, cbc.sqlSave, cbc.mutation, cbc.hooks)
+}
+
+// SaveX calls Save and panics if Save returns an error.
+func (cbc *CASBackendCreate) SaveX(ctx context.Context) *CASBackend {
+	v, err := cbc.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (cbc *CASBackendCreate) Exec(ctx context.Context) error {
+	_, err := cbc.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbc *CASBackendCreate) ExecX(ctx context.Context) {
+	if err := cbc.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// defaults sets the default values of the builder before save.
+func (cbc *CASBackendCreate) defaults() {
+	if _, ok := cbc.mutation.CreatedAt(); !ok {
+		v := casbackend.DefaultCreatedAt()
+		cbc.mutation.SetCreatedAt(v)
+	}
+	if _, ok := cbc.mutation.ValidationStatus(); !ok {
+		v := casbackend.DefaultValidationStatus
+		cbc.mutation.SetValidationStatus(v)
+	}
+	if _, ok := cbc.mutation.ValidatedAt(); !ok {
+		v := casbackend.DefaultValidatedAt()
+		cbc.mutation.SetValidatedAt(v)
+	}
+	if _, ok := cbc.mutation.Default(); !ok {
+		v := casbackend.DefaultDefault
+		cbc.mutation.SetDefault(v)
+	}
+	if _, ok := cbc.mutation.ID(); !ok {
+		v := casbackend.DefaultID()
+		cbc.mutation.SetID(v)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (cbc *CASBackendCreate) check() error {
+	if _, ok := cbc.mutation.Name(); !ok {
+		return &ValidationError{Name: "name", err: errors.New(`ent: missing required field "CASBackend.name"`)}
+	}
+	if _, ok := cbc.mutation.SecretName(); !ok {
+		return &ValidationError{Name: "secret_name", err: errors.New(`ent: missing required field "CASBackend.secret_name"`)}
+	}
+	if _, ok := cbc.mutation.CreatedAt(); !ok {
+		return &ValidationError{Name: "created_at", err: errors.New(`ent: missing required field "CASBackend.created_at"`)}
+	}
+	if _, ok := cbc.mutation.ValidationStatus(); !ok {
+		return &ValidationError{Name: "validation_status", err: errors.New(`ent: missing required field "CASBackend.validation_status"`)}
+	}
+	if v, ok := cbc.mutation.ValidationStatus(); ok {
+		if err := casbackend.ValidationStatusValidator(v); err != nil {
+			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "CASBackend.validation_status": %w`, err)}
+		}
+	}
+	if _, ok := cbc.mutation.ValidatedAt(); !ok {
+		return &ValidationError{Name: "validated_at", err: errors.New(`ent: missing required field "CASBackend.validated_at"`)}
+	}
+	if _, ok := cbc.mutation.Provider(); !ok {
+		return &ValidationError{Name: "provider", err: errors.New(`ent: missing required field "CASBackend.provider"`)}
+	}
+	if v, ok := cbc.mutation.Provider(); ok {
+		if err := casbackend.ProviderValidator(v); err != nil {
+			return &ValidationError{Name: "provider", err: fmt.Errorf(`ent: validator failed for field "CASBackend.provider": %w`, err)}
+		}
+	}
+	if _, ok := cbc.mutation.Default(); !ok {
+		return &ValidationError{Name: "default", err: errors.New(`ent: missing required field "CASBackend.default"`)}
+	}
+	if _, ok := cbc.mutation.OrganizationID(); !ok {
+		return &ValidationError{Name: "organization", err: errors.New(`ent: missing required edge "CASBackend.organization"`)}
+	}
+	return nil
+}
+
+func (cbc *CASBackendCreate) sqlSave(ctx context.Context) (*CASBackend, error) {
+	if err := cbc.check(); err != nil {
+		return nil, err
+	}
+	_node, _spec := cbc.createSpec()
+	if err := sqlgraph.CreateNode(ctx, cbc.driver, _spec); err != nil {
+		if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	if _spec.ID.Value != nil {
+		if id, ok := _spec.ID.Value.(*uuid.UUID); ok {
+			_node.ID = *id
+		} else if err := _node.ID.Scan(_spec.ID.Value); err != nil {
+			return nil, err
+		}
+	}
+	cbc.mutation.id = &_node.ID
+	cbc.mutation.done = true
+	return _node, nil
+}
+
+func (cbc *CASBackendCreate) createSpec() (*CASBackend, *sqlgraph.CreateSpec) {
+	var (
+		_node = &CASBackend{config: cbc.config}
+		_spec = sqlgraph.NewCreateSpec(casbackend.Table, sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID))
+	)
+	if id, ok := cbc.mutation.ID(); ok {
+		_node.ID = id
+		_spec.ID.Value = &id
+	}
+	if value, ok := cbc.mutation.Name(); ok {
+		_spec.SetField(casbackend.FieldName, field.TypeString, value)
+		_node.Name = value
+	}
+	if value, ok := cbc.mutation.SecretName(); ok {
+		_spec.SetField(casbackend.FieldSecretName, field.TypeString, value)
+		_node.SecretName = value
+	}
+	if value, ok := cbc.mutation.CreatedAt(); ok {
+		_spec.SetField(casbackend.FieldCreatedAt, field.TypeTime, value)
+		_node.CreatedAt = value
+	}
+	if value, ok := cbc.mutation.ValidationStatus(); ok {
+		_spec.SetField(casbackend.FieldValidationStatus, field.TypeEnum, value)
+		_node.ValidationStatus = value
+	}
+	if value, ok := cbc.mutation.ValidatedAt(); ok {
+		_spec.SetField(casbackend.FieldValidatedAt, field.TypeTime, value)
+		_node.ValidatedAt = value
+	}
+	if value, ok := cbc.mutation.Provider(); ok {
+		_spec.SetField(casbackend.FieldProvider, field.TypeEnum, value)
+		_node.Provider = value
+	}
+	if value, ok := cbc.mutation.Default(); ok {
+		_spec.SetField(casbackend.FieldDefault, field.TypeBool, value)
+		_node.Default = value
+	}
+	if nodes := cbc.mutation.OrganizationIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   casbackend.OrganizationTable,
+			Columns: []string{casbackend.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.organization_cas_backends = &nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	return _node, _spec
+}
+
+// CASBackendCreateBulk is the builder for creating many CASBackend entities in bulk.
+type CASBackendCreateBulk struct {
+	config
+	builders []*CASBackendCreate
+}
+
+// Save creates the CASBackend entities in the database.
+func (cbcb *CASBackendCreateBulk) Save(ctx context.Context) ([]*CASBackend, error) {
+	specs := make([]*sqlgraph.CreateSpec, len(cbcb.builders))
+	nodes := make([]*CASBackend, len(cbcb.builders))
+	mutators := make([]Mutator, len(cbcb.builders))
+	for i := range cbcb.builders {
+		func(i int, root context.Context) {
+			builder := cbcb.builders[i]
+			builder.defaults()
+			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
+				mutation, ok := m.(*CASBackendMutation)
+				if !ok {
+					return nil, fmt.Errorf("unexpected mutation type %T", m)
+				}
+				if err := builder.check(); err != nil {
+					return nil, err
+				}
+				builder.mutation = mutation
+				var err error
+				nodes[i], specs[i] = builder.createSpec()
+				if i < len(mutators)-1 {
+					_, err = mutators[i+1].Mutate(root, cbcb.builders[i+1].mutation)
+				} else {
+					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
+					// Invoke the actual operation on the latest mutation in the chain.
+					if err = sqlgraph.BatchCreate(ctx, cbcb.driver, spec); err != nil {
+						if sqlgraph.IsConstraintError(err) {
+							err = &ConstraintError{msg: err.Error(), wrap: err}
+						}
+					}
+				}
+				if err != nil {
+					return nil, err
+				}
+				mutation.id = &nodes[i].ID
+				mutation.done = true
+				return nodes[i], nil
+			})
+			for i := len(builder.hooks) - 1; i >= 0; i-- {
+				mut = builder.hooks[i](mut)
+			}
+			mutators[i] = mut
+		}(i, ctx)
+	}
+	if len(mutators) > 0 {
+		if _, err := mutators[0].Mutate(ctx, cbcb.builders[0].mutation); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (cbcb *CASBackendCreateBulk) SaveX(ctx context.Context) []*CASBackend {
+	v, err := cbcb.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// Exec executes the query.
+func (cbcb *CASBackendCreateBulk) Exec(ctx context.Context) error {
+	_, err := cbcb.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbcb *CASBackendCreateBulk) ExecX(ctx context.Context) {
+	if err := cbcb.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/app/controlplane/internal/data/ent/casbackend_delete.go b/app/controlplane/internal/data/ent/casbackend_delete.go
new file mode 100644
index 000000000..f172a65a0
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend_delete.go
@@ -0,0 +1,88 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
+)
+
+// CASBackendDelete is the builder for deleting a CASBackend entity.
+type CASBackendDelete struct {
+	config
+	hooks    []Hook
+	mutation *CASBackendMutation
+}
+
+// Where appends a list predicates to the CASBackendDelete builder.
+func (cbd *CASBackendDelete) Where(ps ...predicate.CASBackend) *CASBackendDelete {
+	cbd.mutation.Where(ps...)
+	return cbd
+}
+
+// Exec executes the deletion query and returns how many vertices were deleted.
+func (cbd *CASBackendDelete) Exec(ctx context.Context) (int, error) {
+	return withHooks(ctx, cbd.sqlExec, cbd.mutation, cbd.hooks)
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbd *CASBackendDelete) ExecX(ctx context.Context) int {
+	n, err := cbd.Exec(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return n
+}
+
+func (cbd *CASBackendDelete) sqlExec(ctx context.Context) (int, error) {
+	_spec := sqlgraph.NewDeleteSpec(casbackend.Table, sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID))
+	if ps := cbd.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	affected, err := sqlgraph.DeleteNodes(ctx, cbd.driver, _spec)
+	if err != nil && sqlgraph.IsConstraintError(err) {
+		err = &ConstraintError{msg: err.Error(), wrap: err}
+	}
+	cbd.mutation.done = true
+	return affected, err
+}
+
+// CASBackendDeleteOne is the builder for deleting a single CASBackend entity.
+type CASBackendDeleteOne struct {
+	cbd *CASBackendDelete
+}
+
+// Where appends a list predicates to the CASBackendDelete builder.
+func (cbdo *CASBackendDeleteOne) Where(ps ...predicate.CASBackend) *CASBackendDeleteOne {
+	cbdo.cbd.mutation.Where(ps...)
+	return cbdo
+}
+
+// Exec executes the deletion query.
+func (cbdo *CASBackendDeleteOne) Exec(ctx context.Context) error {
+	n, err := cbdo.cbd.Exec(ctx)
+	switch {
+	case err != nil:
+		return err
+	case n == 0:
+		return &NotFoundError{casbackend.Label}
+	default:
+		return nil
+	}
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbdo *CASBackendDeleteOne) ExecX(ctx context.Context) {
+	if err := cbdo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
diff --git a/app/controlplane/internal/data/ent/casbackend_query.go b/app/controlplane/internal/data/ent/casbackend_query.go
new file mode 100644
index 000000000..e8353bf1f
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend_query.go
@@ -0,0 +1,614 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"fmt"
+	"math"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
+	"github.com/google/uuid"
+)
+
+// CASBackendQuery is the builder for querying CASBackend entities.
+type CASBackendQuery struct {
+	config
+	ctx              *QueryContext
+	order            []casbackend.OrderOption
+	inters           []Interceptor
+	predicates       []predicate.CASBackend
+	withOrganization *OrganizationQuery
+	withFKs          bool
+	// intermediate query (i.e. traversal path).
+	sql  *sql.Selector
+	path func(context.Context) (*sql.Selector, error)
+}
+
+// Where adds a new predicate for the CASBackendQuery builder.
+func (cbq *CASBackendQuery) Where(ps ...predicate.CASBackend) *CASBackendQuery {
+	cbq.predicates = append(cbq.predicates, ps...)
+	return cbq
+}
+
+// Limit the number of records to be returned by this query.
+func (cbq *CASBackendQuery) Limit(limit int) *CASBackendQuery {
+	cbq.ctx.Limit = &limit
+	return cbq
+}
+
+// Offset to start from.
+func (cbq *CASBackendQuery) Offset(offset int) *CASBackendQuery {
+	cbq.ctx.Offset = &offset
+	return cbq
+}
+
+// Unique configures the query builder to filter duplicate records on query.
+// By default, unique is set to true, and can be disabled using this method.
+func (cbq *CASBackendQuery) Unique(unique bool) *CASBackendQuery {
+	cbq.ctx.Unique = &unique
+	return cbq
+}
+
+// Order specifies how the records should be ordered.
+func (cbq *CASBackendQuery) Order(o ...casbackend.OrderOption) *CASBackendQuery {
+	cbq.order = append(cbq.order, o...)
+	return cbq
+}
+
+// QueryOrganization chains the current query on the "organization" edge.
+func (cbq *CASBackendQuery) QueryOrganization() *OrganizationQuery {
+	query := (&OrganizationClient{config: cbq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := cbq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := cbq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(casbackend.Table, casbackend.FieldID, selector),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, casbackend.OrganizationTable, casbackend.OrganizationColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(cbq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
+// First returns the first CASBackend entity from the query.
+// Returns a *NotFoundError when no CASBackend was found.
+func (cbq *CASBackendQuery) First(ctx context.Context) (*CASBackend, error) {
+	nodes, err := cbq.Limit(1).All(setContextOp(ctx, cbq.ctx, "First"))
+	if err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nil, &NotFoundError{casbackend.Label}
+	}
+	return nodes[0], nil
+}
+
+// FirstX is like First, but panics if an error occurs.
+func (cbq *CASBackendQuery) FirstX(ctx context.Context) *CASBackend {
+	node, err := cbq.First(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return node
+}
+
+// FirstID returns the first CASBackend ID from the query.
+// Returns a *NotFoundError when no CASBackend ID was found.
+func (cbq *CASBackendQuery) FirstID(ctx context.Context) (id uuid.UUID, err error) {
+	var ids []uuid.UUID
+	if ids, err = cbq.Limit(1).IDs(setContextOp(ctx, cbq.ctx, "FirstID")); err != nil {
+		return
+	}
+	if len(ids) == 0 {
+		err = &NotFoundError{casbackend.Label}
+		return
+	}
+	return ids[0], nil
+}
+
+// FirstIDX is like FirstID, but panics if an error occurs.
+func (cbq *CASBackendQuery) FirstIDX(ctx context.Context) uuid.UUID {
+	id, err := cbq.FirstID(ctx)
+	if err != nil && !IsNotFound(err) {
+		panic(err)
+	}
+	return id
+}
+
+// Only returns a single CASBackend entity found by the query, ensuring it only returns one.
+// Returns a *NotSingularError when more than one CASBackend entity is found.
+// Returns a *NotFoundError when no CASBackend entities are found.
+func (cbq *CASBackendQuery) Only(ctx context.Context) (*CASBackend, error) {
+	nodes, err := cbq.Limit(2).All(setContextOp(ctx, cbq.ctx, "Only"))
+	if err != nil {
+		return nil, err
+	}
+	switch len(nodes) {
+	case 1:
+		return nodes[0], nil
+	case 0:
+		return nil, &NotFoundError{casbackend.Label}
+	default:
+		return nil, &NotSingularError{casbackend.Label}
+	}
+}
+
+// OnlyX is like Only, but panics if an error occurs.
+func (cbq *CASBackendQuery) OnlyX(ctx context.Context) *CASBackend {
+	node, err := cbq.Only(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// OnlyID is like Only, but returns the only CASBackend ID in the query.
+// Returns a *NotSingularError when more than one CASBackend ID is found.
+// Returns a *NotFoundError when no entities are found.
+func (cbq *CASBackendQuery) OnlyID(ctx context.Context) (id uuid.UUID, err error) {
+	var ids []uuid.UUID
+	if ids, err = cbq.Limit(2).IDs(setContextOp(ctx, cbq.ctx, "OnlyID")); err != nil {
+		return
+	}
+	switch len(ids) {
+	case 1:
+		id = ids[0]
+	case 0:
+		err = &NotFoundError{casbackend.Label}
+	default:
+		err = &NotSingularError{casbackend.Label}
+	}
+	return
+}
+
+// OnlyIDX is like OnlyID, but panics if an error occurs.
+func (cbq *CASBackendQuery) OnlyIDX(ctx context.Context) uuid.UUID {
+	id, err := cbq.OnlyID(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
+
+// All executes the query and returns a list of CASBackends.
+func (cbq *CASBackendQuery) All(ctx context.Context) ([]*CASBackend, error) {
+	ctx = setContextOp(ctx, cbq.ctx, "All")
+	if err := cbq.prepareQuery(ctx); err != nil {
+		return nil, err
+	}
+	qr := querierAll[[]*CASBackend, *CASBackendQuery]()
+	return withInterceptors[[]*CASBackend](ctx, cbq, qr, cbq.inters)
+}
+
+// AllX is like All, but panics if an error occurs.
+func (cbq *CASBackendQuery) AllX(ctx context.Context) []*CASBackend {
+	nodes, err := cbq.All(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return nodes
+}
+
+// IDs executes the query and returns a list of CASBackend IDs.
+func (cbq *CASBackendQuery) IDs(ctx context.Context) (ids []uuid.UUID, err error) {
+	if cbq.ctx.Unique == nil && cbq.path != nil {
+		cbq.Unique(true)
+	}
+	ctx = setContextOp(ctx, cbq.ctx, "IDs")
+	if err = cbq.Select(casbackend.FieldID).Scan(ctx, &ids); err != nil {
+		return nil, err
+	}
+	return ids, nil
+}
+
+// IDsX is like IDs, but panics if an error occurs.
+func (cbq *CASBackendQuery) IDsX(ctx context.Context) []uuid.UUID {
+	ids, err := cbq.IDs(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return ids
+}
+
+// Count returns the count of the given query.
+func (cbq *CASBackendQuery) Count(ctx context.Context) (int, error) {
+	ctx = setContextOp(ctx, cbq.ctx, "Count")
+	if err := cbq.prepareQuery(ctx); err != nil {
+		return 0, err
+	}
+	return withInterceptors[int](ctx, cbq, querierCount[*CASBackendQuery](), cbq.inters)
+}
+
+// CountX is like Count, but panics if an error occurs.
+func (cbq *CASBackendQuery) CountX(ctx context.Context) int {
+	count, err := cbq.Count(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return count
+}
+
+// Exist returns true if the query has elements in the graph.
+func (cbq *CASBackendQuery) Exist(ctx context.Context) (bool, error) {
+	ctx = setContextOp(ctx, cbq.ctx, "Exist")
+	switch _, err := cbq.FirstID(ctx); {
+	case IsNotFound(err):
+		return false, nil
+	case err != nil:
+		return false, fmt.Errorf("ent: check existence: %w", err)
+	default:
+		return true, nil
+	}
+}
+
+// ExistX is like Exist, but panics if an error occurs.
+func (cbq *CASBackendQuery) ExistX(ctx context.Context) bool {
+	exist, err := cbq.Exist(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return exist
+}
+
+// Clone returns a duplicate of the CASBackendQuery builder, including all associated steps. It can be
+// used to prepare common query builders and use them differently after the clone is made.
+func (cbq *CASBackendQuery) Clone() *CASBackendQuery {
+	if cbq == nil {
+		return nil
+	}
+	return &CASBackendQuery{
+		config:           cbq.config,
+		ctx:              cbq.ctx.Clone(),
+		order:            append([]casbackend.OrderOption{}, cbq.order...),
+		inters:           append([]Interceptor{}, cbq.inters...),
+		predicates:       append([]predicate.CASBackend{}, cbq.predicates...),
+		withOrganization: cbq.withOrganization.Clone(),
+		// clone intermediate query.
+		sql:  cbq.sql.Clone(),
+		path: cbq.path,
+	}
+}
+
+// WithOrganization tells the query-builder to eager-load the nodes that are connected to
+// the "organization" edge. The optional arguments are used to configure the query builder of the edge.
+func (cbq *CASBackendQuery) WithOrganization(opts ...func(*OrganizationQuery)) *CASBackendQuery {
+	query := (&OrganizationClient{config: cbq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	cbq.withOrganization = query
+	return cbq
+}
+
+// GroupBy is used to group vertices by one or more fields/columns.
+// It is often used with aggregate functions, like: count, max, mean, min, sum.
+//
+// Example:
+//
+//	var v []struct {
+//		Name string `json:"name,omitempty"`
+//		Count int `json:"count,omitempty"`
+//	}
+//
+//	client.CASBackend.Query().
+//		GroupBy(casbackend.FieldName).
+//		Aggregate(ent.Count()).
+//		Scan(ctx, &v)
+func (cbq *CASBackendQuery) GroupBy(field string, fields ...string) *CASBackendGroupBy {
+	cbq.ctx.Fields = append([]string{field}, fields...)
+	grbuild := &CASBackendGroupBy{build: cbq}
+	grbuild.flds = &cbq.ctx.Fields
+	grbuild.label = casbackend.Label
+	grbuild.scan = grbuild.Scan
+	return grbuild
+}
+
+// Select allows the selection one or more fields/columns for the given query,
+// instead of selecting all fields in the entity.
+//
+// Example:
+//
+//	var v []struct {
+//		Name string `json:"name,omitempty"`
+//	}
+//
+//	client.CASBackend.Query().
+//		Select(casbackend.FieldName).
+//		Scan(ctx, &v)
+func (cbq *CASBackendQuery) Select(fields ...string) *CASBackendSelect {
+	cbq.ctx.Fields = append(cbq.ctx.Fields, fields...)
+	sbuild := &CASBackendSelect{CASBackendQuery: cbq}
+	sbuild.label = casbackend.Label
+	sbuild.flds, sbuild.scan = &cbq.ctx.Fields, sbuild.Scan
+	return sbuild
+}
+
+// Aggregate returns a CASBackendSelect configured with the given aggregations.
+func (cbq *CASBackendQuery) Aggregate(fns ...AggregateFunc) *CASBackendSelect {
+	return cbq.Select().Aggregate(fns...)
+}
+
+func (cbq *CASBackendQuery) prepareQuery(ctx context.Context) error {
+	for _, inter := range cbq.inters {
+		if inter == nil {
+			return fmt.Errorf("ent: uninitialized interceptor (forgotten import ent/runtime?)")
+		}
+		if trv, ok := inter.(Traverser); ok {
+			if err := trv.Traverse(ctx, cbq); err != nil {
+				return err
+			}
+		}
+	}
+	for _, f := range cbq.ctx.Fields {
+		if !casbackend.ValidColumn(f) {
+			return &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+		}
+	}
+	if cbq.path != nil {
+		prev, err := cbq.path(ctx)
+		if err != nil {
+			return err
+		}
+		cbq.sql = prev
+	}
+	return nil
+}
+
+func (cbq *CASBackendQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*CASBackend, error) {
+	var (
+		nodes       = []*CASBackend{}
+		withFKs     = cbq.withFKs
+		_spec       = cbq.querySpec()
+		loadedTypes = [1]bool{
+			cbq.withOrganization != nil,
+		}
+	)
+	if cbq.withOrganization != nil {
+		withFKs = true
+	}
+	if withFKs {
+		_spec.Node.Columns = append(_spec.Node.Columns, casbackend.ForeignKeys...)
+	}
+	_spec.ScanValues = func(columns []string) ([]any, error) {
+		return (*CASBackend).scanValues(nil, columns)
+	}
+	_spec.Assign = func(columns []string, values []any) error {
+		node := &CASBackend{config: cbq.config}
+		nodes = append(nodes, node)
+		node.Edges.loadedTypes = loadedTypes
+		return node.assignValues(columns, values)
+	}
+	for i := range hooks {
+		hooks[i](ctx, _spec)
+	}
+	if err := sqlgraph.QueryNodes(ctx, cbq.driver, _spec); err != nil {
+		return nil, err
+	}
+	if len(nodes) == 0 {
+		return nodes, nil
+	}
+	if query := cbq.withOrganization; query != nil {
+		if err := cbq.loadOrganization(ctx, query, nodes, nil,
+			func(n *CASBackend, e *Organization) { n.Edges.Organization = e }); err != nil {
+			return nil, err
+		}
+	}
+	return nodes, nil
+}
+
+func (cbq *CASBackendQuery) loadOrganization(ctx context.Context, query *OrganizationQuery, nodes []*CASBackend, init func(*CASBackend), assign func(*CASBackend, *Organization)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*CASBackend)
+	for i := range nodes {
+		if nodes[i].organization_cas_backends == nil {
+			continue
+		}
+		fk := *nodes[i].organization_cas_backends
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(organization.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "organization_cas_backends" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+
+func (cbq *CASBackendQuery) sqlCount(ctx context.Context) (int, error) {
+	_spec := cbq.querySpec()
+	_spec.Node.Columns = cbq.ctx.Fields
+	if len(cbq.ctx.Fields) > 0 {
+		_spec.Unique = cbq.ctx.Unique != nil && *cbq.ctx.Unique
+	}
+	return sqlgraph.CountNodes(ctx, cbq.driver, _spec)
+}
+
+func (cbq *CASBackendQuery) querySpec() *sqlgraph.QuerySpec {
+	_spec := sqlgraph.NewQuerySpec(casbackend.Table, casbackend.Columns, sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID))
+	_spec.From = cbq.sql
+	if unique := cbq.ctx.Unique; unique != nil {
+		_spec.Unique = *unique
+	} else if cbq.path != nil {
+		_spec.Unique = true
+	}
+	if fields := cbq.ctx.Fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, casbackend.FieldID)
+		for i := range fields {
+			if fields[i] != casbackend.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
+			}
+		}
+	}
+	if ps := cbq.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if limit := cbq.ctx.Limit; limit != nil {
+		_spec.Limit = *limit
+	}
+	if offset := cbq.ctx.Offset; offset != nil {
+		_spec.Offset = *offset
+	}
+	if ps := cbq.order; len(ps) > 0 {
+		_spec.Order = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	return _spec
+}
+
+func (cbq *CASBackendQuery) sqlQuery(ctx context.Context) *sql.Selector {
+	builder := sql.Dialect(cbq.driver.Dialect())
+	t1 := builder.Table(casbackend.Table)
+	columns := cbq.ctx.Fields
+	if len(columns) == 0 {
+		columns = casbackend.Columns
+	}
+	selector := builder.Select(t1.Columns(columns...)...).From(t1)
+	if cbq.sql != nil {
+		selector = cbq.sql
+		selector.Select(selector.Columns(columns...)...)
+	}
+	if cbq.ctx.Unique != nil && *cbq.ctx.Unique {
+		selector.Distinct()
+	}
+	for _, p := range cbq.predicates {
+		p(selector)
+	}
+	for _, p := range cbq.order {
+		p(selector)
+	}
+	if offset := cbq.ctx.Offset; offset != nil {
+		// limit is mandatory for offset clause. We start
+		// with default value, and override it below if needed.
+		selector.Offset(*offset).Limit(math.MaxInt32)
+	}
+	if limit := cbq.ctx.Limit; limit != nil {
+		selector.Limit(*limit)
+	}
+	return selector
+}
+
+// CASBackendGroupBy is the group-by builder for CASBackend entities.
+type CASBackendGroupBy struct {
+	selector
+	build *CASBackendQuery
+}
+
+// Aggregate adds the given aggregation functions to the group-by query.
+func (cbgb *CASBackendGroupBy) Aggregate(fns ...AggregateFunc) *CASBackendGroupBy {
+	cbgb.fns = append(cbgb.fns, fns...)
+	return cbgb
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (cbgb *CASBackendGroupBy) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, cbgb.build.ctx, "GroupBy")
+	if err := cbgb.build.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*CASBackendQuery, *CASBackendGroupBy](ctx, cbgb.build, cbgb, cbgb.build.inters, v)
+}
+
+func (cbgb *CASBackendGroupBy) sqlScan(ctx context.Context, root *CASBackendQuery, v any) error {
+	selector := root.sqlQuery(ctx).Select()
+	aggregation := make([]string, 0, len(cbgb.fns))
+	for _, fn := range cbgb.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	if len(selector.SelectedColumns()) == 0 {
+		columns := make([]string, 0, len(*cbgb.flds)+len(cbgb.fns))
+		for _, f := range *cbgb.flds {
+			columns = append(columns, selector.C(f))
+		}
+		columns = append(columns, aggregation...)
+		selector.Select(columns...)
+	}
+	selector.GroupBy(selector.Columns(*cbgb.flds...)...)
+	if err := selector.Err(); err != nil {
+		return err
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := cbgb.build.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
+
+// CASBackendSelect is the builder for selecting fields of CASBackend entities.
+type CASBackendSelect struct {
+	*CASBackendQuery
+	selector
+}
+
+// Aggregate adds the given aggregation functions to the selector query.
+func (cbs *CASBackendSelect) Aggregate(fns ...AggregateFunc) *CASBackendSelect {
+	cbs.fns = append(cbs.fns, fns...)
+	return cbs
+}
+
+// Scan applies the selector query and scans the result into the given value.
+func (cbs *CASBackendSelect) Scan(ctx context.Context, v any) error {
+	ctx = setContextOp(ctx, cbs.ctx, "Select")
+	if err := cbs.prepareQuery(ctx); err != nil {
+		return err
+	}
+	return scanWithInterceptors[*CASBackendQuery, *CASBackendSelect](ctx, cbs.CASBackendQuery, cbs, cbs.inters, v)
+}
+
+func (cbs *CASBackendSelect) sqlScan(ctx context.Context, root *CASBackendQuery, v any) error {
+	selector := root.sqlQuery(ctx)
+	aggregation := make([]string, 0, len(cbs.fns))
+	for _, fn := range cbs.fns {
+		aggregation = append(aggregation, fn(selector))
+	}
+	switch n := len(*cbs.selector.flds); {
+	case n == 0 && len(aggregation) > 0:
+		selector.Select(aggregation...)
+	case n != 0 && len(aggregation) > 0:
+		selector.AppendSelect(aggregation...)
+	}
+	rows := &sql.Rows{}
+	query, args := selector.Query()
+	if err := cbs.driver.Query(ctx, query, args, rows); err != nil {
+		return err
+	}
+	defer rows.Close()
+	return sql.ScanSlice(rows, v)
+}
diff --git a/app/controlplane/internal/data/ent/casbackend_update.go b/app/controlplane/internal/data/ent/casbackend_update.go
new file mode 100644
index 000000000..29d559702
--- /dev/null
+++ b/app/controlplane/internal/data/ent/casbackend_update.go
@@ -0,0 +1,469 @@
+// Code generated by ent, DO NOT EDIT.
+
+package ent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"entgo.io/ent/dialect/sql"
+	"entgo.io/ent/dialect/sql/sqlgraph"
+	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
+	"github.com/google/uuid"
+)
+
+// CASBackendUpdate is the builder for updating CASBackend entities.
+type CASBackendUpdate struct {
+	config
+	hooks    []Hook
+	mutation *CASBackendMutation
+}
+
+// Where appends a list predicates to the CASBackendUpdate builder.
+func (cbu *CASBackendUpdate) Where(ps ...predicate.CASBackend) *CASBackendUpdate {
+	cbu.mutation.Where(ps...)
+	return cbu
+}
+
+// SetName sets the "name" field.
+func (cbu *CASBackendUpdate) SetName(s string) *CASBackendUpdate {
+	cbu.mutation.SetName(s)
+	return cbu
+}
+
+// SetSecretName sets the "secret_name" field.
+func (cbu *CASBackendUpdate) SetSecretName(s string) *CASBackendUpdate {
+	cbu.mutation.SetSecretName(s)
+	return cbu
+}
+
+// SetValidationStatus sets the "validation_status" field.
+func (cbu *CASBackendUpdate) SetValidationStatus(bbvs biz.CASBackendValidationStatus) *CASBackendUpdate {
+	cbu.mutation.SetValidationStatus(bbvs)
+	return cbu
+}
+
+// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
+func (cbu *CASBackendUpdate) SetNillableValidationStatus(bbvs *biz.CASBackendValidationStatus) *CASBackendUpdate {
+	if bbvs != nil {
+		cbu.SetValidationStatus(*bbvs)
+	}
+	return cbu
+}
+
+// SetValidatedAt sets the "validated_at" field.
+func (cbu *CASBackendUpdate) SetValidatedAt(t time.Time) *CASBackendUpdate {
+	cbu.mutation.SetValidatedAt(t)
+	return cbu
+}
+
+// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
+func (cbu *CASBackendUpdate) SetNillableValidatedAt(t *time.Time) *CASBackendUpdate {
+	if t != nil {
+		cbu.SetValidatedAt(*t)
+	}
+	return cbu
+}
+
+// SetProvider sets the "provider" field.
+func (cbu *CASBackendUpdate) SetProvider(bbp biz.CASBackendProvider) *CASBackendUpdate {
+	cbu.mutation.SetProvider(bbp)
+	return cbu
+}
+
+// SetDefault sets the "default" field.
+func (cbu *CASBackendUpdate) SetDefault(b bool) *CASBackendUpdate {
+	cbu.mutation.SetDefault(b)
+	return cbu
+}
+
+// SetNillableDefault sets the "default" field if the given value is not nil.
+func (cbu *CASBackendUpdate) SetNillableDefault(b *bool) *CASBackendUpdate {
+	if b != nil {
+		cbu.SetDefault(*b)
+	}
+	return cbu
+}
+
+// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
+func (cbu *CASBackendUpdate) SetOrganizationID(id uuid.UUID) *CASBackendUpdate {
+	cbu.mutation.SetOrganizationID(id)
+	return cbu
+}
+
+// SetOrganization sets the "organization" edge to the Organization entity.
+func (cbu *CASBackendUpdate) SetOrganization(o *Organization) *CASBackendUpdate {
+	return cbu.SetOrganizationID(o.ID)
+}
+
+// Mutation returns the CASBackendMutation object of the builder.
+func (cbu *CASBackendUpdate) Mutation() *CASBackendMutation {
+	return cbu.mutation
+}
+
+// ClearOrganization clears the "organization" edge to the Organization entity.
+func (cbu *CASBackendUpdate) ClearOrganization() *CASBackendUpdate {
+	cbu.mutation.ClearOrganization()
+	return cbu
+}
+
+// Save executes the query and returns the number of nodes affected by the update operation.
+func (cbu *CASBackendUpdate) Save(ctx context.Context) (int, error) {
+	return withHooks(ctx, cbu.sqlSave, cbu.mutation, cbu.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (cbu *CASBackendUpdate) SaveX(ctx context.Context) int {
+	affected, err := cbu.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return affected
+}
+
+// Exec executes the query.
+func (cbu *CASBackendUpdate) Exec(ctx context.Context) error {
+	_, err := cbu.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbu *CASBackendUpdate) ExecX(ctx context.Context) {
+	if err := cbu.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (cbu *CASBackendUpdate) check() error {
+	if v, ok := cbu.mutation.ValidationStatus(); ok {
+		if err := casbackend.ValidationStatusValidator(v); err != nil {
+			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "CASBackend.validation_status": %w`, err)}
+		}
+	}
+	if v, ok := cbu.mutation.Provider(); ok {
+		if err := casbackend.ProviderValidator(v); err != nil {
+			return &ValidationError{Name: "provider", err: fmt.Errorf(`ent: validator failed for field "CASBackend.provider": %w`, err)}
+		}
+	}
+	if _, ok := cbu.mutation.OrganizationID(); cbu.mutation.OrganizationCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "CASBackend.organization"`)
+	}
+	return nil
+}
+
+func (cbu *CASBackendUpdate) sqlSave(ctx context.Context) (n int, err error) {
+	if err := cbu.check(); err != nil {
+		return n, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(casbackend.Table, casbackend.Columns, sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID))
+	if ps := cbu.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := cbu.mutation.Name(); ok {
+		_spec.SetField(casbackend.FieldName, field.TypeString, value)
+	}
+	if value, ok := cbu.mutation.SecretName(); ok {
+		_spec.SetField(casbackend.FieldSecretName, field.TypeString, value)
+	}
+	if value, ok := cbu.mutation.ValidationStatus(); ok {
+		_spec.SetField(casbackend.FieldValidationStatus, field.TypeEnum, value)
+	}
+	if value, ok := cbu.mutation.ValidatedAt(); ok {
+		_spec.SetField(casbackend.FieldValidatedAt, field.TypeTime, value)
+	}
+	if value, ok := cbu.mutation.Provider(); ok {
+		_spec.SetField(casbackend.FieldProvider, field.TypeEnum, value)
+	}
+	if value, ok := cbu.mutation.Default(); ok {
+		_spec.SetField(casbackend.FieldDefault, field.TypeBool, value)
+	}
+	if cbu.mutation.OrganizationCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   casbackend.OrganizationTable,
+			Columns: []string{casbackend.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := cbu.mutation.OrganizationIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   casbackend.OrganizationTable,
+			Columns: []string{casbackend.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	if n, err = sqlgraph.UpdateNodes(ctx, cbu.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{casbackend.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return 0, err
+	}
+	cbu.mutation.done = true
+	return n, nil
+}
+
+// CASBackendUpdateOne is the builder for updating a single CASBackend entity.
+type CASBackendUpdateOne struct {
+	config
+	fields   []string
+	hooks    []Hook
+	mutation *CASBackendMutation
+}
+
+// SetName sets the "name" field.
+func (cbuo *CASBackendUpdateOne) SetName(s string) *CASBackendUpdateOne {
+	cbuo.mutation.SetName(s)
+	return cbuo
+}
+
+// SetSecretName sets the "secret_name" field.
+func (cbuo *CASBackendUpdateOne) SetSecretName(s string) *CASBackendUpdateOne {
+	cbuo.mutation.SetSecretName(s)
+	return cbuo
+}
+
+// SetValidationStatus sets the "validation_status" field.
+func (cbuo *CASBackendUpdateOne) SetValidationStatus(bbvs biz.CASBackendValidationStatus) *CASBackendUpdateOne {
+	cbuo.mutation.SetValidationStatus(bbvs)
+	return cbuo
+}
+
+// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
+func (cbuo *CASBackendUpdateOne) SetNillableValidationStatus(bbvs *biz.CASBackendValidationStatus) *CASBackendUpdateOne {
+	if bbvs != nil {
+		cbuo.SetValidationStatus(*bbvs)
+	}
+	return cbuo
+}
+
+// SetValidatedAt sets the "validated_at" field.
+func (cbuo *CASBackendUpdateOne) SetValidatedAt(t time.Time) *CASBackendUpdateOne {
+	cbuo.mutation.SetValidatedAt(t)
+	return cbuo
+}
+
+// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
+func (cbuo *CASBackendUpdateOne) SetNillableValidatedAt(t *time.Time) *CASBackendUpdateOne {
+	if t != nil {
+		cbuo.SetValidatedAt(*t)
+	}
+	return cbuo
+}
+
+// SetProvider sets the "provider" field.
+func (cbuo *CASBackendUpdateOne) SetProvider(bbp biz.CASBackendProvider) *CASBackendUpdateOne {
+	cbuo.mutation.SetProvider(bbp)
+	return cbuo
+}
+
+// SetDefault sets the "default" field.
+func (cbuo *CASBackendUpdateOne) SetDefault(b bool) *CASBackendUpdateOne {
+	cbuo.mutation.SetDefault(b)
+	return cbuo
+}
+
+// SetNillableDefault sets the "default" field if the given value is not nil.
+func (cbuo *CASBackendUpdateOne) SetNillableDefault(b *bool) *CASBackendUpdateOne {
+	if b != nil {
+		cbuo.SetDefault(*b)
+	}
+	return cbuo
+}
+
+// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
+func (cbuo *CASBackendUpdateOne) SetOrganizationID(id uuid.UUID) *CASBackendUpdateOne {
+	cbuo.mutation.SetOrganizationID(id)
+	return cbuo
+}
+
+// SetOrganization sets the "organization" edge to the Organization entity.
+func (cbuo *CASBackendUpdateOne) SetOrganization(o *Organization) *CASBackendUpdateOne {
+	return cbuo.SetOrganizationID(o.ID)
+}
+
+// Mutation returns the CASBackendMutation object of the builder.
+func (cbuo *CASBackendUpdateOne) Mutation() *CASBackendMutation {
+	return cbuo.mutation
+}
+
+// ClearOrganization clears the "organization" edge to the Organization entity.
+func (cbuo *CASBackendUpdateOne) ClearOrganization() *CASBackendUpdateOne {
+	cbuo.mutation.ClearOrganization()
+	return cbuo
+}
+
+// Where appends a list predicates to the CASBackendUpdate builder.
+func (cbuo *CASBackendUpdateOne) Where(ps ...predicate.CASBackend) *CASBackendUpdateOne {
+	cbuo.mutation.Where(ps...)
+	return cbuo
+}
+
+// Select allows selecting one or more fields (columns) of the returned entity.
+// The default is selecting all fields defined in the entity schema.
+func (cbuo *CASBackendUpdateOne) Select(field string, fields ...string) *CASBackendUpdateOne {
+	cbuo.fields = append([]string{field}, fields...)
+	return cbuo
+}
+
+// Save executes the query and returns the updated CASBackend entity.
+func (cbuo *CASBackendUpdateOne) Save(ctx context.Context) (*CASBackend, error) {
+	return withHooks(ctx, cbuo.sqlSave, cbuo.mutation, cbuo.hooks)
+}
+
+// SaveX is like Save, but panics if an error occurs.
+func (cbuo *CASBackendUpdateOne) SaveX(ctx context.Context) *CASBackend {
+	node, err := cbuo.Save(ctx)
+	if err != nil {
+		panic(err)
+	}
+	return node
+}
+
+// Exec executes the query on the entity.
+func (cbuo *CASBackendUpdateOne) Exec(ctx context.Context) error {
+	_, err := cbuo.Save(ctx)
+	return err
+}
+
+// ExecX is like Exec, but panics if an error occurs.
+func (cbuo *CASBackendUpdateOne) ExecX(ctx context.Context) {
+	if err := cbuo.Exec(ctx); err != nil {
+		panic(err)
+	}
+}
+
+// check runs all checks and user-defined validators on the builder.
+func (cbuo *CASBackendUpdateOne) check() error {
+	if v, ok := cbuo.mutation.ValidationStatus(); ok {
+		if err := casbackend.ValidationStatusValidator(v); err != nil {
+			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "CASBackend.validation_status": %w`, err)}
+		}
+	}
+	if v, ok := cbuo.mutation.Provider(); ok {
+		if err := casbackend.ProviderValidator(v); err != nil {
+			return &ValidationError{Name: "provider", err: fmt.Errorf(`ent: validator failed for field "CASBackend.provider": %w`, err)}
+		}
+	}
+	if _, ok := cbuo.mutation.OrganizationID(); cbuo.mutation.OrganizationCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "CASBackend.organization"`)
+	}
+	return nil
+}
+
+func (cbuo *CASBackendUpdateOne) sqlSave(ctx context.Context) (_node *CASBackend, err error) {
+	if err := cbuo.check(); err != nil {
+		return _node, err
+	}
+	_spec := sqlgraph.NewUpdateSpec(casbackend.Table, casbackend.Columns, sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID))
+	id, ok := cbuo.mutation.ID()
+	if !ok {
+		return nil, &ValidationError{Name: "id", err: errors.New(`ent: missing "CASBackend.id" for update`)}
+	}
+	_spec.Node.ID.Value = id
+	if fields := cbuo.fields; len(fields) > 0 {
+		_spec.Node.Columns = make([]string, 0, len(fields))
+		_spec.Node.Columns = append(_spec.Node.Columns, casbackend.FieldID)
+		for _, f := range fields {
+			if !casbackend.ValidColumn(f) {
+				return nil, &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
+			}
+			if f != casbackend.FieldID {
+				_spec.Node.Columns = append(_spec.Node.Columns, f)
+			}
+		}
+	}
+	if ps := cbuo.mutation.predicates; len(ps) > 0 {
+		_spec.Predicate = func(selector *sql.Selector) {
+			for i := range ps {
+				ps[i](selector)
+			}
+		}
+	}
+	if value, ok := cbuo.mutation.Name(); ok {
+		_spec.SetField(casbackend.FieldName, field.TypeString, value)
+	}
+	if value, ok := cbuo.mutation.SecretName(); ok {
+		_spec.SetField(casbackend.FieldSecretName, field.TypeString, value)
+	}
+	if value, ok := cbuo.mutation.ValidationStatus(); ok {
+		_spec.SetField(casbackend.FieldValidationStatus, field.TypeEnum, value)
+	}
+	if value, ok := cbuo.mutation.ValidatedAt(); ok {
+		_spec.SetField(casbackend.FieldValidatedAt, field.TypeTime, value)
+	}
+	if value, ok := cbuo.mutation.Provider(); ok {
+		_spec.SetField(casbackend.FieldProvider, field.TypeEnum, value)
+	}
+	if value, ok := cbuo.mutation.Default(); ok {
+		_spec.SetField(casbackend.FieldDefault, field.TypeBool, value)
+	}
+	if cbuo.mutation.OrganizationCleared() {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   casbackend.OrganizationTable,
+			Columns: []string{casbackend.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
+	}
+	if nodes := cbuo.mutation.OrganizationIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: true,
+			Table:   casbackend.OrganizationTable,
+			Columns: []string{casbackend.OrganizationColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_spec.Edges.Add = append(_spec.Edges.Add, edge)
+	}
+	_node = &CASBackend{config: cbuo.config}
+	_spec.Assign = _node.assignValues
+	_spec.ScanValues = _node.scanValues
+	if err = sqlgraph.UpdateNode(ctx, cbuo.driver, _spec); err != nil {
+		if _, ok := err.(*sqlgraph.NotFoundError); ok {
+			err = &NotFoundError{casbackend.Label}
+		} else if sqlgraph.IsConstraintError(err) {
+			err = &ConstraintError{msg: err.Error(), wrap: err}
+		}
+		return nil, err
+	}
+	cbuo.mutation.done = true
+	return _node, nil
+}
diff --git a/app/controlplane/internal/data/ent/client.go b/app/controlplane/internal/data/ent/client.go
index d6a9ca338..2a8dafc49 100644
--- a/app/controlplane/internal/data/ent/client.go
+++ b/app/controlplane/internal/data/ent/client.go
@@ -15,10 +15,10 @@ import (
 	"entgo.io/ent/dialect"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integrationattachment"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/robotaccount"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/user"
@@ -33,14 +33,14 @@ type Client struct {
 	config
 	// Schema is the client for creating, migrating and dropping schema.
 	Schema *migrate.Schema
+	// CASBackend is the client for interacting with the CASBackend builders.
+	CASBackend *CASBackendClient
 	// Integration is the client for interacting with the Integration builders.
 	Integration *IntegrationClient
 	// IntegrationAttachment is the client for interacting with the IntegrationAttachment builders.
 	IntegrationAttachment *IntegrationAttachmentClient
 	// Membership is the client for interacting with the Membership builders.
 	Membership *MembershipClient
-	// OCIRepository is the client for interacting with the OCIRepository builders.
-	OCIRepository *OCIRepositoryClient
 	// Organization is the client for interacting with the Organization builders.
 	Organization *OrganizationClient
 	// RobotAccount is the client for interacting with the RobotAccount builders.
@@ -68,10 +68,10 @@ func NewClient(opts ...Option) *Client {
 
 func (c *Client) init() {
 	c.Schema = migrate.NewSchema(c.driver)
+	c.CASBackend = NewCASBackendClient(c.config)
 	c.Integration = NewIntegrationClient(c.config)
 	c.IntegrationAttachment = NewIntegrationAttachmentClient(c.config)
 	c.Membership = NewMembershipClient(c.config)
-	c.OCIRepository = NewOCIRepositoryClient(c.config)
 	c.Organization = NewOrganizationClient(c.config)
 	c.RobotAccount = NewRobotAccountClient(c.config)
 	c.User = NewUserClient(c.config)
@@ -161,10 +161,10 @@ func (c *Client) Tx(ctx context.Context) (*Tx, error) {
 	return &Tx{
 		ctx:                     ctx,
 		config:                  cfg,
+		CASBackend:              NewCASBackendClient(cfg),
 		Integration:             NewIntegrationClient(cfg),
 		IntegrationAttachment:   NewIntegrationAttachmentClient(cfg),
 		Membership:              NewMembershipClient(cfg),
-		OCIRepository:           NewOCIRepositoryClient(cfg),
 		Organization:            NewOrganizationClient(cfg),
 		RobotAccount:            NewRobotAccountClient(cfg),
 		User:                    NewUserClient(cfg),
@@ -191,10 +191,10 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 	return &Tx{
 		ctx:                     ctx,
 		config:                  cfg,
+		CASBackend:              NewCASBackendClient(cfg),
 		Integration:             NewIntegrationClient(cfg),
 		IntegrationAttachment:   NewIntegrationAttachmentClient(cfg),
 		Membership:              NewMembershipClient(cfg),
-		OCIRepository:           NewOCIRepositoryClient(cfg),
 		Organization:            NewOrganizationClient(cfg),
 		RobotAccount:            NewRobotAccountClient(cfg),
 		User:                    NewUserClient(cfg),
@@ -208,7 +208,7 @@ func (c *Client) BeginTx(ctx context.Context, opts *sql.TxOptions) (*Tx, error)
 // Debug returns a new debug-client. It's used to get verbose logging on specific operations.
 //
 //	client.Debug().
-//		Integration.
+//		CASBackend.
 //		Query().
 //		Count(ctx)
 func (c *Client) Debug() *Client {
@@ -231,7 +231,7 @@ func (c *Client) Close() error {
 // In order to add hooks to a specific client, call: `client.Node.Use(...)`.
 func (c *Client) Use(hooks ...Hook) {
 	for _, n := range []interface{ Use(...Hook) }{
-		c.Integration, c.IntegrationAttachment, c.Membership, c.OCIRepository,
+		c.CASBackend, c.Integration, c.IntegrationAttachment, c.Membership,
 		c.Organization, c.RobotAccount, c.User, c.Workflow, c.WorkflowContract,
 		c.WorkflowContractVersion, c.WorkflowRun,
 	} {
@@ -243,7 +243,7 @@ func (c *Client) Use(hooks ...Hook) {
 // In order to add interceptors to a specific client, call: `client.Node.Intercept(...)`.
 func (c *Client) Intercept(interceptors ...Interceptor) {
 	for _, n := range []interface{ Intercept(...Interceptor) }{
-		c.Integration, c.IntegrationAttachment, c.Membership, c.OCIRepository,
+		c.CASBackend, c.Integration, c.IntegrationAttachment, c.Membership,
 		c.Organization, c.RobotAccount, c.User, c.Workflow, c.WorkflowContract,
 		c.WorkflowContractVersion, c.WorkflowRun,
 	} {
@@ -254,14 +254,14 @@ func (c *Client) Intercept(interceptors ...Interceptor) {
 // Mutate implements the ent.Mutator interface.
 func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
 	switch m := m.(type) {
+	case *CASBackendMutation:
+		return c.CASBackend.mutate(ctx, m)
 	case *IntegrationMutation:
 		return c.Integration.mutate(ctx, m)
 	case *IntegrationAttachmentMutation:
 		return c.IntegrationAttachment.mutate(ctx, m)
 	case *MembershipMutation:
 		return c.Membership.mutate(ctx, m)
-	case *OCIRepositoryMutation:
-		return c.OCIRepository.mutate(ctx, m)
 	case *OrganizationMutation:
 		return c.Organization.mutate(ctx, m)
 	case *RobotAccountMutation:
@@ -281,6 +281,140 @@ func (c *Client) Mutate(ctx context.Context, m Mutation) (Value, error) {
 	}
 }
 
+// CASBackendClient is a client for the CASBackend schema.
+type CASBackendClient struct {
+	config
+}
+
+// NewCASBackendClient returns a client for the CASBackend from the given config.
+func NewCASBackendClient(c config) *CASBackendClient {
+	return &CASBackendClient{config: c}
+}
+
+// Use adds a list of mutation hooks to the hooks stack.
+// A call to `Use(f, g, h)` equals to `casbackend.Hooks(f(g(h())))`.
+func (c *CASBackendClient) Use(hooks ...Hook) {
+	c.hooks.CASBackend = append(c.hooks.CASBackend, hooks...)
+}
+
+// Intercept adds a list of query interceptors to the interceptors stack.
+// A call to `Intercept(f, g, h)` equals to `casbackend.Intercept(f(g(h())))`.
+func (c *CASBackendClient) Intercept(interceptors ...Interceptor) {
+	c.inters.CASBackend = append(c.inters.CASBackend, interceptors...)
+}
+
+// Create returns a builder for creating a CASBackend entity.
+func (c *CASBackendClient) Create() *CASBackendCreate {
+	mutation := newCASBackendMutation(c.config, OpCreate)
+	return &CASBackendCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// CreateBulk returns a builder for creating a bulk of CASBackend entities.
+func (c *CASBackendClient) CreateBulk(builders ...*CASBackendCreate) *CASBackendCreateBulk {
+	return &CASBackendCreateBulk{config: c.config, builders: builders}
+}
+
+// Update returns an update builder for CASBackend.
+func (c *CASBackendClient) Update() *CASBackendUpdate {
+	mutation := newCASBackendMutation(c.config, OpUpdate)
+	return &CASBackendUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOne returns an update builder for the given entity.
+func (c *CASBackendClient) UpdateOne(cb *CASBackend) *CASBackendUpdateOne {
+	mutation := newCASBackendMutation(c.config, OpUpdateOne, withCASBackend(cb))
+	return &CASBackendUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// UpdateOneID returns an update builder for the given id.
+func (c *CASBackendClient) UpdateOneID(id uuid.UUID) *CASBackendUpdateOne {
+	mutation := newCASBackendMutation(c.config, OpUpdateOne, withCASBackendID(id))
+	return &CASBackendUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// Delete returns a delete builder for CASBackend.
+func (c *CASBackendClient) Delete() *CASBackendDelete {
+	mutation := newCASBackendMutation(c.config, OpDelete)
+	return &CASBackendDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
+}
+
+// DeleteOne returns a builder for deleting the given entity.
+func (c *CASBackendClient) DeleteOne(cb *CASBackend) *CASBackendDeleteOne {
+	return c.DeleteOneID(cb.ID)
+}
+
+// DeleteOneID returns a builder for deleting the given entity by its id.
+func (c *CASBackendClient) DeleteOneID(id uuid.UUID) *CASBackendDeleteOne {
+	builder := c.Delete().Where(casbackend.ID(id))
+	builder.mutation.id = &id
+	builder.mutation.op = OpDeleteOne
+	return &CASBackendDeleteOne{builder}
+}
+
+// Query returns a query builder for CASBackend.
+func (c *CASBackendClient) Query() *CASBackendQuery {
+	return &CASBackendQuery{
+		config: c.config,
+		ctx:    &QueryContext{Type: TypeCASBackend},
+		inters: c.Interceptors(),
+	}
+}
+
+// Get returns a CASBackend entity by its id.
+func (c *CASBackendClient) Get(ctx context.Context, id uuid.UUID) (*CASBackend, error) {
+	return c.Query().Where(casbackend.ID(id)).Only(ctx)
+}
+
+// GetX is like Get, but panics if an error occurs.
+func (c *CASBackendClient) GetX(ctx context.Context, id uuid.UUID) *CASBackend {
+	obj, err := c.Get(ctx, id)
+	if err != nil {
+		panic(err)
+	}
+	return obj
+}
+
+// QueryOrganization queries the organization edge of a CASBackend.
+func (c *CASBackendClient) QueryOrganization(cb *CASBackend) *OrganizationQuery {
+	query := (&OrganizationClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := cb.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(casbackend.Table, casbackend.FieldID, id),
+			sqlgraph.To(organization.Table, organization.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, true, casbackend.OrganizationTable, casbackend.OrganizationColumn),
+		)
+		fromV = sqlgraph.Neighbors(cb.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
+// Hooks returns the client hooks.
+func (c *CASBackendClient) Hooks() []Hook {
+	return c.hooks.CASBackend
+}
+
+// Interceptors returns the client interceptors.
+func (c *CASBackendClient) Interceptors() []Interceptor {
+	return c.inters.CASBackend
+}
+
+func (c *CASBackendClient) mutate(ctx context.Context, m *CASBackendMutation) (Value, error) {
+	switch m.Op() {
+	case OpCreate:
+		return (&CASBackendCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdate:
+		return (&CASBackendUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpUpdateOne:
+		return (&CASBackendUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
+	case OpDelete, OpDeleteOne:
+		return (&CASBackendDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
+	default:
+		return nil, fmt.Errorf("ent: unknown CASBackend mutation op: %q", m.Op())
+	}
+}
+
 // IntegrationClient is a client for the Integration schema.
 type IntegrationClient struct {
 	config
@@ -731,140 +865,6 @@ func (c *MembershipClient) mutate(ctx context.Context, m *MembershipMutation) (V
 	}
 }
 
-// OCIRepositoryClient is a client for the OCIRepository schema.
-type OCIRepositoryClient struct {
-	config
-}
-
-// NewOCIRepositoryClient returns a client for the OCIRepository from the given config.
-func NewOCIRepositoryClient(c config) *OCIRepositoryClient {
-	return &OCIRepositoryClient{config: c}
-}
-
-// Use adds a list of mutation hooks to the hooks stack.
-// A call to `Use(f, g, h)` equals to `ocirepository.Hooks(f(g(h())))`.
-func (c *OCIRepositoryClient) Use(hooks ...Hook) {
-	c.hooks.OCIRepository = append(c.hooks.OCIRepository, hooks...)
-}
-
-// Intercept adds a list of query interceptors to the interceptors stack.
-// A call to `Intercept(f, g, h)` equals to `ocirepository.Intercept(f(g(h())))`.
-func (c *OCIRepositoryClient) Intercept(interceptors ...Interceptor) {
-	c.inters.OCIRepository = append(c.inters.OCIRepository, interceptors...)
-}
-
-// Create returns a builder for creating a OCIRepository entity.
-func (c *OCIRepositoryClient) Create() *OCIRepositoryCreate {
-	mutation := newOCIRepositoryMutation(c.config, OpCreate)
-	return &OCIRepositoryCreate{config: c.config, hooks: c.Hooks(), mutation: mutation}
-}
-
-// CreateBulk returns a builder for creating a bulk of OCIRepository entities.
-func (c *OCIRepositoryClient) CreateBulk(builders ...*OCIRepositoryCreate) *OCIRepositoryCreateBulk {
-	return &OCIRepositoryCreateBulk{config: c.config, builders: builders}
-}
-
-// Update returns an update builder for OCIRepository.
-func (c *OCIRepositoryClient) Update() *OCIRepositoryUpdate {
-	mutation := newOCIRepositoryMutation(c.config, OpUpdate)
-	return &OCIRepositoryUpdate{config: c.config, hooks: c.Hooks(), mutation: mutation}
-}
-
-// UpdateOne returns an update builder for the given entity.
-func (c *OCIRepositoryClient) UpdateOne(or *OCIRepository) *OCIRepositoryUpdateOne {
-	mutation := newOCIRepositoryMutation(c.config, OpUpdateOne, withOCIRepository(or))
-	return &OCIRepositoryUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
-}
-
-// UpdateOneID returns an update builder for the given id.
-func (c *OCIRepositoryClient) UpdateOneID(id uuid.UUID) *OCIRepositoryUpdateOne {
-	mutation := newOCIRepositoryMutation(c.config, OpUpdateOne, withOCIRepositoryID(id))
-	return &OCIRepositoryUpdateOne{config: c.config, hooks: c.Hooks(), mutation: mutation}
-}
-
-// Delete returns a delete builder for OCIRepository.
-func (c *OCIRepositoryClient) Delete() *OCIRepositoryDelete {
-	mutation := newOCIRepositoryMutation(c.config, OpDelete)
-	return &OCIRepositoryDelete{config: c.config, hooks: c.Hooks(), mutation: mutation}
-}
-
-// DeleteOne returns a builder for deleting the given entity.
-func (c *OCIRepositoryClient) DeleteOne(or *OCIRepository) *OCIRepositoryDeleteOne {
-	return c.DeleteOneID(or.ID)
-}
-
-// DeleteOneID returns a builder for deleting the given entity by its id.
-func (c *OCIRepositoryClient) DeleteOneID(id uuid.UUID) *OCIRepositoryDeleteOne {
-	builder := c.Delete().Where(ocirepository.ID(id))
-	builder.mutation.id = &id
-	builder.mutation.op = OpDeleteOne
-	return &OCIRepositoryDeleteOne{builder}
-}
-
-// Query returns a query builder for OCIRepository.
-func (c *OCIRepositoryClient) Query() *OCIRepositoryQuery {
-	return &OCIRepositoryQuery{
-		config: c.config,
-		ctx:    &QueryContext{Type: TypeOCIRepository},
-		inters: c.Interceptors(),
-	}
-}
-
-// Get returns a OCIRepository entity by its id.
-func (c *OCIRepositoryClient) Get(ctx context.Context, id uuid.UUID) (*OCIRepository, error) {
-	return c.Query().Where(ocirepository.ID(id)).Only(ctx)
-}
-
-// GetX is like Get, but panics if an error occurs.
-func (c *OCIRepositoryClient) GetX(ctx context.Context, id uuid.UUID) *OCIRepository {
-	obj, err := c.Get(ctx, id)
-	if err != nil {
-		panic(err)
-	}
-	return obj
-}
-
-// QueryOrganization queries the organization edge of a OCIRepository.
-func (c *OCIRepositoryClient) QueryOrganization(or *OCIRepository) *OrganizationQuery {
-	query := (&OrganizationClient{config: c.config}).Query()
-	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
-		id := or.ID
-		step := sqlgraph.NewStep(
-			sqlgraph.From(ocirepository.Table, ocirepository.FieldID, id),
-			sqlgraph.To(organization.Table, organization.FieldID),
-			sqlgraph.Edge(sqlgraph.M2O, true, ocirepository.OrganizationTable, ocirepository.OrganizationColumn),
-		)
-		fromV = sqlgraph.Neighbors(or.driver.Dialect(), step)
-		return fromV, nil
-	}
-	return query
-}
-
-// Hooks returns the client hooks.
-func (c *OCIRepositoryClient) Hooks() []Hook {
-	return c.hooks.OCIRepository
-}
-
-// Interceptors returns the client interceptors.
-func (c *OCIRepositoryClient) Interceptors() []Interceptor {
-	return c.inters.OCIRepository
-}
-
-func (c *OCIRepositoryClient) mutate(ctx context.Context, m *OCIRepositoryMutation) (Value, error) {
-	switch m.Op() {
-	case OpCreate:
-		return (&OCIRepositoryCreate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
-	case OpUpdate:
-		return (&OCIRepositoryUpdate{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
-	case OpUpdateOne:
-		return (&OCIRepositoryUpdateOne{config: c.config, hooks: c.Hooks(), mutation: m}).Save(ctx)
-	case OpDelete, OpDeleteOne:
-		return (&OCIRepositoryDelete{config: c.config, hooks: c.Hooks(), mutation: m}).Exec(ctx)
-	default:
-		return nil, fmt.Errorf("ent: unknown OCIRepository mutation op: %q", m.Op())
-	}
-}
-
 // OrganizationClient is a client for the Organization schema.
 type OrganizationClient struct {
 	config
@@ -1006,15 +1006,15 @@ func (c *OrganizationClient) QueryWorkflows(o *Organization) *WorkflowQuery {
 	return query
 }
 
-// QueryOciRepositories queries the oci_repositories edge of a Organization.
-func (c *OrganizationClient) QueryOciRepositories(o *Organization) *OCIRepositoryQuery {
-	query := (&OCIRepositoryClient{config: c.config}).Query()
+// QueryCasBackends queries the cas_backends edge of a Organization.
+func (c *OrganizationClient) QueryCasBackends(o *Organization) *CASBackendQuery {
+	query := (&CASBackendClient{config: c.config}).Query()
 	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
 		id := o.ID
 		step := sqlgraph.NewStep(
 			sqlgraph.From(organization.Table, organization.FieldID, id),
-			sqlgraph.To(ocirepository.Table, ocirepository.FieldID),
-			sqlgraph.Edge(sqlgraph.O2M, false, organization.OciRepositoriesTable, organization.OciRepositoriesColumn),
+			sqlgraph.To(casbackend.Table, casbackend.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, false, organization.CasBackendsTable, organization.CasBackendsColumn),
 		)
 		fromV = sqlgraph.Neighbors(o.driver.Dialect(), step)
 		return fromV, nil
@@ -2014,12 +2014,12 @@ func (c *WorkflowRunClient) mutate(ctx context.Context, m *WorkflowRunMutation)
 // hooks and interceptors per client, for fast access.
 type (
 	hooks struct {
-		Integration, IntegrationAttachment, Membership, OCIRepository, Organization,
+		CASBackend, Integration, IntegrationAttachment, Membership, Organization,
 		RobotAccount, User, Workflow, WorkflowContract, WorkflowContractVersion,
 		WorkflowRun []ent.Hook
 	}
 	inters struct {
-		Integration, IntegrationAttachment, Membership, OCIRepository, Organization,
+		CASBackend, Integration, IntegrationAttachment, Membership, Organization,
 		RobotAccount, User, Workflow, WorkflowContract, WorkflowContractVersion,
 		WorkflowRun []ent.Interceptor
 	}
diff --git a/app/controlplane/internal/data/ent/ent.go b/app/controlplane/internal/data/ent/ent.go
index 2f277d27b..ced9d9099 100644
--- a/app/controlplane/internal/data/ent/ent.go
+++ b/app/controlplane/internal/data/ent/ent.go
@@ -12,10 +12,10 @@ import (
 	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integrationattachment"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/robotaccount"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/user"
@@ -83,10 +83,10 @@ var (
 func checkColumn(table, column string) error {
 	initCheck.Do(func() {
 		columnCheck = sql.NewColumnCheck(map[string]func(string) bool{
+			casbackend.Table:              casbackend.ValidColumn,
 			integration.Table:             integration.ValidColumn,
 			integrationattachment.Table:   integrationattachment.ValidColumn,
 			membership.Table:              membership.ValidColumn,
-			ocirepository.Table:           ocirepository.ValidColumn,
 			organization.Table:            organization.ValidColumn,
 			robotaccount.Table:            robotaccount.ValidColumn,
 			user.Table:                    user.ValidColumn,
diff --git a/app/controlplane/internal/data/ent/hook/hook.go b/app/controlplane/internal/data/ent/hook/hook.go
index 1cf1d4e84..c739f095b 100644
--- a/app/controlplane/internal/data/ent/hook/hook.go
+++ b/app/controlplane/internal/data/ent/hook/hook.go
@@ -9,6 +9,18 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent"
 )
 
+// The CASBackendFunc type is an adapter to allow the use of ordinary
+// function as CASBackend mutator.
+type CASBackendFunc func(context.Context, *ent.CASBackendMutation) (ent.Value, error)
+
+// Mutate calls f(ctx, m).
+func (f CASBackendFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value, error) {
+	if mv, ok := m.(*ent.CASBackendMutation); ok {
+		return f(ctx, mv)
+	}
+	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.CASBackendMutation", m)
+}
+
 // The IntegrationFunc type is an adapter to allow the use of ordinary
 // function as Integration mutator.
 type IntegrationFunc func(context.Context, *ent.IntegrationMutation) (ent.Value, error)
@@ -45,18 +57,6 @@ func (f MembershipFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value,
 	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.MembershipMutation", m)
 }
 
-// The OCIRepositoryFunc type is an adapter to allow the use of ordinary
-// function as OCIRepository mutator.
-type OCIRepositoryFunc func(context.Context, *ent.OCIRepositoryMutation) (ent.Value, error)
-
-// Mutate calls f(ctx, m).
-func (f OCIRepositoryFunc) Mutate(ctx context.Context, m ent.Mutation) (ent.Value, error) {
-	if mv, ok := m.(*ent.OCIRepositoryMutation); ok {
-		return f(ctx, mv)
-	}
-	return nil, fmt.Errorf("unexpected mutation type %T. expect *ent.OCIRepositoryMutation", m)
-}
-
 // The OrganizationFunc type is an adapter to allow the use of ordinary
 // function as Organization mutator.
 type OrganizationFunc func(context.Context, *ent.OrganizationMutation) (ent.Value, error)
diff --git a/app/controlplane/internal/data/ent/migrate/migrations/20230710111950-cas-backend.sql b/app/controlplane/internal/data/ent/migrate/migrations/20230710111950-cas-backend.sql
new file mode 100644
index 000000000..be7c441e6
--- /dev/null
+++ b/app/controlplane/internal/data/ent/migrate/migrations/20230710111950-cas-backend.sql
@@ -0,0 +1,20 @@
+-- Add provider and set existing to OCI type
+ALTER TABLE "oci_repositories" ADD COLUMN "provider" character varying NULL;
+UPDATE "oci_repositories" SET provider = 'OCI';
+ALTER TABLE "oci_repositories" ALTER COLUMN provider SET NOT NULL;
+
+-- Create "rename table" table
+ALTER TABLE "oci_repositories" RENAME TO "cas_backends";
+ALTER INDEX "oci_repositories_pkey" RENAME TO "cas_backends_pkey";
+
+-- Rename repo => name
+ALTER TABLE "cas_backends" RENAME COLUMN "repo" TO "name";
+-- Update foreign key references
+ALTER TABLE "cas_backends" RENAME COLUMN "organization_oci_repositories" TO "organization_cas_backends";
+ALTER TABLE "cas_backends" DROP CONSTRAINT "oci_repositories_organizations_oci_repositories";
+ALTER TABLE "cas_backends" ADD CONSTRAINT "cas_backends_organizations_cas_backends" FOREIGN KEY ("organization_cas_backends") REFERENCES "organizations" ("id") ON UPDATE NO ACTION ON DELETE CASCADE;
+
+-- default cas backend
+ALTER TABLE "cas_backends" ADD COLUMN "default" boolean NOT NULL DEFAULT false;
+-- but the default for existing ones is true
+UPDATE "cas_backends" SET "default" = true;
diff --git a/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum b/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum
index abfe818df..748e0cd86 100644
--- a/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum
+++ b/app/controlplane/internal/data/ent/migrate/migrations/atlas.sum
@@ -1,2 +1,3 @@
-h1:twWmOGBzcUJyuVTv5/GCIYdotzSw0GJ+FGftlXql4O4=
+h1:FR9yQwTYBw/AfgYTVOfVG9HP+5kYfqzH6eKNIH0Bvs4=
 20230706165452_init-schema.sql h1:VvqbNFEQnCvUVyj2iDYVQQxDM0+sSXqocpt/5H64k8M=
+20230710111950-cas-backend.sql h1:A8iBuSzZIEbdsv9ipBtscZQuaBp3V5/VMw7eZH6GX+g=
diff --git a/app/controlplane/internal/data/ent/migrate/schema.go b/app/controlplane/internal/data/ent/migrate/schema.go
index 6ed0652fa..0d43159d9 100644
--- a/app/controlplane/internal/data/ent/migrate/schema.go
+++ b/app/controlplane/internal/data/ent/migrate/schema.go
@@ -8,6 +8,32 @@ import (
 )
 
 var (
+	// CasBackendsColumns holds the columns for the "cas_backends" table.
+	CasBackendsColumns = []*schema.Column{
+		{Name: "id", Type: field.TypeUUID, Unique: true},
+		{Name: "name", Type: field.TypeString},
+		{Name: "secret_name", Type: field.TypeString},
+		{Name: "created_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
+		{Name: "validation_status", Type: field.TypeEnum, Enums: []string{"OK", "Invalid"}, Default: "OK"},
+		{Name: "validated_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
+		{Name: "provider", Type: field.TypeEnum, Enums: []string{"OCI"}},
+		{Name: "default", Type: field.TypeBool, Default: false},
+		{Name: "organization_cas_backends", Type: field.TypeUUID},
+	}
+	// CasBackendsTable holds the schema information for the "cas_backends" table.
+	CasBackendsTable = &schema.Table{
+		Name:       "cas_backends",
+		Columns:    CasBackendsColumns,
+		PrimaryKey: []*schema.Column{CasBackendsColumns[0]},
+		ForeignKeys: []*schema.ForeignKey{
+			{
+				Symbol:     "cas_backends_organizations_cas_backends",
+				Columns:    []*schema.Column{CasBackendsColumns[8]},
+				RefColumns: []*schema.Column{OrganizationsColumns[0]},
+				OnDelete:   schema.Cascade,
+			},
+		},
+	}
 	// IntegrationsColumns holds the columns for the "integrations" table.
 	IntegrationsColumns = []*schema.Column{
 		{Name: "id", Type: field.TypeUUID, Unique: true},
@@ -98,30 +124,6 @@ var (
 			},
 		},
 	}
-	// OciRepositoriesColumns holds the columns for the "oci_repositories" table.
-	OciRepositoriesColumns = []*schema.Column{
-		{Name: "id", Type: field.TypeUUID, Unique: true},
-		{Name: "repo", Type: field.TypeString},
-		{Name: "secret_name", Type: field.TypeString},
-		{Name: "created_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
-		{Name: "validation_status", Type: field.TypeEnum, Enums: []string{"OK", "Invalid"}, Default: "OK"},
-		{Name: "validated_at", Type: field.TypeTime, Default: "CURRENT_TIMESTAMP"},
-		{Name: "organization_oci_repositories", Type: field.TypeUUID},
-	}
-	// OciRepositoriesTable holds the schema information for the "oci_repositories" table.
-	OciRepositoriesTable = &schema.Table{
-		Name:       "oci_repositories",
-		Columns:    OciRepositoriesColumns,
-		PrimaryKey: []*schema.Column{OciRepositoriesColumns[0]},
-		ForeignKeys: []*schema.ForeignKey{
-			{
-				Symbol:     "oci_repositories_organizations_oci_repositories",
-				Columns:    []*schema.Column{OciRepositoriesColumns[6]},
-				RefColumns: []*schema.Column{OrganizationsColumns[0]},
-				OnDelete:   schema.Cascade,
-			},
-		},
-	}
 	// OrganizationsColumns holds the columns for the "organizations" table.
 	OrganizationsColumns = []*schema.Column{
 		{Name: "id", Type: field.TypeUUID, Unique: true},
@@ -298,10 +300,10 @@ var (
 	}
 	// Tables holds all the tables in the schema.
 	Tables = []*schema.Table{
+		CasBackendsTable,
 		IntegrationsTable,
 		IntegrationAttachmentsTable,
 		MembershipsTable,
-		OciRepositoriesTable,
 		OrganizationsTable,
 		RobotAccountsTable,
 		UsersTable,
@@ -313,12 +315,12 @@ var (
 )
 
 func init() {
+	CasBackendsTable.ForeignKeys[0].RefTable = OrganizationsTable
 	IntegrationsTable.ForeignKeys[0].RefTable = OrganizationsTable
 	IntegrationAttachmentsTable.ForeignKeys[0].RefTable = IntegrationsTable
 	IntegrationAttachmentsTable.ForeignKeys[1].RefTable = WorkflowsTable
 	MembershipsTable.ForeignKeys[0].RefTable = OrganizationsTable
 	MembershipsTable.ForeignKeys[1].RefTable = UsersTable
-	OciRepositoriesTable.ForeignKeys[0].RefTable = OrganizationsTable
 	RobotAccountsTable.ForeignKeys[0].RefTable = WorkflowsTable
 	WorkflowsTable.ForeignKeys[0].RefTable = OrganizationsTable
 	WorkflowsTable.ForeignKeys[1].RefTable = WorkflowContractsTable
diff --git a/app/controlplane/internal/data/ent/mutation.go b/app/controlplane/internal/data/ent/mutation.go
index fd96c30a7..ceb09b529 100644
--- a/app/controlplane/internal/data/ent/mutation.go
+++ b/app/controlplane/internal/data/ent/mutation.go
@@ -12,10 +12,10 @@ import (
 	"entgo.io/ent"
 	"entgo.io/ent/dialect/sql"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integrationattachment"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/robotaccount"
@@ -37,10 +37,10 @@ const (
 	OpUpdateOne = ent.OpUpdateOne
 
 	// Node types.
+	TypeCASBackend              = "CASBackend"
 	TypeIntegration             = "Integration"
 	TypeIntegrationAttachment   = "IntegrationAttachment"
 	TypeMembership              = "Membership"
-	TypeOCIRepository           = "OCIRepository"
 	TypeOrganization            = "Organization"
 	TypeRobotAccount            = "RobotAccount"
 	TypeUser                    = "User"
@@ -50,40 +50,38 @@ const (
 	TypeWorkflowRun             = "WorkflowRun"
 )
 
-// IntegrationMutation represents an operation that mutates the Integration nodes in the graph.
-type IntegrationMutation struct {
+// CASBackendMutation represents an operation that mutates the CASBackend nodes in the graph.
+type CASBackendMutation struct {
 	config
 	op                  Op
 	typ                 string
 	id                  *uuid.UUID
-	kind                *string
-	description         *string
+	name                *string
 	secret_name         *string
 	created_at          *time.Time
-	configuration       *[]byte
-	deleted_at          *time.Time
+	validation_status   *biz.CASBackendValidationStatus
+	validated_at        *time.Time
+	provider            *biz.CASBackendProvider
+	_default            *bool
 	clearedFields       map[string]struct{}
-	attachments         map[uuid.UUID]struct{}
-	removedattachments  map[uuid.UUID]struct{}
-	clearedattachments  bool
 	organization        *uuid.UUID
 	clearedorganization bool
 	done                bool
-	oldValue            func(context.Context) (*Integration, error)
-	predicates          []predicate.Integration
+	oldValue            func(context.Context) (*CASBackend, error)
+	predicates          []predicate.CASBackend
 }
 
-var _ ent.Mutation = (*IntegrationMutation)(nil)
+var _ ent.Mutation = (*CASBackendMutation)(nil)
 
-// integrationOption allows management of the mutation configuration using functional options.
-type integrationOption func(*IntegrationMutation)
+// casbackendOption allows management of the mutation configuration using functional options.
+type casbackendOption func(*CASBackendMutation)
 
-// newIntegrationMutation creates new mutation for the Integration entity.
-func newIntegrationMutation(c config, op Op, opts ...integrationOption) *IntegrationMutation {
-	m := &IntegrationMutation{
+// newCASBackendMutation creates new mutation for the CASBackend entity.
+func newCASBackendMutation(c config, op Op, opts ...casbackendOption) *CASBackendMutation {
+	m := &CASBackendMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeIntegration,
+		typ:           TypeCASBackend,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -92,20 +90,20 @@ func newIntegrationMutation(c config, op Op, opts ...integrationOption) *Integra
 	return m
 }
 
-// withIntegrationID sets the ID field of the mutation.
-func withIntegrationID(id uuid.UUID) integrationOption {
-	return func(m *IntegrationMutation) {
+// withCASBackendID sets the ID field of the mutation.
+func withCASBackendID(id uuid.UUID) casbackendOption {
+	return func(m *CASBackendMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *Integration
+			value *CASBackend
 		)
-		m.oldValue = func(ctx context.Context) (*Integration, error) {
+		m.oldValue = func(ctx context.Context) (*CASBackend, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().Integration.Get(ctx, id)
+					value, err = m.Client().CASBackend.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -114,10 +112,10 @@ func withIntegrationID(id uuid.UUID) integrationOption {
 	}
 }
 
-// withIntegration sets the old Integration of the mutation.
-func withIntegration(node *Integration) integrationOption {
-	return func(m *IntegrationMutation) {
-		m.oldValue = func(context.Context) (*Integration, error) {
+// withCASBackend sets the old CASBackend of the mutation.
+func withCASBackend(node *CASBackend) casbackendOption {
+	return func(m *CASBackendMutation) {
+		m.oldValue = func(context.Context) (*CASBackend, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -126,7 +124,7 @@ func withIntegration(node *Integration) integrationOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m IntegrationMutation) Client() *Client {
+func (m CASBackendMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -134,7 +132,7 @@ func (m IntegrationMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m IntegrationMutation) Tx() (*Tx, error) {
+func (m CASBackendMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("ent: mutation is not running in a transaction")
 	}
@@ -144,14 +142,14 @@ func (m IntegrationMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of Integration entities.
-func (m *IntegrationMutation) SetID(id uuid.UUID) {
+// operation is only accepted on creation of CASBackend entities.
+func (m *CASBackendMutation) SetID(id uuid.UUID) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *IntegrationMutation) ID() (id uuid.UUID, exists bool) {
+func (m *CASBackendMutation) ID() (id uuid.UUID, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -162,7 +160,7 @@ func (m *IntegrationMutation) ID() (id uuid.UUID, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *IntegrationMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
+func (m *CASBackendMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -171,104 +169,55 @@ func (m *IntegrationMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().Integration.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().CASBackend.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetKind sets the "kind" field.
-func (m *IntegrationMutation) SetKind(s string) {
-	m.kind = &s
-}
-
-// Kind returns the value of the "kind" field in the mutation.
-func (m *IntegrationMutation) Kind() (r string, exists bool) {
-	v := m.kind
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldKind returns the old "kind" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldKind(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldKind is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldKind requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldKind: %w", err)
-	}
-	return oldValue.Kind, nil
-}
-
-// ResetKind resets all changes to the "kind" field.
-func (m *IntegrationMutation) ResetKind() {
-	m.kind = nil
-}
-
-// SetDescription sets the "description" field.
-func (m *IntegrationMutation) SetDescription(s string) {
-	m.description = &s
+// SetName sets the "name" field.
+func (m *CASBackendMutation) SetName(s string) {
+	m.name = &s
 }
 
-// Description returns the value of the "description" field in the mutation.
-func (m *IntegrationMutation) Description() (r string, exists bool) {
-	v := m.description
+// Name returns the value of the "name" field in the mutation.
+func (m *CASBackendMutation) Name() (r string, exists bool) {
+	v := m.name
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldDescription returns the old "description" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// OldName returns the old "name" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldDescription(ctx context.Context) (v string, err error) {
+func (m *CASBackendMutation) OldName(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldDescription is only allowed on UpdateOne operations")
+		return v, errors.New("OldName is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldDescription requires an ID field in the mutation")
+		return v, errors.New("OldName requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldDescription: %w", err)
+		return v, fmt.Errorf("querying old value for OldName: %w", err)
 	}
-	return oldValue.Description, nil
-}
-
-// ClearDescription clears the value of the "description" field.
-func (m *IntegrationMutation) ClearDescription() {
-	m.description = nil
-	m.clearedFields[integration.FieldDescription] = struct{}{}
-}
-
-// DescriptionCleared returns if the "description" field was cleared in this mutation.
-func (m *IntegrationMutation) DescriptionCleared() bool {
-	_, ok := m.clearedFields[integration.FieldDescription]
-	return ok
+	return oldValue.Name, nil
 }
 
-// ResetDescription resets all changes to the "description" field.
-func (m *IntegrationMutation) ResetDescription() {
-	m.description = nil
-	delete(m.clearedFields, integration.FieldDescription)
+// ResetName resets all changes to the "name" field.
+func (m *CASBackendMutation) ResetName() {
+	m.name = nil
 }
 
 // SetSecretName sets the "secret_name" field.
-func (m *IntegrationMutation) SetSecretName(s string) {
+func (m *CASBackendMutation) SetSecretName(s string) {
 	m.secret_name = &s
 }
 
 // SecretName returns the value of the "secret_name" field in the mutation.
-func (m *IntegrationMutation) SecretName() (r string, exists bool) {
+func (m *CASBackendMutation) SecretName() (r string, exists bool) {
 	v := m.secret_name
 	if v == nil {
 		return
@@ -276,10 +225,10 @@ func (m *IntegrationMutation) SecretName() (r string, exists bool) {
 	return *v, true
 }
 
-// OldSecretName returns the old "secret_name" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// OldSecretName returns the old "secret_name" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldSecretName(ctx context.Context) (v string, err error) {
+func (m *CASBackendMutation) OldSecretName(ctx context.Context) (v string, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldSecretName is only allowed on UpdateOne operations")
 	}
@@ -294,17 +243,17 @@ func (m *IntegrationMutation) OldSecretName(ctx context.Context) (v string, err
 }
 
 // ResetSecretName resets all changes to the "secret_name" field.
-func (m *IntegrationMutation) ResetSecretName() {
+func (m *CASBackendMutation) ResetSecretName() {
 	m.secret_name = nil
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (m *IntegrationMutation) SetCreatedAt(t time.Time) {
+func (m *CASBackendMutation) SetCreatedAt(t time.Time) {
 	m.created_at = &t
 }
 
 // CreatedAt returns the value of the "created_at" field in the mutation.
-func (m *IntegrationMutation) CreatedAt() (r time.Time, exists bool) {
+func (m *CASBackendMutation) CreatedAt() (r time.Time, exists bool) {
 	v := m.created_at
 	if v == nil {
 		return
@@ -312,10 +261,10 @@ func (m *IntegrationMutation) CreatedAt() (r time.Time, exists bool) {
 	return *v, true
 }
 
-// OldCreatedAt returns the old "created_at" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *CASBackendMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
@@ -330,179 +279,171 @@ func (m *IntegrationMutation) OldCreatedAt(ctx context.Context) (v time.Time, er
 }
 
 // ResetCreatedAt resets all changes to the "created_at" field.
-func (m *IntegrationMutation) ResetCreatedAt() {
+func (m *CASBackendMutation) ResetCreatedAt() {
 	m.created_at = nil
 }
 
-// SetConfiguration sets the "configuration" field.
-func (m *IntegrationMutation) SetConfiguration(b []byte) {
-	m.configuration = &b
+// SetValidationStatus sets the "validation_status" field.
+func (m *CASBackendMutation) SetValidationStatus(bbvs biz.CASBackendValidationStatus) {
+	m.validation_status = &bbvs
 }
 
-// Configuration returns the value of the "configuration" field in the mutation.
-func (m *IntegrationMutation) Configuration() (r []byte, exists bool) {
-	v := m.configuration
+// ValidationStatus returns the value of the "validation_status" field in the mutation.
+func (m *CASBackendMutation) ValidationStatus() (r biz.CASBackendValidationStatus, exists bool) {
+	v := m.validation_status
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldConfiguration returns the old "configuration" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// OldValidationStatus returns the old "validation_status" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldConfiguration(ctx context.Context) (v []byte, err error) {
+func (m *CASBackendMutation) OldValidationStatus(ctx context.Context) (v biz.CASBackendValidationStatus, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldConfiguration is only allowed on UpdateOne operations")
+		return v, errors.New("OldValidationStatus is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldConfiguration requires an ID field in the mutation")
+		return v, errors.New("OldValidationStatus requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldConfiguration: %w", err)
+		return v, fmt.Errorf("querying old value for OldValidationStatus: %w", err)
 	}
-	return oldValue.Configuration, nil
-}
-
-// ClearConfiguration clears the value of the "configuration" field.
-func (m *IntegrationMutation) ClearConfiguration() {
-	m.configuration = nil
-	m.clearedFields[integration.FieldConfiguration] = struct{}{}
-}
-
-// ConfigurationCleared returns if the "configuration" field was cleared in this mutation.
-func (m *IntegrationMutation) ConfigurationCleared() bool {
-	_, ok := m.clearedFields[integration.FieldConfiguration]
-	return ok
+	return oldValue.ValidationStatus, nil
 }
 
-// ResetConfiguration resets all changes to the "configuration" field.
-func (m *IntegrationMutation) ResetConfiguration() {
-	m.configuration = nil
-	delete(m.clearedFields, integration.FieldConfiguration)
+// ResetValidationStatus resets all changes to the "validation_status" field.
+func (m *CASBackendMutation) ResetValidationStatus() {
+	m.validation_status = nil
 }
 
-// SetDeletedAt sets the "deleted_at" field.
-func (m *IntegrationMutation) SetDeletedAt(t time.Time) {
-	m.deleted_at = &t
+// SetValidatedAt sets the "validated_at" field.
+func (m *CASBackendMutation) SetValidatedAt(t time.Time) {
+	m.validated_at = &t
 }
 
-// DeletedAt returns the value of the "deleted_at" field in the mutation.
-func (m *IntegrationMutation) DeletedAt() (r time.Time, exists bool) {
-	v := m.deleted_at
+// ValidatedAt returns the value of the "validated_at" field in the mutation.
+func (m *CASBackendMutation) ValidatedAt() (r time.Time, exists bool) {
+	v := m.validated_at
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldDeletedAt returns the old "deleted_at" field's value of the Integration entity.
-// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// OldValidatedAt returns the old "validated_at" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationMutation) OldDeletedAt(ctx context.Context) (v time.Time, err error) {
+func (m *CASBackendMutation) OldValidatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldDeletedAt is only allowed on UpdateOne operations")
+		return v, errors.New("OldValidatedAt is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldDeletedAt requires an ID field in the mutation")
+		return v, errors.New("OldValidatedAt requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldDeletedAt: %w", err)
+		return v, fmt.Errorf("querying old value for OldValidatedAt: %w", err)
 	}
-	return oldValue.DeletedAt, nil
+	return oldValue.ValidatedAt, nil
 }
 
-// ClearDeletedAt clears the value of the "deleted_at" field.
-func (m *IntegrationMutation) ClearDeletedAt() {
-	m.deleted_at = nil
-	m.clearedFields[integration.FieldDeletedAt] = struct{}{}
+// ResetValidatedAt resets all changes to the "validated_at" field.
+func (m *CASBackendMutation) ResetValidatedAt() {
+	m.validated_at = nil
 }
 
-// DeletedAtCleared returns if the "deleted_at" field was cleared in this mutation.
-func (m *IntegrationMutation) DeletedAtCleared() bool {
-	_, ok := m.clearedFields[integration.FieldDeletedAt]
-	return ok
+// SetProvider sets the "provider" field.
+func (m *CASBackendMutation) SetProvider(bbp biz.CASBackendProvider) {
+	m.provider = &bbp
 }
 
-// ResetDeletedAt resets all changes to the "deleted_at" field.
-func (m *IntegrationMutation) ResetDeletedAt() {
-	m.deleted_at = nil
-	delete(m.clearedFields, integration.FieldDeletedAt)
+// Provider returns the value of the "provider" field in the mutation.
+func (m *CASBackendMutation) Provider() (r biz.CASBackendProvider, exists bool) {
+	v := m.provider
+	if v == nil {
+		return
+	}
+	return *v, true
 }
 
-// AddAttachmentIDs adds the "attachments" edge to the IntegrationAttachment entity by ids.
-func (m *IntegrationMutation) AddAttachmentIDs(ids ...uuid.UUID) {
-	if m.attachments == nil {
-		m.attachments = make(map[uuid.UUID]struct{})
+// OldProvider returns the old "provider" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *CASBackendMutation) OldProvider(ctx context.Context) (v biz.CASBackendProvider, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldProvider is only allowed on UpdateOne operations")
 	}
-	for i := range ids {
-		m.attachments[ids[i]] = struct{}{}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldProvider requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldProvider: %w", err)
 	}
+	return oldValue.Provider, nil
 }
 
-// ClearAttachments clears the "attachments" edge to the IntegrationAttachment entity.
-func (m *IntegrationMutation) ClearAttachments() {
-	m.clearedattachments = true
+// ResetProvider resets all changes to the "provider" field.
+func (m *CASBackendMutation) ResetProvider() {
+	m.provider = nil
 }
 
-// AttachmentsCleared reports if the "attachments" edge to the IntegrationAttachment entity was cleared.
-func (m *IntegrationMutation) AttachmentsCleared() bool {
-	return m.clearedattachments
+// SetDefault sets the "default" field.
+func (m *CASBackendMutation) SetDefault(b bool) {
+	m._default = &b
 }
 
-// RemoveAttachmentIDs removes the "attachments" edge to the IntegrationAttachment entity by IDs.
-func (m *IntegrationMutation) RemoveAttachmentIDs(ids ...uuid.UUID) {
-	if m.removedattachments == nil {
-		m.removedattachments = make(map[uuid.UUID]struct{})
-	}
-	for i := range ids {
-		delete(m.attachments, ids[i])
-		m.removedattachments[ids[i]] = struct{}{}
+// Default returns the value of the "default" field in the mutation.
+func (m *CASBackendMutation) Default() (r bool, exists bool) {
+	v := m._default
+	if v == nil {
+		return
 	}
+	return *v, true
 }
 
-// RemovedAttachments returns the removed IDs of the "attachments" edge to the IntegrationAttachment entity.
-func (m *IntegrationMutation) RemovedAttachmentsIDs() (ids []uuid.UUID) {
-	for id := range m.removedattachments {
-		ids = append(ids, id)
+// OldDefault returns the old "default" field's value of the CASBackend entity.
+// If the CASBackend object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *CASBackendMutation) OldDefault(ctx context.Context) (v bool, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldDefault is only allowed on UpdateOne operations")
 	}
-	return
-}
-
-// AttachmentsIDs returns the "attachments" edge IDs in the mutation.
-func (m *IntegrationMutation) AttachmentsIDs() (ids []uuid.UUID) {
-	for id := range m.attachments {
-		ids = append(ids, id)
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldDefault requires an ID field in the mutation")
 	}
-	return
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldDefault: %w", err)
+	}
+	return oldValue.Default, nil
 }
 
-// ResetAttachments resets all changes to the "attachments" edge.
-func (m *IntegrationMutation) ResetAttachments() {
-	m.attachments = nil
-	m.clearedattachments = false
-	m.removedattachments = nil
+// ResetDefault resets all changes to the "default" field.
+func (m *CASBackendMutation) ResetDefault() {
+	m._default = nil
 }
 
 // SetOrganizationID sets the "organization" edge to the Organization entity by id.
-func (m *IntegrationMutation) SetOrganizationID(id uuid.UUID) {
+func (m *CASBackendMutation) SetOrganizationID(id uuid.UUID) {
 	m.organization = &id
 }
 
 // ClearOrganization clears the "organization" edge to the Organization entity.
-func (m *IntegrationMutation) ClearOrganization() {
+func (m *CASBackendMutation) ClearOrganization() {
 	m.clearedorganization = true
 }
 
 // OrganizationCleared reports if the "organization" edge to the Organization entity was cleared.
-func (m *IntegrationMutation) OrganizationCleared() bool {
+func (m *CASBackendMutation) OrganizationCleared() bool {
 	return m.clearedorganization
 }
 
 // OrganizationID returns the "organization" edge ID in the mutation.
-func (m *IntegrationMutation) OrganizationID() (id uuid.UUID, exists bool) {
+func (m *CASBackendMutation) OrganizationID() (id uuid.UUID, exists bool) {
 	if m.organization != nil {
 		return *m.organization, true
 	}
@@ -512,7 +453,7 @@ func (m *IntegrationMutation) OrganizationID() (id uuid.UUID, exists bool) {
 // OrganizationIDs returns the "organization" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
 // OrganizationID instead. It exists only for internal usage by the builders.
-func (m *IntegrationMutation) OrganizationIDs() (ids []uuid.UUID) {
+func (m *CASBackendMutation) OrganizationIDs() (ids []uuid.UUID) {
 	if id := m.organization; id != nil {
 		ids = append(ids, *id)
 	}
@@ -520,20 +461,20 @@ func (m *IntegrationMutation) OrganizationIDs() (ids []uuid.UUID) {
 }
 
 // ResetOrganization resets all changes to the "organization" edge.
-func (m *IntegrationMutation) ResetOrganization() {
+func (m *CASBackendMutation) ResetOrganization() {
 	m.organization = nil
 	m.clearedorganization = false
 }
 
-// Where appends a list predicates to the IntegrationMutation builder.
-func (m *IntegrationMutation) Where(ps ...predicate.Integration) {
+// Where appends a list predicates to the CASBackendMutation builder.
+func (m *CASBackendMutation) Where(ps ...predicate.CASBackend) {
 	m.predicates = append(m.predicates, ps...)
 }
 
-// WhereP appends storage-level predicates to the IntegrationMutation builder. Using this method,
+// WhereP appends storage-level predicates to the CASBackendMutation builder. Using this method,
 // users can use type-assertion to append predicates that do not depend on any generated package.
-func (m *IntegrationMutation) WhereP(ps ...func(*sql.Selector)) {
-	p := make([]predicate.Integration, len(ps))
+func (m *CASBackendMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.CASBackend, len(ps))
 	for i := range ps {
 		p[i] = ps[i]
 	}
@@ -541,42 +482,45 @@ func (m *IntegrationMutation) WhereP(ps ...func(*sql.Selector)) {
 }
 
 // Op returns the operation name.
-func (m *IntegrationMutation) Op() Op {
+func (m *CASBackendMutation) Op() Op {
 	return m.op
 }
 
 // SetOp allows setting the mutation operation.
-func (m *IntegrationMutation) SetOp(op Op) {
+func (m *CASBackendMutation) SetOp(op Op) {
 	m.op = op
 }
 
-// Type returns the node type of this mutation (Integration).
-func (m *IntegrationMutation) Type() string {
+// Type returns the node type of this mutation (CASBackend).
+func (m *CASBackendMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *IntegrationMutation) Fields() []string {
-	fields := make([]string, 0, 6)
-	if m.kind != nil {
-		fields = append(fields, integration.FieldKind)
-	}
-	if m.description != nil {
-		fields = append(fields, integration.FieldDescription)
+func (m *CASBackendMutation) Fields() []string {
+	fields := make([]string, 0, 7)
+	if m.name != nil {
+		fields = append(fields, casbackend.FieldName)
 	}
 	if m.secret_name != nil {
-		fields = append(fields, integration.FieldSecretName)
+		fields = append(fields, casbackend.FieldSecretName)
 	}
 	if m.created_at != nil {
-		fields = append(fields, integration.FieldCreatedAt)
+		fields = append(fields, casbackend.FieldCreatedAt)
 	}
-	if m.configuration != nil {
-		fields = append(fields, integration.FieldConfiguration)
+	if m.validation_status != nil {
+		fields = append(fields, casbackend.FieldValidationStatus)
 	}
-	if m.deleted_at != nil {
-		fields = append(fields, integration.FieldDeletedAt)
+	if m.validated_at != nil {
+		fields = append(fields, casbackend.FieldValidatedAt)
+	}
+	if m.provider != nil {
+		fields = append(fields, casbackend.FieldProvider)
+	}
+	if m._default != nil {
+		fields = append(fields, casbackend.FieldDefault)
 	}
 	return fields
 }
@@ -584,20 +528,22 @@ func (m *IntegrationMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *IntegrationMutation) Field(name string) (ent.Value, bool) {
+func (m *CASBackendMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case integration.FieldKind:
-		return m.Kind()
-	case integration.FieldDescription:
-		return m.Description()
-	case integration.FieldSecretName:
+	case casbackend.FieldName:
+		return m.Name()
+	case casbackend.FieldSecretName:
 		return m.SecretName()
-	case integration.FieldCreatedAt:
+	case casbackend.FieldCreatedAt:
 		return m.CreatedAt()
-	case integration.FieldConfiguration:
-		return m.Configuration()
-	case integration.FieldDeletedAt:
-		return m.DeletedAt()
+	case casbackend.FieldValidationStatus:
+		return m.ValidationStatus()
+	case casbackend.FieldValidatedAt:
+		return m.ValidatedAt()
+	case casbackend.FieldProvider:
+		return m.Provider()
+	case casbackend.FieldDefault:
+		return m.Default()
 	}
 	return nil, false
 }
@@ -605,186 +551,168 @@ func (m *IntegrationMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *IntegrationMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *CASBackendMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case integration.FieldKind:
-		return m.OldKind(ctx)
-	case integration.FieldDescription:
-		return m.OldDescription(ctx)
-	case integration.FieldSecretName:
+	case casbackend.FieldName:
+		return m.OldName(ctx)
+	case casbackend.FieldSecretName:
 		return m.OldSecretName(ctx)
-	case integration.FieldCreatedAt:
+	case casbackend.FieldCreatedAt:
 		return m.OldCreatedAt(ctx)
-	case integration.FieldConfiguration:
-		return m.OldConfiguration(ctx)
-	case integration.FieldDeletedAt:
-		return m.OldDeletedAt(ctx)
+	case casbackend.FieldValidationStatus:
+		return m.OldValidationStatus(ctx)
+	case casbackend.FieldValidatedAt:
+		return m.OldValidatedAt(ctx)
+	case casbackend.FieldProvider:
+		return m.OldProvider(ctx)
+	case casbackend.FieldDefault:
+		return m.OldDefault(ctx)
 	}
-	return nil, fmt.Errorf("unknown Integration field %s", name)
+	return nil, fmt.Errorf("unknown CASBackend field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *IntegrationMutation) SetField(name string, value ent.Value) error {
+func (m *CASBackendMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case integration.FieldKind:
+	case casbackend.FieldName:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetKind(v)
+		m.SetName(v)
 		return nil
-	case integration.FieldDescription:
+	case casbackend.FieldSecretName:
 		v, ok := value.(string)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetDescription(v)
+		m.SetSecretName(v)
 		return nil
-	case integration.FieldSecretName:
-		v, ok := value.(string)
+	case casbackend.FieldCreatedAt:
+		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetSecretName(v)
+		m.SetCreatedAt(v)
 		return nil
-	case integration.FieldCreatedAt:
+	case casbackend.FieldValidationStatus:
+		v, ok := value.(biz.CASBackendValidationStatus)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetValidationStatus(v)
+		return nil
+	case casbackend.FieldValidatedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCreatedAt(v)
+		m.SetValidatedAt(v)
 		return nil
-	case integration.FieldConfiguration:
-		v, ok := value.([]byte)
+	case casbackend.FieldProvider:
+		v, ok := value.(biz.CASBackendProvider)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetConfiguration(v)
+		m.SetProvider(v)
 		return nil
-	case integration.FieldDeletedAt:
-		v, ok := value.(time.Time)
+	case casbackend.FieldDefault:
+		v, ok := value.(bool)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetDeletedAt(v)
+		m.SetDefault(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Integration field %s", name)
+	return fmt.Errorf("unknown CASBackend field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *IntegrationMutation) AddedFields() []string {
+func (m *CASBackendMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *IntegrationMutation) AddedField(name string) (ent.Value, bool) {
+func (m *CASBackendMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *IntegrationMutation) AddField(name string, value ent.Value) error {
+func (m *CASBackendMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown Integration numeric field %s", name)
+	return fmt.Errorf("unknown CASBackend numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *IntegrationMutation) ClearedFields() []string {
-	var fields []string
-	if m.FieldCleared(integration.FieldDescription) {
-		fields = append(fields, integration.FieldDescription)
-	}
-	if m.FieldCleared(integration.FieldConfiguration) {
-		fields = append(fields, integration.FieldConfiguration)
-	}
-	if m.FieldCleared(integration.FieldDeletedAt) {
-		fields = append(fields, integration.FieldDeletedAt)
-	}
-	return fields
+func (m *CASBackendMutation) ClearedFields() []string {
+	return nil
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *IntegrationMutation) FieldCleared(name string) bool {
+func (m *CASBackendMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *IntegrationMutation) ClearField(name string) error {
-	switch name {
-	case integration.FieldDescription:
-		m.ClearDescription()
-		return nil
-	case integration.FieldConfiguration:
-		m.ClearConfiguration()
-		return nil
-	case integration.FieldDeletedAt:
-		m.ClearDeletedAt()
-		return nil
-	}
-	return fmt.Errorf("unknown Integration nullable field %s", name)
+func (m *CASBackendMutation) ClearField(name string) error {
+	return fmt.Errorf("unknown CASBackend nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *IntegrationMutation) ResetField(name string) error {
+func (m *CASBackendMutation) ResetField(name string) error {
 	switch name {
-	case integration.FieldKind:
-		m.ResetKind()
-		return nil
-	case integration.FieldDescription:
-		m.ResetDescription()
+	case casbackend.FieldName:
+		m.ResetName()
 		return nil
-	case integration.FieldSecretName:
+	case casbackend.FieldSecretName:
 		m.ResetSecretName()
 		return nil
-	case integration.FieldCreatedAt:
+	case casbackend.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case integration.FieldConfiguration:
-		m.ResetConfiguration()
+	case casbackend.FieldValidationStatus:
+		m.ResetValidationStatus()
 		return nil
-	case integration.FieldDeletedAt:
-		m.ResetDeletedAt()
+	case casbackend.FieldValidatedAt:
+		m.ResetValidatedAt()
+		return nil
+	case casbackend.FieldProvider:
+		m.ResetProvider()
+		return nil
+	case casbackend.FieldDefault:
+		m.ResetDefault()
 		return nil
 	}
-	return fmt.Errorf("unknown Integration field %s", name)
+	return fmt.Errorf("unknown CASBackend field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *IntegrationMutation) AddedEdges() []string {
-	edges := make([]string, 0, 2)
-	if m.attachments != nil {
-		edges = append(edges, integration.EdgeAttachments)
-	}
+func (m *CASBackendMutation) AddedEdges() []string {
+	edges := make([]string, 0, 1)
 	if m.organization != nil {
-		edges = append(edges, integration.EdgeOrganization)
+		edges = append(edges, casbackend.EdgeOrganization)
 	}
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *IntegrationMutation) AddedIDs(name string) []ent.Value {
+func (m *CASBackendMutation) AddedIDs(name string) []ent.Value {
 	switch name {
-	case integration.EdgeAttachments:
-		ids := make([]ent.Value, 0, len(m.attachments))
-		for id := range m.attachments {
-			ids = append(ids, id)
-		}
-		return ids
-	case integration.EdgeOrganization:
+	case casbackend.EdgeOrganization:
 		if id := m.organization; id != nil {
 			return []ent.Value{*id}
 		}
@@ -793,47 +721,31 @@ func (m *IntegrationMutation) AddedIDs(name string) []ent.Value {
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *IntegrationMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 2)
-	if m.removedattachments != nil {
-		edges = append(edges, integration.EdgeAttachments)
-	}
+func (m *CASBackendMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 1)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *IntegrationMutation) RemovedIDs(name string) []ent.Value {
-	switch name {
-	case integration.EdgeAttachments:
-		ids := make([]ent.Value, 0, len(m.removedattachments))
-		for id := range m.removedattachments {
-			ids = append(ids, id)
-		}
-		return ids
-	}
+func (m *CASBackendMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *IntegrationMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 2)
-	if m.clearedattachments {
-		edges = append(edges, integration.EdgeAttachments)
-	}
+func (m *CASBackendMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 1)
 	if m.clearedorganization {
-		edges = append(edges, integration.EdgeOrganization)
+		edges = append(edges, casbackend.EdgeOrganization)
 	}
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *IntegrationMutation) EdgeCleared(name string) bool {
+func (m *CASBackendMutation) EdgeCleared(name string) bool {
 	switch name {
-	case integration.EdgeAttachments:
-		return m.clearedattachments
-	case integration.EdgeOrganization:
+	case casbackend.EdgeOrganization:
 		return m.clearedorganization
 	}
 	return false
@@ -841,59 +753,60 @@ func (m *IntegrationMutation) EdgeCleared(name string) bool {
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *IntegrationMutation) ClearEdge(name string) error {
+func (m *CASBackendMutation) ClearEdge(name string) error {
 	switch name {
-	case integration.EdgeOrganization:
+	case casbackend.EdgeOrganization:
 		m.ClearOrganization()
 		return nil
 	}
-	return fmt.Errorf("unknown Integration unique edge %s", name)
+	return fmt.Errorf("unknown CASBackend unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *IntegrationMutation) ResetEdge(name string) error {
+func (m *CASBackendMutation) ResetEdge(name string) error {
 	switch name {
-	case integration.EdgeAttachments:
-		m.ResetAttachments()
-		return nil
-	case integration.EdgeOrganization:
+	case casbackend.EdgeOrganization:
 		m.ResetOrganization()
 		return nil
 	}
-	return fmt.Errorf("unknown Integration edge %s", name)
+	return fmt.Errorf("unknown CASBackend edge %s", name)
 }
 
-// IntegrationAttachmentMutation represents an operation that mutates the IntegrationAttachment nodes in the graph.
-type IntegrationAttachmentMutation struct {
+// IntegrationMutation represents an operation that mutates the Integration nodes in the graph.
+type IntegrationMutation struct {
 	config
-	op                 Op
-	typ                string
-	id                 *uuid.UUID
-	created_at         *time.Time
-	configuration      *[]byte
-	deleted_at         *time.Time
-	clearedFields      map[string]struct{}
-	integration        *uuid.UUID
-	clearedintegration bool
-	workflow           *uuid.UUID
-	clearedworkflow    bool
-	done               bool
-	oldValue           func(context.Context) (*IntegrationAttachment, error)
-	predicates         []predicate.IntegrationAttachment
+	op                  Op
+	typ                 string
+	id                  *uuid.UUID
+	kind                *string
+	description         *string
+	secret_name         *string
+	created_at          *time.Time
+	configuration       *[]byte
+	deleted_at          *time.Time
+	clearedFields       map[string]struct{}
+	attachments         map[uuid.UUID]struct{}
+	removedattachments  map[uuid.UUID]struct{}
+	clearedattachments  bool
+	organization        *uuid.UUID
+	clearedorganization bool
+	done                bool
+	oldValue            func(context.Context) (*Integration, error)
+	predicates          []predicate.Integration
 }
 
-var _ ent.Mutation = (*IntegrationAttachmentMutation)(nil)
+var _ ent.Mutation = (*IntegrationMutation)(nil)
 
-// integrationattachmentOption allows management of the mutation configuration using functional options.
-type integrationattachmentOption func(*IntegrationAttachmentMutation)
+// integrationOption allows management of the mutation configuration using functional options.
+type integrationOption func(*IntegrationMutation)
 
-// newIntegrationAttachmentMutation creates new mutation for the IntegrationAttachment entity.
-func newIntegrationAttachmentMutation(c config, op Op, opts ...integrationattachmentOption) *IntegrationAttachmentMutation {
-	m := &IntegrationAttachmentMutation{
+// newIntegrationMutation creates new mutation for the Integration entity.
+func newIntegrationMutation(c config, op Op, opts ...integrationOption) *IntegrationMutation {
+	m := &IntegrationMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeIntegrationAttachment,
+		typ:           TypeIntegration,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -902,20 +815,20 @@ func newIntegrationAttachmentMutation(c config, op Op, opts ...integrationattach
 	return m
 }
 
-// withIntegrationAttachmentID sets the ID field of the mutation.
-func withIntegrationAttachmentID(id uuid.UUID) integrationattachmentOption {
-	return func(m *IntegrationAttachmentMutation) {
+// withIntegrationID sets the ID field of the mutation.
+func withIntegrationID(id uuid.UUID) integrationOption {
+	return func(m *IntegrationMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *IntegrationAttachment
+			value *Integration
 		)
-		m.oldValue = func(ctx context.Context) (*IntegrationAttachment, error) {
+		m.oldValue = func(ctx context.Context) (*Integration, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().IntegrationAttachment.Get(ctx, id)
+					value, err = m.Client().Integration.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -924,19 +837,19 @@ func withIntegrationAttachmentID(id uuid.UUID) integrationattachmentOption {
 	}
 }
 
-// withIntegrationAttachment sets the old IntegrationAttachment of the mutation.
-func withIntegrationAttachment(node *IntegrationAttachment) integrationattachmentOption {
-	return func(m *IntegrationAttachmentMutation) {
-		m.oldValue = func(context.Context) (*IntegrationAttachment, error) {
-			return node, nil
-		}
-		m.id = &node.ID
+// withIntegration sets the old Integration of the mutation.
+func withIntegration(node *Integration) integrationOption {
+	return func(m *IntegrationMutation) {
+		m.oldValue = func(context.Context) (*Integration, error) {
+			return node, nil
+		}
+		m.id = &node.ID
 	}
 }
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m IntegrationAttachmentMutation) Client() *Client {
+func (m IntegrationMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -944,7 +857,7 @@ func (m IntegrationAttachmentMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m IntegrationAttachmentMutation) Tx() (*Tx, error) {
+func (m IntegrationMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("ent: mutation is not running in a transaction")
 	}
@@ -954,14 +867,14 @@ func (m IntegrationAttachmentMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of IntegrationAttachment entities.
-func (m *IntegrationAttachmentMutation) SetID(id uuid.UUID) {
+// operation is only accepted on creation of Integration entities.
+func (m *IntegrationMutation) SetID(id uuid.UUID) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *IntegrationAttachmentMutation) ID() (id uuid.UUID, exists bool) {
+func (m *IntegrationMutation) ID() (id uuid.UUID, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -972,7 +885,7 @@ func (m *IntegrationAttachmentMutation) ID() (id uuid.UUID, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *IntegrationAttachmentMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
+func (m *IntegrationMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -981,19 +894,140 @@ func (m *IntegrationAttachmentMutation) IDs(ctx context.Context) ([]uuid.UUID, e
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().IntegrationAttachment.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().Integration.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
+// SetKind sets the "kind" field.
+func (m *IntegrationMutation) SetKind(s string) {
+	m.kind = &s
+}
+
+// Kind returns the value of the "kind" field in the mutation.
+func (m *IntegrationMutation) Kind() (r string, exists bool) {
+	v := m.kind
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldKind returns the old "kind" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *IntegrationMutation) OldKind(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldKind is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldKind requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldKind: %w", err)
+	}
+	return oldValue.Kind, nil
+}
+
+// ResetKind resets all changes to the "kind" field.
+func (m *IntegrationMutation) ResetKind() {
+	m.kind = nil
+}
+
+// SetDescription sets the "description" field.
+func (m *IntegrationMutation) SetDescription(s string) {
+	m.description = &s
+}
+
+// Description returns the value of the "description" field in the mutation.
+func (m *IntegrationMutation) Description() (r string, exists bool) {
+	v := m.description
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldDescription returns the old "description" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *IntegrationMutation) OldDescription(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldDescription is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldDescription requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldDescription: %w", err)
+	}
+	return oldValue.Description, nil
+}
+
+// ClearDescription clears the value of the "description" field.
+func (m *IntegrationMutation) ClearDescription() {
+	m.description = nil
+	m.clearedFields[integration.FieldDescription] = struct{}{}
+}
+
+// DescriptionCleared returns if the "description" field was cleared in this mutation.
+func (m *IntegrationMutation) DescriptionCleared() bool {
+	_, ok := m.clearedFields[integration.FieldDescription]
+	return ok
+}
+
+// ResetDescription resets all changes to the "description" field.
+func (m *IntegrationMutation) ResetDescription() {
+	m.description = nil
+	delete(m.clearedFields, integration.FieldDescription)
+}
+
+// SetSecretName sets the "secret_name" field.
+func (m *IntegrationMutation) SetSecretName(s string) {
+	m.secret_name = &s
+}
+
+// SecretName returns the value of the "secret_name" field in the mutation.
+func (m *IntegrationMutation) SecretName() (r string, exists bool) {
+	v := m.secret_name
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldSecretName returns the old "secret_name" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *IntegrationMutation) OldSecretName(ctx context.Context) (v string, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldSecretName is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldSecretName requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldSecretName: %w", err)
+	}
+	return oldValue.SecretName, nil
+}
+
+// ResetSecretName resets all changes to the "secret_name" field.
+func (m *IntegrationMutation) ResetSecretName() {
+	m.secret_name = nil
+}
+
 // SetCreatedAt sets the "created_at" field.
-func (m *IntegrationAttachmentMutation) SetCreatedAt(t time.Time) {
+func (m *IntegrationMutation) SetCreatedAt(t time.Time) {
 	m.created_at = &t
 }
 
 // CreatedAt returns the value of the "created_at" field in the mutation.
-func (m *IntegrationAttachmentMutation) CreatedAt() (r time.Time, exists bool) {
+func (m *IntegrationMutation) CreatedAt() (r time.Time, exists bool) {
 	v := m.created_at
 	if v == nil {
 		return
@@ -1001,10 +1035,10 @@ func (m *IntegrationAttachmentMutation) CreatedAt() (r time.Time, exists bool) {
 	return *v, true
 }
 
-// OldCreatedAt returns the old "created_at" field's value of the IntegrationAttachment entity.
-// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationAttachmentMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *IntegrationMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
@@ -1019,17 +1053,17 @@ func (m *IntegrationAttachmentMutation) OldCreatedAt(ctx context.Context) (v tim
 }
 
 // ResetCreatedAt resets all changes to the "created_at" field.
-func (m *IntegrationAttachmentMutation) ResetCreatedAt() {
+func (m *IntegrationMutation) ResetCreatedAt() {
 	m.created_at = nil
 }
 
 // SetConfiguration sets the "configuration" field.
-func (m *IntegrationAttachmentMutation) SetConfiguration(b []byte) {
+func (m *IntegrationMutation) SetConfiguration(b []byte) {
 	m.configuration = &b
 }
 
 // Configuration returns the value of the "configuration" field in the mutation.
-func (m *IntegrationAttachmentMutation) Configuration() (r []byte, exists bool) {
+func (m *IntegrationMutation) Configuration() (r []byte, exists bool) {
 	v := m.configuration
 	if v == nil {
 		return
@@ -1037,10 +1071,10 @@ func (m *IntegrationAttachmentMutation) Configuration() (r []byte, exists bool)
 	return *v, true
 }
 
-// OldConfiguration returns the old "configuration" field's value of the IntegrationAttachment entity.
-// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
+// OldConfiguration returns the old "configuration" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationAttachmentMutation) OldConfiguration(ctx context.Context) (v []byte, err error) {
+func (m *IntegrationMutation) OldConfiguration(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldConfiguration is only allowed on UpdateOne operations")
 	}
@@ -1055,30 +1089,30 @@ func (m *IntegrationAttachmentMutation) OldConfiguration(ctx context.Context) (v
 }
 
 // ClearConfiguration clears the value of the "configuration" field.
-func (m *IntegrationAttachmentMutation) ClearConfiguration() {
+func (m *IntegrationMutation) ClearConfiguration() {
 	m.configuration = nil
-	m.clearedFields[integrationattachment.FieldConfiguration] = struct{}{}
+	m.clearedFields[integration.FieldConfiguration] = struct{}{}
 }
 
 // ConfigurationCleared returns if the "configuration" field was cleared in this mutation.
-func (m *IntegrationAttachmentMutation) ConfigurationCleared() bool {
-	_, ok := m.clearedFields[integrationattachment.FieldConfiguration]
+func (m *IntegrationMutation) ConfigurationCleared() bool {
+	_, ok := m.clearedFields[integration.FieldConfiguration]
 	return ok
 }
 
 // ResetConfiguration resets all changes to the "configuration" field.
-func (m *IntegrationAttachmentMutation) ResetConfiguration() {
+func (m *IntegrationMutation) ResetConfiguration() {
 	m.configuration = nil
-	delete(m.clearedFields, integrationattachment.FieldConfiguration)
+	delete(m.clearedFields, integration.FieldConfiguration)
 }
 
 // SetDeletedAt sets the "deleted_at" field.
-func (m *IntegrationAttachmentMutation) SetDeletedAt(t time.Time) {
+func (m *IntegrationMutation) SetDeletedAt(t time.Time) {
 	m.deleted_at = &t
 }
 
 // DeletedAt returns the value of the "deleted_at" field in the mutation.
-func (m *IntegrationAttachmentMutation) DeletedAt() (r time.Time, exists bool) {
+func (m *IntegrationMutation) DeletedAt() (r time.Time, exists bool) {
 	v := m.deleted_at
 	if v == nil {
 		return
@@ -1086,10 +1120,10 @@ func (m *IntegrationAttachmentMutation) DeletedAt() (r time.Time, exists bool) {
 	return *v, true
 }
 
-// OldDeletedAt returns the old "deleted_at" field's value of the IntegrationAttachment entity.
-// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
+// OldDeletedAt returns the old "deleted_at" field's value of the Integration entity.
+// If the Integration object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *IntegrationAttachmentMutation) OldDeletedAt(ctx context.Context) (v time.Time, err error) {
+func (m *IntegrationMutation) OldDeletedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldDeletedAt is only allowed on UpdateOne operations")
 	}
@@ -1104,110 +1138,125 @@ func (m *IntegrationAttachmentMutation) OldDeletedAt(ctx context.Context) (v tim
 }
 
 // ClearDeletedAt clears the value of the "deleted_at" field.
-func (m *IntegrationAttachmentMutation) ClearDeletedAt() {
+func (m *IntegrationMutation) ClearDeletedAt() {
 	m.deleted_at = nil
-	m.clearedFields[integrationattachment.FieldDeletedAt] = struct{}{}
+	m.clearedFields[integration.FieldDeletedAt] = struct{}{}
 }
 
 // DeletedAtCleared returns if the "deleted_at" field was cleared in this mutation.
-func (m *IntegrationAttachmentMutation) DeletedAtCleared() bool {
-	_, ok := m.clearedFields[integrationattachment.FieldDeletedAt]
+func (m *IntegrationMutation) DeletedAtCleared() bool {
+	_, ok := m.clearedFields[integration.FieldDeletedAt]
 	return ok
 }
 
 // ResetDeletedAt resets all changes to the "deleted_at" field.
-func (m *IntegrationAttachmentMutation) ResetDeletedAt() {
+func (m *IntegrationMutation) ResetDeletedAt() {
 	m.deleted_at = nil
-	delete(m.clearedFields, integrationattachment.FieldDeletedAt)
+	delete(m.clearedFields, integration.FieldDeletedAt)
 }
 
-// SetIntegrationID sets the "integration" edge to the Integration entity by id.
-func (m *IntegrationAttachmentMutation) SetIntegrationID(id uuid.UUID) {
-	m.integration = &id
+// AddAttachmentIDs adds the "attachments" edge to the IntegrationAttachment entity by ids.
+func (m *IntegrationMutation) AddAttachmentIDs(ids ...uuid.UUID) {
+	if m.attachments == nil {
+		m.attachments = make(map[uuid.UUID]struct{})
+	}
+	for i := range ids {
+		m.attachments[ids[i]] = struct{}{}
+	}
 }
 
-// ClearIntegration clears the "integration" edge to the Integration entity.
-func (m *IntegrationAttachmentMutation) ClearIntegration() {
-	m.clearedintegration = true
+// ClearAttachments clears the "attachments" edge to the IntegrationAttachment entity.
+func (m *IntegrationMutation) ClearAttachments() {
+	m.clearedattachments = true
 }
 
-// IntegrationCleared reports if the "integration" edge to the Integration entity was cleared.
-func (m *IntegrationAttachmentMutation) IntegrationCleared() bool {
-	return m.clearedintegration
+// AttachmentsCleared reports if the "attachments" edge to the IntegrationAttachment entity was cleared.
+func (m *IntegrationMutation) AttachmentsCleared() bool {
+	return m.clearedattachments
 }
 
-// IntegrationID returns the "integration" edge ID in the mutation.
-func (m *IntegrationAttachmentMutation) IntegrationID() (id uuid.UUID, exists bool) {
-	if m.integration != nil {
-		return *m.integration, true
+// RemoveAttachmentIDs removes the "attachments" edge to the IntegrationAttachment entity by IDs.
+func (m *IntegrationMutation) RemoveAttachmentIDs(ids ...uuid.UUID) {
+	if m.removedattachments == nil {
+		m.removedattachments = make(map[uuid.UUID]struct{})
+	}
+	for i := range ids {
+		delete(m.attachments, ids[i])
+		m.removedattachments[ids[i]] = struct{}{}
+	}
+}
+
+// RemovedAttachments returns the removed IDs of the "attachments" edge to the IntegrationAttachment entity.
+func (m *IntegrationMutation) RemovedAttachmentsIDs() (ids []uuid.UUID) {
+	for id := range m.removedattachments {
+		ids = append(ids, id)
 	}
 	return
 }
 
-// IntegrationIDs returns the "integration" edge IDs in the mutation.
-// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
-// IntegrationID instead. It exists only for internal usage by the builders.
-func (m *IntegrationAttachmentMutation) IntegrationIDs() (ids []uuid.UUID) {
-	if id := m.integration; id != nil {
-		ids = append(ids, *id)
+// AttachmentsIDs returns the "attachments" edge IDs in the mutation.
+func (m *IntegrationMutation) AttachmentsIDs() (ids []uuid.UUID) {
+	for id := range m.attachments {
+		ids = append(ids, id)
 	}
 	return
 }
 
-// ResetIntegration resets all changes to the "integration" edge.
-func (m *IntegrationAttachmentMutation) ResetIntegration() {
-	m.integration = nil
-	m.clearedintegration = false
+// ResetAttachments resets all changes to the "attachments" edge.
+func (m *IntegrationMutation) ResetAttachments() {
+	m.attachments = nil
+	m.clearedattachments = false
+	m.removedattachments = nil
 }
 
-// SetWorkflowID sets the "workflow" edge to the Workflow entity by id.
-func (m *IntegrationAttachmentMutation) SetWorkflowID(id uuid.UUID) {
-	m.workflow = &id
+// SetOrganizationID sets the "organization" edge to the Organization entity by id.
+func (m *IntegrationMutation) SetOrganizationID(id uuid.UUID) {
+	m.organization = &id
 }
 
-// ClearWorkflow clears the "workflow" edge to the Workflow entity.
-func (m *IntegrationAttachmentMutation) ClearWorkflow() {
-	m.clearedworkflow = true
+// ClearOrganization clears the "organization" edge to the Organization entity.
+func (m *IntegrationMutation) ClearOrganization() {
+	m.clearedorganization = true
 }
 
-// WorkflowCleared reports if the "workflow" edge to the Workflow entity was cleared.
-func (m *IntegrationAttachmentMutation) WorkflowCleared() bool {
-	return m.clearedworkflow
+// OrganizationCleared reports if the "organization" edge to the Organization entity was cleared.
+func (m *IntegrationMutation) OrganizationCleared() bool {
+	return m.clearedorganization
 }
 
-// WorkflowID returns the "workflow" edge ID in the mutation.
-func (m *IntegrationAttachmentMutation) WorkflowID() (id uuid.UUID, exists bool) {
-	if m.workflow != nil {
-		return *m.workflow, true
+// OrganizationID returns the "organization" edge ID in the mutation.
+func (m *IntegrationMutation) OrganizationID() (id uuid.UUID, exists bool) {
+	if m.organization != nil {
+		return *m.organization, true
 	}
 	return
 }
 
-// WorkflowIDs returns the "workflow" edge IDs in the mutation.
+// OrganizationIDs returns the "organization" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
-// WorkflowID instead. It exists only for internal usage by the builders.
-func (m *IntegrationAttachmentMutation) WorkflowIDs() (ids []uuid.UUID) {
-	if id := m.workflow; id != nil {
+// OrganizationID instead. It exists only for internal usage by the builders.
+func (m *IntegrationMutation) OrganizationIDs() (ids []uuid.UUID) {
+	if id := m.organization; id != nil {
 		ids = append(ids, *id)
 	}
 	return
 }
 
-// ResetWorkflow resets all changes to the "workflow" edge.
-func (m *IntegrationAttachmentMutation) ResetWorkflow() {
-	m.workflow = nil
-	m.clearedworkflow = false
+// ResetOrganization resets all changes to the "organization" edge.
+func (m *IntegrationMutation) ResetOrganization() {
+	m.organization = nil
+	m.clearedorganization = false
 }
 
-// Where appends a list predicates to the IntegrationAttachmentMutation builder.
-func (m *IntegrationAttachmentMutation) Where(ps ...predicate.IntegrationAttachment) {
+// Where appends a list predicates to the IntegrationMutation builder.
+func (m *IntegrationMutation) Where(ps ...predicate.Integration) {
 	m.predicates = append(m.predicates, ps...)
 }
 
-// WhereP appends storage-level predicates to the IntegrationAttachmentMutation builder. Using this method,
+// WhereP appends storage-level predicates to the IntegrationMutation builder. Using this method,
 // users can use type-assertion to append predicates that do not depend on any generated package.
-func (m *IntegrationAttachmentMutation) WhereP(ps ...func(*sql.Selector)) {
-	p := make([]predicate.IntegrationAttachment, len(ps))
+func (m *IntegrationMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.Integration, len(ps))
 	for i := range ps {
 		p[i] = ps[i]
 	}
@@ -1215,33 +1264,42 @@ func (m *IntegrationAttachmentMutation) WhereP(ps ...func(*sql.Selector)) {
 }
 
 // Op returns the operation name.
-func (m *IntegrationAttachmentMutation) Op() Op {
+func (m *IntegrationMutation) Op() Op {
 	return m.op
 }
 
 // SetOp allows setting the mutation operation.
-func (m *IntegrationAttachmentMutation) SetOp(op Op) {
+func (m *IntegrationMutation) SetOp(op Op) {
 	m.op = op
 }
 
-// Type returns the node type of this mutation (IntegrationAttachment).
-func (m *IntegrationAttachmentMutation) Type() string {
+// Type returns the node type of this mutation (Integration).
+func (m *IntegrationMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *IntegrationAttachmentMutation) Fields() []string {
-	fields := make([]string, 0, 3)
+func (m *IntegrationMutation) Fields() []string {
+	fields := make([]string, 0, 6)
+	if m.kind != nil {
+		fields = append(fields, integration.FieldKind)
+	}
+	if m.description != nil {
+		fields = append(fields, integration.FieldDescription)
+	}
+	if m.secret_name != nil {
+		fields = append(fields, integration.FieldSecretName)
+	}
 	if m.created_at != nil {
-		fields = append(fields, integrationattachment.FieldCreatedAt)
+		fields = append(fields, integration.FieldCreatedAt)
 	}
 	if m.configuration != nil {
-		fields = append(fields, integrationattachment.FieldConfiguration)
+		fields = append(fields, integration.FieldConfiguration)
 	}
 	if m.deleted_at != nil {
-		fields = append(fields, integrationattachment.FieldDeletedAt)
+		fields = append(fields, integration.FieldDeletedAt)
 	}
 	return fields
 }
@@ -1249,13 +1307,19 @@ func (m *IntegrationAttachmentMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *IntegrationAttachmentMutation) Field(name string) (ent.Value, bool) {
+func (m *IntegrationMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case integrationattachment.FieldCreatedAt:
+	case integration.FieldKind:
+		return m.Kind()
+	case integration.FieldDescription:
+		return m.Description()
+	case integration.FieldSecretName:
+		return m.SecretName()
+	case integration.FieldCreatedAt:
 		return m.CreatedAt()
-	case integrationattachment.FieldConfiguration:
+	case integration.FieldConfiguration:
 		return m.Configuration()
-	case integrationattachment.FieldDeletedAt:
+	case integration.FieldDeletedAt:
 		return m.DeletedAt()
 	}
 	return nil, false
@@ -1264,38 +1328,65 @@ func (m *IntegrationAttachmentMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *IntegrationAttachmentMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *IntegrationMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case integrationattachment.FieldCreatedAt:
+	case integration.FieldKind:
+		return m.OldKind(ctx)
+	case integration.FieldDescription:
+		return m.OldDescription(ctx)
+	case integration.FieldSecretName:
+		return m.OldSecretName(ctx)
+	case integration.FieldCreatedAt:
 		return m.OldCreatedAt(ctx)
-	case integrationattachment.FieldConfiguration:
+	case integration.FieldConfiguration:
 		return m.OldConfiguration(ctx)
-	case integrationattachment.FieldDeletedAt:
+	case integration.FieldDeletedAt:
 		return m.OldDeletedAt(ctx)
 	}
-	return nil, fmt.Errorf("unknown IntegrationAttachment field %s", name)
+	return nil, fmt.Errorf("unknown Integration field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *IntegrationAttachmentMutation) SetField(name string, value ent.Value) error {
+func (m *IntegrationMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case integrationattachment.FieldCreatedAt:
+	case integration.FieldKind:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetKind(v)
+		return nil
+	case integration.FieldDescription:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetDescription(v)
+		return nil
+	case integration.FieldSecretName:
+		v, ok := value.(string)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetSecretName(v)
+		return nil
+	case integration.FieldCreatedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetCreatedAt(v)
 		return nil
-	case integrationattachment.FieldConfiguration:
+	case integration.FieldConfiguration:
 		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetConfiguration(v)
 		return nil
-	case integrationattachment.FieldDeletedAt:
+	case integration.FieldDeletedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
@@ -1303,104 +1394,121 @@ func (m *IntegrationAttachmentMutation) SetField(name string, value ent.Value) e
 		m.SetDeletedAt(v)
 		return nil
 	}
-	return fmt.Errorf("unknown IntegrationAttachment field %s", name)
+	return fmt.Errorf("unknown Integration field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *IntegrationAttachmentMutation) AddedFields() []string {
+func (m *IntegrationMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *IntegrationAttachmentMutation) AddedField(name string) (ent.Value, bool) {
+func (m *IntegrationMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *IntegrationAttachmentMutation) AddField(name string, value ent.Value) error {
+func (m *IntegrationMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown IntegrationAttachment numeric field %s", name)
+	return fmt.Errorf("unknown Integration numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *IntegrationAttachmentMutation) ClearedFields() []string {
+func (m *IntegrationMutation) ClearedFields() []string {
 	var fields []string
-	if m.FieldCleared(integrationattachment.FieldConfiguration) {
-		fields = append(fields, integrationattachment.FieldConfiguration)
+	if m.FieldCleared(integration.FieldDescription) {
+		fields = append(fields, integration.FieldDescription)
 	}
-	if m.FieldCleared(integrationattachment.FieldDeletedAt) {
-		fields = append(fields, integrationattachment.FieldDeletedAt)
+	if m.FieldCleared(integration.FieldConfiguration) {
+		fields = append(fields, integration.FieldConfiguration)
+	}
+	if m.FieldCleared(integration.FieldDeletedAt) {
+		fields = append(fields, integration.FieldDeletedAt)
 	}
 	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *IntegrationAttachmentMutation) FieldCleared(name string) bool {
+func (m *IntegrationMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *IntegrationAttachmentMutation) ClearField(name string) error {
+func (m *IntegrationMutation) ClearField(name string) error {
 	switch name {
-	case integrationattachment.FieldConfiguration:
+	case integration.FieldDescription:
+		m.ClearDescription()
+		return nil
+	case integration.FieldConfiguration:
 		m.ClearConfiguration()
 		return nil
-	case integrationattachment.FieldDeletedAt:
+	case integration.FieldDeletedAt:
 		m.ClearDeletedAt()
 		return nil
 	}
-	return fmt.Errorf("unknown IntegrationAttachment nullable field %s", name)
+	return fmt.Errorf("unknown Integration nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *IntegrationAttachmentMutation) ResetField(name string) error {
+func (m *IntegrationMutation) ResetField(name string) error {
 	switch name {
-	case integrationattachment.FieldCreatedAt:
+	case integration.FieldKind:
+		m.ResetKind()
+		return nil
+	case integration.FieldDescription:
+		m.ResetDescription()
+		return nil
+	case integration.FieldSecretName:
+		m.ResetSecretName()
+		return nil
+	case integration.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case integrationattachment.FieldConfiguration:
+	case integration.FieldConfiguration:
 		m.ResetConfiguration()
 		return nil
-	case integrationattachment.FieldDeletedAt:
+	case integration.FieldDeletedAt:
 		m.ResetDeletedAt()
 		return nil
 	}
-	return fmt.Errorf("unknown IntegrationAttachment field %s", name)
+	return fmt.Errorf("unknown Integration field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *IntegrationAttachmentMutation) AddedEdges() []string {
+func (m *IntegrationMutation) AddedEdges() []string {
 	edges := make([]string, 0, 2)
-	if m.integration != nil {
-		edges = append(edges, integrationattachment.EdgeIntegration)
+	if m.attachments != nil {
+		edges = append(edges, integration.EdgeAttachments)
 	}
-	if m.workflow != nil {
-		edges = append(edges, integrationattachment.EdgeWorkflow)
+	if m.organization != nil {
+		edges = append(edges, integration.EdgeOrganization)
 	}
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *IntegrationAttachmentMutation) AddedIDs(name string) []ent.Value {
+func (m *IntegrationMutation) AddedIDs(name string) []ent.Value {
 	switch name {
-	case integrationattachment.EdgeIntegration:
-		if id := m.integration; id != nil {
-			return []ent.Value{*id}
+	case integration.EdgeAttachments:
+		ids := make([]ent.Value, 0, len(m.attachments))
+		for id := range m.attachments {
+			ids = append(ids, id)
 		}
-	case integrationattachment.EdgeWorkflow:
-		if id := m.workflow; id != nil {
+		return ids
+	case integration.EdgeOrganization:
+		if id := m.organization; id != nil {
 			return []ent.Value{*id}
 		}
 	}
@@ -1408,99 +1516,107 @@ func (m *IntegrationAttachmentMutation) AddedIDs(name string) []ent.Value {
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *IntegrationAttachmentMutation) RemovedEdges() []string {
+func (m *IntegrationMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 2)
+	if m.removedattachments != nil {
+		edges = append(edges, integration.EdgeAttachments)
+	}
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *IntegrationAttachmentMutation) RemovedIDs(name string) []ent.Value {
+func (m *IntegrationMutation) RemovedIDs(name string) []ent.Value {
+	switch name {
+	case integration.EdgeAttachments:
+		ids := make([]ent.Value, 0, len(m.removedattachments))
+		for id := range m.removedattachments {
+			ids = append(ids, id)
+		}
+		return ids
+	}
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *IntegrationAttachmentMutation) ClearedEdges() []string {
+func (m *IntegrationMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 2)
-	if m.clearedintegration {
-		edges = append(edges, integrationattachment.EdgeIntegration)
+	if m.clearedattachments {
+		edges = append(edges, integration.EdgeAttachments)
 	}
-	if m.clearedworkflow {
-		edges = append(edges, integrationattachment.EdgeWorkflow)
+	if m.clearedorganization {
+		edges = append(edges, integration.EdgeOrganization)
 	}
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *IntegrationAttachmentMutation) EdgeCleared(name string) bool {
+func (m *IntegrationMutation) EdgeCleared(name string) bool {
 	switch name {
-	case integrationattachment.EdgeIntegration:
-		return m.clearedintegration
-	case integrationattachment.EdgeWorkflow:
-		return m.clearedworkflow
+	case integration.EdgeAttachments:
+		return m.clearedattachments
+	case integration.EdgeOrganization:
+		return m.clearedorganization
 	}
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *IntegrationAttachmentMutation) ClearEdge(name string) error {
+func (m *IntegrationMutation) ClearEdge(name string) error {
 	switch name {
-	case integrationattachment.EdgeIntegration:
-		m.ClearIntegration()
-		return nil
-	case integrationattachment.EdgeWorkflow:
-		m.ClearWorkflow()
+	case integration.EdgeOrganization:
+		m.ClearOrganization()
 		return nil
 	}
-	return fmt.Errorf("unknown IntegrationAttachment unique edge %s", name)
+	return fmt.Errorf("unknown Integration unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *IntegrationAttachmentMutation) ResetEdge(name string) error {
+func (m *IntegrationMutation) ResetEdge(name string) error {
 	switch name {
-	case integrationattachment.EdgeIntegration:
-		m.ResetIntegration()
+	case integration.EdgeAttachments:
+		m.ResetAttachments()
 		return nil
-	case integrationattachment.EdgeWorkflow:
-		m.ResetWorkflow()
+	case integration.EdgeOrganization:
+		m.ResetOrganization()
 		return nil
 	}
-	return fmt.Errorf("unknown IntegrationAttachment edge %s", name)
+	return fmt.Errorf("unknown Integration edge %s", name)
 }
 
-// MembershipMutation represents an operation that mutates the Membership nodes in the graph.
-type MembershipMutation struct {
+// IntegrationAttachmentMutation represents an operation that mutates the IntegrationAttachment nodes in the graph.
+type IntegrationAttachmentMutation struct {
 	config
-	op                  Op
-	typ                 string
-	id                  *uuid.UUID
-	current             *bool
-	created_at          *time.Time
-	updated_at          *time.Time
-	clearedFields       map[string]struct{}
-	organization        *uuid.UUID
-	clearedorganization bool
-	user                *uuid.UUID
-	cleareduser         bool
-	done                bool
-	oldValue            func(context.Context) (*Membership, error)
-	predicates          []predicate.Membership
+	op                 Op
+	typ                string
+	id                 *uuid.UUID
+	created_at         *time.Time
+	configuration      *[]byte
+	deleted_at         *time.Time
+	clearedFields      map[string]struct{}
+	integration        *uuid.UUID
+	clearedintegration bool
+	workflow           *uuid.UUID
+	clearedworkflow    bool
+	done               bool
+	oldValue           func(context.Context) (*IntegrationAttachment, error)
+	predicates         []predicate.IntegrationAttachment
 }
 
-var _ ent.Mutation = (*MembershipMutation)(nil)
+var _ ent.Mutation = (*IntegrationAttachmentMutation)(nil)
 
-// membershipOption allows management of the mutation configuration using functional options.
-type membershipOption func(*MembershipMutation)
+// integrationattachmentOption allows management of the mutation configuration using functional options.
+type integrationattachmentOption func(*IntegrationAttachmentMutation)
 
-// newMembershipMutation creates new mutation for the Membership entity.
-func newMembershipMutation(c config, op Op, opts ...membershipOption) *MembershipMutation {
-	m := &MembershipMutation{
+// newIntegrationAttachmentMutation creates new mutation for the IntegrationAttachment entity.
+func newIntegrationAttachmentMutation(c config, op Op, opts ...integrationattachmentOption) *IntegrationAttachmentMutation {
+	m := &IntegrationAttachmentMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeMembership,
+		typ:           TypeIntegrationAttachment,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -1509,20 +1625,20 @@ func newMembershipMutation(c config, op Op, opts ...membershipOption) *Membershi
 	return m
 }
 
-// withMembershipID sets the ID field of the mutation.
-func withMembershipID(id uuid.UUID) membershipOption {
-	return func(m *MembershipMutation) {
+// withIntegrationAttachmentID sets the ID field of the mutation.
+func withIntegrationAttachmentID(id uuid.UUID) integrationattachmentOption {
+	return func(m *IntegrationAttachmentMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *Membership
+			value *IntegrationAttachment
 		)
-		m.oldValue = func(ctx context.Context) (*Membership, error) {
+		m.oldValue = func(ctx context.Context) (*IntegrationAttachment, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().Membership.Get(ctx, id)
+					value, err = m.Client().IntegrationAttachment.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -1531,10 +1647,10 @@ func withMembershipID(id uuid.UUID) membershipOption {
 	}
 }
 
-// withMembership sets the old Membership of the mutation.
-func withMembership(node *Membership) membershipOption {
-	return func(m *MembershipMutation) {
-		m.oldValue = func(context.Context) (*Membership, error) {
+// withIntegrationAttachment sets the old IntegrationAttachment of the mutation.
+func withIntegrationAttachment(node *IntegrationAttachment) integrationattachmentOption {
+	return func(m *IntegrationAttachmentMutation) {
+		m.oldValue = func(context.Context) (*IntegrationAttachment, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -1543,7 +1659,7 @@ func withMembership(node *Membership) membershipOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m MembershipMutation) Client() *Client {
+func (m IntegrationAttachmentMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -1551,7 +1667,7 @@ func (m MembershipMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m MembershipMutation) Tx() (*Tx, error) {
+func (m IntegrationAttachmentMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("ent: mutation is not running in a transaction")
 	}
@@ -1561,14 +1677,14 @@ func (m MembershipMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of Membership entities.
-func (m *MembershipMutation) SetID(id uuid.UUID) {
+// operation is only accepted on creation of IntegrationAttachment entities.
+func (m *IntegrationAttachmentMutation) SetID(id uuid.UUID) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *MembershipMutation) ID() (id uuid.UUID, exists bool) {
+func (m *IntegrationAttachmentMutation) ID() (id uuid.UUID, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -1579,7 +1695,7 @@ func (m *MembershipMutation) ID() (id uuid.UUID, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *MembershipMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
+func (m *IntegrationAttachmentMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -1588,207 +1704,233 @@ func (m *MembershipMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().Membership.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().IntegrationAttachment.Query().Where(m.predicates...).IDs(ctx)
 	default:
 		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
 }
 
-// SetCurrent sets the "current" field.
-func (m *MembershipMutation) SetCurrent(b bool) {
-	m.current = &b
+// SetCreatedAt sets the "created_at" field.
+func (m *IntegrationAttachmentMutation) SetCreatedAt(t time.Time) {
+	m.created_at = &t
 }
 
-// Current returns the value of the "current" field in the mutation.
-func (m *MembershipMutation) Current() (r bool, exists bool) {
-	v := m.current
+// CreatedAt returns the value of the "created_at" field in the mutation.
+func (m *IntegrationAttachmentMutation) CreatedAt() (r time.Time, exists bool) {
+	v := m.created_at
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldCurrent returns the old "current" field's value of the Membership entity.
-// If the Membership object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the IntegrationAttachment entity.
+// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *MembershipMutation) OldCurrent(ctx context.Context) (v bool, err error) {
+func (m *IntegrationAttachmentMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCurrent is only allowed on UpdateOne operations")
+		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCurrent requires an ID field in the mutation")
+		return v, errors.New("OldCreatedAt requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCurrent: %w", err)
+		return v, fmt.Errorf("querying old value for OldCreatedAt: %w", err)
 	}
-	return oldValue.Current, nil
+	return oldValue.CreatedAt, nil
 }
 
-// ResetCurrent resets all changes to the "current" field.
-func (m *MembershipMutation) ResetCurrent() {
-	m.current = nil
+// ResetCreatedAt resets all changes to the "created_at" field.
+func (m *IntegrationAttachmentMutation) ResetCreatedAt() {
+	m.created_at = nil
 }
 
-// SetCreatedAt sets the "created_at" field.
-func (m *MembershipMutation) SetCreatedAt(t time.Time) {
-	m.created_at = &t
+// SetConfiguration sets the "configuration" field.
+func (m *IntegrationAttachmentMutation) SetConfiguration(b []byte) {
+	m.configuration = &b
 }
 
-// CreatedAt returns the value of the "created_at" field in the mutation.
-func (m *MembershipMutation) CreatedAt() (r time.Time, exists bool) {
-	v := m.created_at
+// Configuration returns the value of the "configuration" field in the mutation.
+func (m *IntegrationAttachmentMutation) Configuration() (r []byte, exists bool) {
+	v := m.configuration
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldCreatedAt returns the old "created_at" field's value of the Membership entity.
-// If the Membership object wasn't provided to the builder, the object is fetched from the database.
+// OldConfiguration returns the old "configuration" field's value of the IntegrationAttachment entity.
+// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *MembershipMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *IntegrationAttachmentMutation) OldConfiguration(ctx context.Context) (v []byte, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
+		return v, errors.New("OldConfiguration is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCreatedAt requires an ID field in the mutation")
+		return v, errors.New("OldConfiguration requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCreatedAt: %w", err)
+		return v, fmt.Errorf("querying old value for OldConfiguration: %w", err)
 	}
-	return oldValue.CreatedAt, nil
+	return oldValue.Configuration, nil
 }
 
-// ResetCreatedAt resets all changes to the "created_at" field.
-func (m *MembershipMutation) ResetCreatedAt() {
-	m.created_at = nil
+// ClearConfiguration clears the value of the "configuration" field.
+func (m *IntegrationAttachmentMutation) ClearConfiguration() {
+	m.configuration = nil
+	m.clearedFields[integrationattachment.FieldConfiguration] = struct{}{}
 }
 
-// SetUpdatedAt sets the "updated_at" field.
-func (m *MembershipMutation) SetUpdatedAt(t time.Time) {
-	m.updated_at = &t
+// ConfigurationCleared returns if the "configuration" field was cleared in this mutation.
+func (m *IntegrationAttachmentMutation) ConfigurationCleared() bool {
+	_, ok := m.clearedFields[integrationattachment.FieldConfiguration]
+	return ok
 }
 
-// UpdatedAt returns the value of the "updated_at" field in the mutation.
-func (m *MembershipMutation) UpdatedAt() (r time.Time, exists bool) {
-	v := m.updated_at
+// ResetConfiguration resets all changes to the "configuration" field.
+func (m *IntegrationAttachmentMutation) ResetConfiguration() {
+	m.configuration = nil
+	delete(m.clearedFields, integrationattachment.FieldConfiguration)
+}
+
+// SetDeletedAt sets the "deleted_at" field.
+func (m *IntegrationAttachmentMutation) SetDeletedAt(t time.Time) {
+	m.deleted_at = &t
+}
+
+// DeletedAt returns the value of the "deleted_at" field in the mutation.
+func (m *IntegrationAttachmentMutation) DeletedAt() (r time.Time, exists bool) {
+	v := m.deleted_at
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldUpdatedAt returns the old "updated_at" field's value of the Membership entity.
-// If the Membership object wasn't provided to the builder, the object is fetched from the database.
+// OldDeletedAt returns the old "deleted_at" field's value of the IntegrationAttachment entity.
+// If the IntegrationAttachment object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *MembershipMutation) OldUpdatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *IntegrationAttachmentMutation) OldDeletedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldUpdatedAt is only allowed on UpdateOne operations")
+		return v, errors.New("OldDeletedAt is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldUpdatedAt requires an ID field in the mutation")
+		return v, errors.New("OldDeletedAt requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldUpdatedAt: %w", err)
+		return v, fmt.Errorf("querying old value for OldDeletedAt: %w", err)
 	}
-	return oldValue.UpdatedAt, nil
+	return oldValue.DeletedAt, nil
 }
 
-// ResetUpdatedAt resets all changes to the "updated_at" field.
-func (m *MembershipMutation) ResetUpdatedAt() {
-	m.updated_at = nil
+// ClearDeletedAt clears the value of the "deleted_at" field.
+func (m *IntegrationAttachmentMutation) ClearDeletedAt() {
+	m.deleted_at = nil
+	m.clearedFields[integrationattachment.FieldDeletedAt] = struct{}{}
 }
 
-// SetOrganizationID sets the "organization" edge to the Organization entity by id.
-func (m *MembershipMutation) SetOrganizationID(id uuid.UUID) {
-	m.organization = &id
+// DeletedAtCleared returns if the "deleted_at" field was cleared in this mutation.
+func (m *IntegrationAttachmentMutation) DeletedAtCleared() bool {
+	_, ok := m.clearedFields[integrationattachment.FieldDeletedAt]
+	return ok
 }
 
-// ClearOrganization clears the "organization" edge to the Organization entity.
-func (m *MembershipMutation) ClearOrganization() {
-	m.clearedorganization = true
+// ResetDeletedAt resets all changes to the "deleted_at" field.
+func (m *IntegrationAttachmentMutation) ResetDeletedAt() {
+	m.deleted_at = nil
+	delete(m.clearedFields, integrationattachment.FieldDeletedAt)
 }
 
-// OrganizationCleared reports if the "organization" edge to the Organization entity was cleared.
-func (m *MembershipMutation) OrganizationCleared() bool {
-	return m.clearedorganization
+// SetIntegrationID sets the "integration" edge to the Integration entity by id.
+func (m *IntegrationAttachmentMutation) SetIntegrationID(id uuid.UUID) {
+	m.integration = &id
 }
 
-// OrganizationID returns the "organization" edge ID in the mutation.
-func (m *MembershipMutation) OrganizationID() (id uuid.UUID, exists bool) {
-	if m.organization != nil {
-		return *m.organization, true
+// ClearIntegration clears the "integration" edge to the Integration entity.
+func (m *IntegrationAttachmentMutation) ClearIntegration() {
+	m.clearedintegration = true
+}
+
+// IntegrationCleared reports if the "integration" edge to the Integration entity was cleared.
+func (m *IntegrationAttachmentMutation) IntegrationCleared() bool {
+	return m.clearedintegration
+}
+
+// IntegrationID returns the "integration" edge ID in the mutation.
+func (m *IntegrationAttachmentMutation) IntegrationID() (id uuid.UUID, exists bool) {
+	if m.integration != nil {
+		return *m.integration, true
 	}
 	return
 }
 
-// OrganizationIDs returns the "organization" edge IDs in the mutation.
+// IntegrationIDs returns the "integration" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
-// OrganizationID instead. It exists only for internal usage by the builders.
-func (m *MembershipMutation) OrganizationIDs() (ids []uuid.UUID) {
-	if id := m.organization; id != nil {
+// IntegrationID instead. It exists only for internal usage by the builders.
+func (m *IntegrationAttachmentMutation) IntegrationIDs() (ids []uuid.UUID) {
+	if id := m.integration; id != nil {
 		ids = append(ids, *id)
 	}
 	return
 }
 
-// ResetOrganization resets all changes to the "organization" edge.
-func (m *MembershipMutation) ResetOrganization() {
-	m.organization = nil
-	m.clearedorganization = false
+// ResetIntegration resets all changes to the "integration" edge.
+func (m *IntegrationAttachmentMutation) ResetIntegration() {
+	m.integration = nil
+	m.clearedintegration = false
 }
 
-// SetUserID sets the "user" edge to the User entity by id.
-func (m *MembershipMutation) SetUserID(id uuid.UUID) {
-	m.user = &id
+// SetWorkflowID sets the "workflow" edge to the Workflow entity by id.
+func (m *IntegrationAttachmentMutation) SetWorkflowID(id uuid.UUID) {
+	m.workflow = &id
 }
 
-// ClearUser clears the "user" edge to the User entity.
-func (m *MembershipMutation) ClearUser() {
-	m.cleareduser = true
+// ClearWorkflow clears the "workflow" edge to the Workflow entity.
+func (m *IntegrationAttachmentMutation) ClearWorkflow() {
+	m.clearedworkflow = true
 }
 
-// UserCleared reports if the "user" edge to the User entity was cleared.
-func (m *MembershipMutation) UserCleared() bool {
-	return m.cleareduser
+// WorkflowCleared reports if the "workflow" edge to the Workflow entity was cleared.
+func (m *IntegrationAttachmentMutation) WorkflowCleared() bool {
+	return m.clearedworkflow
 }
 
-// UserID returns the "user" edge ID in the mutation.
-func (m *MembershipMutation) UserID() (id uuid.UUID, exists bool) {
-	if m.user != nil {
-		return *m.user, true
+// WorkflowID returns the "workflow" edge ID in the mutation.
+func (m *IntegrationAttachmentMutation) WorkflowID() (id uuid.UUID, exists bool) {
+	if m.workflow != nil {
+		return *m.workflow, true
 	}
 	return
 }
 
-// UserIDs returns the "user" edge IDs in the mutation.
+// WorkflowIDs returns the "workflow" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
-// UserID instead. It exists only for internal usage by the builders.
-func (m *MembershipMutation) UserIDs() (ids []uuid.UUID) {
-	if id := m.user; id != nil {
+// WorkflowID instead. It exists only for internal usage by the builders.
+func (m *IntegrationAttachmentMutation) WorkflowIDs() (ids []uuid.UUID) {
+	if id := m.workflow; id != nil {
 		ids = append(ids, *id)
 	}
 	return
 }
 
-// ResetUser resets all changes to the "user" edge.
-func (m *MembershipMutation) ResetUser() {
-	m.user = nil
-	m.cleareduser = false
+// ResetWorkflow resets all changes to the "workflow" edge.
+func (m *IntegrationAttachmentMutation) ResetWorkflow() {
+	m.workflow = nil
+	m.clearedworkflow = false
 }
 
-// Where appends a list predicates to the MembershipMutation builder.
-func (m *MembershipMutation) Where(ps ...predicate.Membership) {
+// Where appends a list predicates to the IntegrationAttachmentMutation builder.
+func (m *IntegrationAttachmentMutation) Where(ps ...predicate.IntegrationAttachment) {
 	m.predicates = append(m.predicates, ps...)
 }
 
-// WhereP appends storage-level predicates to the MembershipMutation builder. Using this method,
+// WhereP appends storage-level predicates to the IntegrationAttachmentMutation builder. Using this method,
 // users can use type-assertion to append predicates that do not depend on any generated package.
-func (m *MembershipMutation) WhereP(ps ...func(*sql.Selector)) {
-	p := make([]predicate.Membership, len(ps))
+func (m *IntegrationAttachmentMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.IntegrationAttachment, len(ps))
 	for i := range ps {
 		p[i] = ps[i]
 	}
@@ -1796,33 +1938,33 @@ func (m *MembershipMutation) WhereP(ps ...func(*sql.Selector)) {
 }
 
 // Op returns the operation name.
-func (m *MembershipMutation) Op() Op {
+func (m *IntegrationAttachmentMutation) Op() Op {
 	return m.op
 }
 
 // SetOp allows setting the mutation operation.
-func (m *MembershipMutation) SetOp(op Op) {
+func (m *IntegrationAttachmentMutation) SetOp(op Op) {
 	m.op = op
 }
 
-// Type returns the node type of this mutation (Membership).
-func (m *MembershipMutation) Type() string {
+// Type returns the node type of this mutation (IntegrationAttachment).
+func (m *IntegrationAttachmentMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *MembershipMutation) Fields() []string {
+func (m *IntegrationAttachmentMutation) Fields() []string {
 	fields := make([]string, 0, 3)
-	if m.current != nil {
-		fields = append(fields, membership.FieldCurrent)
-	}
 	if m.created_at != nil {
-		fields = append(fields, membership.FieldCreatedAt)
+		fields = append(fields, integrationattachment.FieldCreatedAt)
 	}
-	if m.updated_at != nil {
-		fields = append(fields, membership.FieldUpdatedAt)
+	if m.configuration != nil {
+		fields = append(fields, integrationattachment.FieldConfiguration)
+	}
+	if m.deleted_at != nil {
+		fields = append(fields, integrationattachment.FieldDeletedAt)
 	}
 	return fields
 }
@@ -1830,14 +1972,14 @@ func (m *MembershipMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *MembershipMutation) Field(name string) (ent.Value, bool) {
+func (m *IntegrationAttachmentMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case membership.FieldCurrent:
-		return m.Current()
-	case membership.FieldCreatedAt:
+	case integrationattachment.FieldCreatedAt:
 		return m.CreatedAt()
-	case membership.FieldUpdatedAt:
-		return m.UpdatedAt()
+	case integrationattachment.FieldConfiguration:
+		return m.Configuration()
+	case integrationattachment.FieldDeletedAt:
+		return m.DeletedAt()
 	}
 	return nil, false
 }
@@ -1845,128 +1987,143 @@ func (m *MembershipMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *MembershipMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *IntegrationAttachmentMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case membership.FieldCurrent:
-		return m.OldCurrent(ctx)
-	case membership.FieldCreatedAt:
+	case integrationattachment.FieldCreatedAt:
 		return m.OldCreatedAt(ctx)
-	case membership.FieldUpdatedAt:
-		return m.OldUpdatedAt(ctx)
+	case integrationattachment.FieldConfiguration:
+		return m.OldConfiguration(ctx)
+	case integrationattachment.FieldDeletedAt:
+		return m.OldDeletedAt(ctx)
 	}
-	return nil, fmt.Errorf("unknown Membership field %s", name)
+	return nil, fmt.Errorf("unknown IntegrationAttachment field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *MembershipMutation) SetField(name string, value ent.Value) error {
+func (m *IntegrationAttachmentMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case membership.FieldCurrent:
-		v, ok := value.(bool)
+	case integrationattachment.FieldCreatedAt:
+		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCurrent(v)
+		m.SetCreatedAt(v)
 		return nil
-	case membership.FieldCreatedAt:
-		v, ok := value.(time.Time)
+	case integrationattachment.FieldConfiguration:
+		v, ok := value.([]byte)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetCreatedAt(v)
+		m.SetConfiguration(v)
 		return nil
-	case membership.FieldUpdatedAt:
+	case integrationattachment.FieldDeletedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetUpdatedAt(v)
+		m.SetDeletedAt(v)
 		return nil
 	}
-	return fmt.Errorf("unknown Membership field %s", name)
+	return fmt.Errorf("unknown IntegrationAttachment field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *MembershipMutation) AddedFields() []string {
+func (m *IntegrationAttachmentMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *MembershipMutation) AddedField(name string) (ent.Value, bool) {
+func (m *IntegrationAttachmentMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *MembershipMutation) AddField(name string, value ent.Value) error {
+func (m *IntegrationAttachmentMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown Membership numeric field %s", name)
+	return fmt.Errorf("unknown IntegrationAttachment numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *MembershipMutation) ClearedFields() []string {
-	return nil
+func (m *IntegrationAttachmentMutation) ClearedFields() []string {
+	var fields []string
+	if m.FieldCleared(integrationattachment.FieldConfiguration) {
+		fields = append(fields, integrationattachment.FieldConfiguration)
+	}
+	if m.FieldCleared(integrationattachment.FieldDeletedAt) {
+		fields = append(fields, integrationattachment.FieldDeletedAt)
+	}
+	return fields
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *MembershipMutation) FieldCleared(name string) bool {
+func (m *IntegrationAttachmentMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *MembershipMutation) ClearField(name string) error {
-	return fmt.Errorf("unknown Membership nullable field %s", name)
+func (m *IntegrationAttachmentMutation) ClearField(name string) error {
+	switch name {
+	case integrationattachment.FieldConfiguration:
+		m.ClearConfiguration()
+		return nil
+	case integrationattachment.FieldDeletedAt:
+		m.ClearDeletedAt()
+		return nil
+	}
+	return fmt.Errorf("unknown IntegrationAttachment nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *MembershipMutation) ResetField(name string) error {
+func (m *IntegrationAttachmentMutation) ResetField(name string) error {
 	switch name {
-	case membership.FieldCurrent:
-		m.ResetCurrent()
-		return nil
-	case membership.FieldCreatedAt:
+	case integrationattachment.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case membership.FieldUpdatedAt:
-		m.ResetUpdatedAt()
+	case integrationattachment.FieldConfiguration:
+		m.ResetConfiguration()
+		return nil
+	case integrationattachment.FieldDeletedAt:
+		m.ResetDeletedAt()
 		return nil
 	}
-	return fmt.Errorf("unknown Membership field %s", name)
+	return fmt.Errorf("unknown IntegrationAttachment field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *MembershipMutation) AddedEdges() []string {
+func (m *IntegrationAttachmentMutation) AddedEdges() []string {
 	edges := make([]string, 0, 2)
-	if m.organization != nil {
-		edges = append(edges, membership.EdgeOrganization)
+	if m.integration != nil {
+		edges = append(edges, integrationattachment.EdgeIntegration)
 	}
-	if m.user != nil {
-		edges = append(edges, membership.EdgeUser)
+	if m.workflow != nil {
+		edges = append(edges, integrationattachment.EdgeWorkflow)
 	}
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *MembershipMutation) AddedIDs(name string) []ent.Value {
+func (m *IntegrationAttachmentMutation) AddedIDs(name string) []ent.Value {
 	switch name {
-	case membership.EdgeOrganization:
-		if id := m.organization; id != nil {
+	case integrationattachment.EdgeIntegration:
+		if id := m.integration; id != nil {
 			return []ent.Value{*id}
 		}
-	case membership.EdgeUser:
-		if id := m.user; id != nil {
+	case integrationattachment.EdgeWorkflow:
+		if id := m.workflow; id != nil {
 			return []ent.Value{*id}
 		}
 	}
@@ -1974,99 +2131,99 @@ func (m *MembershipMutation) AddedIDs(name string) []ent.Value {
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *MembershipMutation) RemovedEdges() []string {
+func (m *IntegrationAttachmentMutation) RemovedEdges() []string {
 	edges := make([]string, 0, 2)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *MembershipMutation) RemovedIDs(name string) []ent.Value {
+func (m *IntegrationAttachmentMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *MembershipMutation) ClearedEdges() []string {
+func (m *IntegrationAttachmentMutation) ClearedEdges() []string {
 	edges := make([]string, 0, 2)
-	if m.clearedorganization {
-		edges = append(edges, membership.EdgeOrganization)
+	if m.clearedintegration {
+		edges = append(edges, integrationattachment.EdgeIntegration)
 	}
-	if m.cleareduser {
-		edges = append(edges, membership.EdgeUser)
+	if m.clearedworkflow {
+		edges = append(edges, integrationattachment.EdgeWorkflow)
 	}
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *MembershipMutation) EdgeCleared(name string) bool {
+func (m *IntegrationAttachmentMutation) EdgeCleared(name string) bool {
 	switch name {
-	case membership.EdgeOrganization:
-		return m.clearedorganization
-	case membership.EdgeUser:
-		return m.cleareduser
+	case integrationattachment.EdgeIntegration:
+		return m.clearedintegration
+	case integrationattachment.EdgeWorkflow:
+		return m.clearedworkflow
 	}
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *MembershipMutation) ClearEdge(name string) error {
+func (m *IntegrationAttachmentMutation) ClearEdge(name string) error {
 	switch name {
-	case membership.EdgeOrganization:
-		m.ClearOrganization()
+	case integrationattachment.EdgeIntegration:
+		m.ClearIntegration()
 		return nil
-	case membership.EdgeUser:
-		m.ClearUser()
+	case integrationattachment.EdgeWorkflow:
+		m.ClearWorkflow()
 		return nil
 	}
-	return fmt.Errorf("unknown Membership unique edge %s", name)
+	return fmt.Errorf("unknown IntegrationAttachment unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *MembershipMutation) ResetEdge(name string) error {
+func (m *IntegrationAttachmentMutation) ResetEdge(name string) error {
 	switch name {
-	case membership.EdgeOrganization:
-		m.ResetOrganization()
+	case integrationattachment.EdgeIntegration:
+		m.ResetIntegration()
 		return nil
-	case membership.EdgeUser:
-		m.ResetUser()
+	case integrationattachment.EdgeWorkflow:
+		m.ResetWorkflow()
 		return nil
 	}
-	return fmt.Errorf("unknown Membership edge %s", name)
+	return fmt.Errorf("unknown IntegrationAttachment edge %s", name)
 }
 
-// OCIRepositoryMutation represents an operation that mutates the OCIRepository nodes in the graph.
-type OCIRepositoryMutation struct {
+// MembershipMutation represents an operation that mutates the Membership nodes in the graph.
+type MembershipMutation struct {
 	config
 	op                  Op
 	typ                 string
 	id                  *uuid.UUID
-	repo                *string
-	secret_name         *string
+	current             *bool
 	created_at          *time.Time
-	validation_status   *biz.OCIRepoValidationStatus
-	validated_at        *time.Time
+	updated_at          *time.Time
 	clearedFields       map[string]struct{}
 	organization        *uuid.UUID
 	clearedorganization bool
+	user                *uuid.UUID
+	cleareduser         bool
 	done                bool
-	oldValue            func(context.Context) (*OCIRepository, error)
-	predicates          []predicate.OCIRepository
+	oldValue            func(context.Context) (*Membership, error)
+	predicates          []predicate.Membership
 }
 
-var _ ent.Mutation = (*OCIRepositoryMutation)(nil)
+var _ ent.Mutation = (*MembershipMutation)(nil)
 
-// ocirepositoryOption allows management of the mutation configuration using functional options.
-type ocirepositoryOption func(*OCIRepositoryMutation)
+// membershipOption allows management of the mutation configuration using functional options.
+type membershipOption func(*MembershipMutation)
 
-// newOCIRepositoryMutation creates new mutation for the OCIRepository entity.
-func newOCIRepositoryMutation(c config, op Op, opts ...ocirepositoryOption) *OCIRepositoryMutation {
-	m := &OCIRepositoryMutation{
+// newMembershipMutation creates new mutation for the Membership entity.
+func newMembershipMutation(c config, op Op, opts ...membershipOption) *MembershipMutation {
+	m := &MembershipMutation{
 		config:        c,
 		op:            op,
-		typ:           TypeOCIRepository,
+		typ:           TypeMembership,
 		clearedFields: make(map[string]struct{}),
 	}
 	for _, opt := range opts {
@@ -2075,20 +2232,20 @@ func newOCIRepositoryMutation(c config, op Op, opts ...ocirepositoryOption) *OCI
 	return m
 }
 
-// withOCIRepositoryID sets the ID field of the mutation.
-func withOCIRepositoryID(id uuid.UUID) ocirepositoryOption {
-	return func(m *OCIRepositoryMutation) {
+// withMembershipID sets the ID field of the mutation.
+func withMembershipID(id uuid.UUID) membershipOption {
+	return func(m *MembershipMutation) {
 		var (
 			err   error
 			once  sync.Once
-			value *OCIRepository
+			value *Membership
 		)
-		m.oldValue = func(ctx context.Context) (*OCIRepository, error) {
+		m.oldValue = func(ctx context.Context) (*Membership, error) {
 			once.Do(func() {
 				if m.done {
 					err = errors.New("querying old values post mutation is not allowed")
 				} else {
-					value, err = m.Client().OCIRepository.Get(ctx, id)
+					value, err = m.Client().Membership.Get(ctx, id)
 				}
 			})
 			return value, err
@@ -2097,10 +2254,10 @@ func withOCIRepositoryID(id uuid.UUID) ocirepositoryOption {
 	}
 }
 
-// withOCIRepository sets the old OCIRepository of the mutation.
-func withOCIRepository(node *OCIRepository) ocirepositoryOption {
-	return func(m *OCIRepositoryMutation) {
-		m.oldValue = func(context.Context) (*OCIRepository, error) {
+// withMembership sets the old Membership of the mutation.
+func withMembership(node *Membership) membershipOption {
+	return func(m *MembershipMutation) {
+		m.oldValue = func(context.Context) (*Membership, error) {
 			return node, nil
 		}
 		m.id = &node.ID
@@ -2109,7 +2266,7 @@ func withOCIRepository(node *OCIRepository) ocirepositoryOption {
 
 // Client returns a new `ent.Client` from the mutation. If the mutation was
 // executed in a transaction (ent.Tx), a transactional client is returned.
-func (m OCIRepositoryMutation) Client() *Client {
+func (m MembershipMutation) Client() *Client {
 	client := &Client{config: m.config}
 	client.init()
 	return client
@@ -2117,7 +2274,7 @@ func (m OCIRepositoryMutation) Client() *Client {
 
 // Tx returns an `ent.Tx` for mutations that were executed in transactions;
 // it returns an error otherwise.
-func (m OCIRepositoryMutation) Tx() (*Tx, error) {
+func (m MembershipMutation) Tx() (*Tx, error) {
 	if _, ok := m.driver.(*txDriver); !ok {
 		return nil, errors.New("ent: mutation is not running in a transaction")
 	}
@@ -2127,14 +2284,14 @@ func (m OCIRepositoryMutation) Tx() (*Tx, error) {
 }
 
 // SetID sets the value of the id field. Note that this
-// operation is only accepted on creation of OCIRepository entities.
-func (m *OCIRepositoryMutation) SetID(id uuid.UUID) {
+// operation is only accepted on creation of Membership entities.
+func (m *MembershipMutation) SetID(id uuid.UUID) {
 	m.id = &id
 }
 
 // ID returns the ID value in the mutation. Note that the ID is only available
 // if it was provided to the builder or after it was returned from the database.
-func (m *OCIRepositoryMutation) ID() (id uuid.UUID, exists bool) {
+func (m *MembershipMutation) ID() (id uuid.UUID, exists bool) {
 	if m.id == nil {
 		return
 	}
@@ -2145,7 +2302,7 @@ func (m *OCIRepositoryMutation) ID() (id uuid.UUID, exists bool) {
 // That means, if the mutation is applied within a transaction with an isolation level such
 // as sql.LevelSerializable, the returned ids match the ids of the rows that will be updated
 // or updated by the mutation.
-func (m *OCIRepositoryMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
+func (m *MembershipMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 	switch {
 	case m.op.Is(OpUpdateOne | OpDeleteOne):
 		id, exists := m.ID()
@@ -2154,91 +2311,55 @@ func (m *OCIRepositoryMutation) IDs(ctx context.Context) ([]uuid.UUID, error) {
 		}
 		fallthrough
 	case m.op.Is(OpUpdate | OpDelete):
-		return m.Client().OCIRepository.Query().Where(m.predicates...).IDs(ctx)
+		return m.Client().Membership.Query().Where(m.predicates...).IDs(ctx)
 	default:
-		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
-	}
-}
-
-// SetRepo sets the "repo" field.
-func (m *OCIRepositoryMutation) SetRepo(s string) {
-	m.repo = &s
-}
-
-// Repo returns the value of the "repo" field in the mutation.
-func (m *OCIRepositoryMutation) Repo() (r string, exists bool) {
-	v := m.repo
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldRepo returns the old "repo" field's value of the OCIRepository entity.
-// If the OCIRepository object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OCIRepositoryMutation) OldRepo(ctx context.Context) (v string, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldRepo is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldRepo requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldRepo: %w", err)
+		return nil, fmt.Errorf("IDs is not allowed on %s operations", m.op)
 	}
-	return oldValue.Repo, nil
-}
-
-// ResetRepo resets all changes to the "repo" field.
-func (m *OCIRepositoryMutation) ResetRepo() {
-	m.repo = nil
 }
 
-// SetSecretName sets the "secret_name" field.
-func (m *OCIRepositoryMutation) SetSecretName(s string) {
-	m.secret_name = &s
+// SetCurrent sets the "current" field.
+func (m *MembershipMutation) SetCurrent(b bool) {
+	m.current = &b
 }
 
-// SecretName returns the value of the "secret_name" field in the mutation.
-func (m *OCIRepositoryMutation) SecretName() (r string, exists bool) {
-	v := m.secret_name
+// Current returns the value of the "current" field in the mutation.
+func (m *MembershipMutation) Current() (r bool, exists bool) {
+	v := m.current
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldSecretName returns the old "secret_name" field's value of the OCIRepository entity.
-// If the OCIRepository object wasn't provided to the builder, the object is fetched from the database.
+// OldCurrent returns the old "current" field's value of the Membership entity.
+// If the Membership object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OCIRepositoryMutation) OldSecretName(ctx context.Context) (v string, err error) {
+func (m *MembershipMutation) OldCurrent(ctx context.Context) (v bool, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldSecretName is only allowed on UpdateOne operations")
+		return v, errors.New("OldCurrent is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldSecretName requires an ID field in the mutation")
+		return v, errors.New("OldCurrent requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldSecretName: %w", err)
+		return v, fmt.Errorf("querying old value for OldCurrent: %w", err)
 	}
-	return oldValue.SecretName, nil
+	return oldValue.Current, nil
 }
 
-// ResetSecretName resets all changes to the "secret_name" field.
-func (m *OCIRepositoryMutation) ResetSecretName() {
-	m.secret_name = nil
+// ResetCurrent resets all changes to the "current" field.
+func (m *MembershipMutation) ResetCurrent() {
+	m.current = nil
 }
 
 // SetCreatedAt sets the "created_at" field.
-func (m *OCIRepositoryMutation) SetCreatedAt(t time.Time) {
+func (m *MembershipMutation) SetCreatedAt(t time.Time) {
 	m.created_at = &t
 }
 
 // CreatedAt returns the value of the "created_at" field in the mutation.
-func (m *OCIRepositoryMutation) CreatedAt() (r time.Time, exists bool) {
+func (m *MembershipMutation) CreatedAt() (r time.Time, exists bool) {
 	v := m.created_at
 	if v == nil {
 		return
@@ -2246,10 +2367,10 @@ func (m *OCIRepositoryMutation) CreatedAt() (r time.Time, exists bool) {
 	return *v, true
 }
 
-// OldCreatedAt returns the old "created_at" field's value of the OCIRepository entity.
-// If the OCIRepository object wasn't provided to the builder, the object is fetched from the database.
+// OldCreatedAt returns the old "created_at" field's value of the Membership entity.
+// If the Membership object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OCIRepositoryMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *MembershipMutation) OldCreatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldCreatedAt is only allowed on UpdateOne operations")
 	}
@@ -2264,99 +2385,63 @@ func (m *OCIRepositoryMutation) OldCreatedAt(ctx context.Context) (v time.Time,
 }
 
 // ResetCreatedAt resets all changes to the "created_at" field.
-func (m *OCIRepositoryMutation) ResetCreatedAt() {
+func (m *MembershipMutation) ResetCreatedAt() {
 	m.created_at = nil
 }
 
-// SetValidationStatus sets the "validation_status" field.
-func (m *OCIRepositoryMutation) SetValidationStatus(brvs biz.OCIRepoValidationStatus) {
-	m.validation_status = &brvs
-}
-
-// ValidationStatus returns the value of the "validation_status" field in the mutation.
-func (m *OCIRepositoryMutation) ValidationStatus() (r biz.OCIRepoValidationStatus, exists bool) {
-	v := m.validation_status
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldValidationStatus returns the old "validation_status" field's value of the OCIRepository entity.
-// If the OCIRepository object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OCIRepositoryMutation) OldValidationStatus(ctx context.Context) (v biz.OCIRepoValidationStatus, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldValidationStatus is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldValidationStatus requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldValidationStatus: %w", err)
-	}
-	return oldValue.ValidationStatus, nil
-}
-
-// ResetValidationStatus resets all changes to the "validation_status" field.
-func (m *OCIRepositoryMutation) ResetValidationStatus() {
-	m.validation_status = nil
-}
-
-// SetValidatedAt sets the "validated_at" field.
-func (m *OCIRepositoryMutation) SetValidatedAt(t time.Time) {
-	m.validated_at = &t
+// SetUpdatedAt sets the "updated_at" field.
+func (m *MembershipMutation) SetUpdatedAt(t time.Time) {
+	m.updated_at = &t
 }
 
-// ValidatedAt returns the value of the "validated_at" field in the mutation.
-func (m *OCIRepositoryMutation) ValidatedAt() (r time.Time, exists bool) {
-	v := m.validated_at
+// UpdatedAt returns the value of the "updated_at" field in the mutation.
+func (m *MembershipMutation) UpdatedAt() (r time.Time, exists bool) {
+	v := m.updated_at
 	if v == nil {
 		return
 	}
 	return *v, true
 }
 
-// OldValidatedAt returns the old "validated_at" field's value of the OCIRepository entity.
-// If the OCIRepository object wasn't provided to the builder, the object is fetched from the database.
+// OldUpdatedAt returns the old "updated_at" field's value of the Membership entity.
+// If the Membership object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OCIRepositoryMutation) OldValidatedAt(ctx context.Context) (v time.Time, err error) {
+func (m *MembershipMutation) OldUpdatedAt(ctx context.Context) (v time.Time, err error) {
 	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldValidatedAt is only allowed on UpdateOne operations")
+		return v, errors.New("OldUpdatedAt is only allowed on UpdateOne operations")
 	}
 	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldValidatedAt requires an ID field in the mutation")
+		return v, errors.New("OldUpdatedAt requires an ID field in the mutation")
 	}
 	oldValue, err := m.oldValue(ctx)
 	if err != nil {
-		return v, fmt.Errorf("querying old value for OldValidatedAt: %w", err)
+		return v, fmt.Errorf("querying old value for OldUpdatedAt: %w", err)
 	}
-	return oldValue.ValidatedAt, nil
+	return oldValue.UpdatedAt, nil
 }
 
-// ResetValidatedAt resets all changes to the "validated_at" field.
-func (m *OCIRepositoryMutation) ResetValidatedAt() {
-	m.validated_at = nil
+// ResetUpdatedAt resets all changes to the "updated_at" field.
+func (m *MembershipMutation) ResetUpdatedAt() {
+	m.updated_at = nil
 }
 
 // SetOrganizationID sets the "organization" edge to the Organization entity by id.
-func (m *OCIRepositoryMutation) SetOrganizationID(id uuid.UUID) {
+func (m *MembershipMutation) SetOrganizationID(id uuid.UUID) {
 	m.organization = &id
 }
 
 // ClearOrganization clears the "organization" edge to the Organization entity.
-func (m *OCIRepositoryMutation) ClearOrganization() {
+func (m *MembershipMutation) ClearOrganization() {
 	m.clearedorganization = true
 }
 
 // OrganizationCleared reports if the "organization" edge to the Organization entity was cleared.
-func (m *OCIRepositoryMutation) OrganizationCleared() bool {
+func (m *MembershipMutation) OrganizationCleared() bool {
 	return m.clearedorganization
 }
 
 // OrganizationID returns the "organization" edge ID in the mutation.
-func (m *OCIRepositoryMutation) OrganizationID() (id uuid.UUID, exists bool) {
+func (m *MembershipMutation) OrganizationID() (id uuid.UUID, exists bool) {
 	if m.organization != nil {
 		return *m.organization, true
 	}
@@ -2366,7 +2451,7 @@ func (m *OCIRepositoryMutation) OrganizationID() (id uuid.UUID, exists bool) {
 // OrganizationIDs returns the "organization" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
 // OrganizationID instead. It exists only for internal usage by the builders.
-func (m *OCIRepositoryMutation) OrganizationIDs() (ids []uuid.UUID) {
+func (m *MembershipMutation) OrganizationIDs() (ids []uuid.UUID) {
 	if id := m.organization; id != nil {
 		ids = append(ids, *id)
 	}
@@ -2374,20 +2459,59 @@ func (m *OCIRepositoryMutation) OrganizationIDs() (ids []uuid.UUID) {
 }
 
 // ResetOrganization resets all changes to the "organization" edge.
-func (m *OCIRepositoryMutation) ResetOrganization() {
+func (m *MembershipMutation) ResetOrganization() {
 	m.organization = nil
 	m.clearedorganization = false
 }
 
-// Where appends a list predicates to the OCIRepositoryMutation builder.
-func (m *OCIRepositoryMutation) Where(ps ...predicate.OCIRepository) {
+// SetUserID sets the "user" edge to the User entity by id.
+func (m *MembershipMutation) SetUserID(id uuid.UUID) {
+	m.user = &id
+}
+
+// ClearUser clears the "user" edge to the User entity.
+func (m *MembershipMutation) ClearUser() {
+	m.cleareduser = true
+}
+
+// UserCleared reports if the "user" edge to the User entity was cleared.
+func (m *MembershipMutation) UserCleared() bool {
+	return m.cleareduser
+}
+
+// UserID returns the "user" edge ID in the mutation.
+func (m *MembershipMutation) UserID() (id uuid.UUID, exists bool) {
+	if m.user != nil {
+		return *m.user, true
+	}
+	return
+}
+
+// UserIDs returns the "user" edge IDs in the mutation.
+// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
+// UserID instead. It exists only for internal usage by the builders.
+func (m *MembershipMutation) UserIDs() (ids []uuid.UUID) {
+	if id := m.user; id != nil {
+		ids = append(ids, *id)
+	}
+	return
+}
+
+// ResetUser resets all changes to the "user" edge.
+func (m *MembershipMutation) ResetUser() {
+	m.user = nil
+	m.cleareduser = false
+}
+
+// Where appends a list predicates to the MembershipMutation builder.
+func (m *MembershipMutation) Where(ps ...predicate.Membership) {
 	m.predicates = append(m.predicates, ps...)
 }
 
-// WhereP appends storage-level predicates to the OCIRepositoryMutation builder. Using this method,
+// WhereP appends storage-level predicates to the MembershipMutation builder. Using this method,
 // users can use type-assertion to append predicates that do not depend on any generated package.
-func (m *OCIRepositoryMutation) WhereP(ps ...func(*sql.Selector)) {
-	p := make([]predicate.OCIRepository, len(ps))
+func (m *MembershipMutation) WhereP(ps ...func(*sql.Selector)) {
+	p := make([]predicate.Membership, len(ps))
 	for i := range ps {
 		p[i] = ps[i]
 	}
@@ -2395,39 +2519,33 @@ func (m *OCIRepositoryMutation) WhereP(ps ...func(*sql.Selector)) {
 }
 
 // Op returns the operation name.
-func (m *OCIRepositoryMutation) Op() Op {
+func (m *MembershipMutation) Op() Op {
 	return m.op
 }
 
 // SetOp allows setting the mutation operation.
-func (m *OCIRepositoryMutation) SetOp(op Op) {
+func (m *MembershipMutation) SetOp(op Op) {
 	m.op = op
 }
 
-// Type returns the node type of this mutation (OCIRepository).
-func (m *OCIRepositoryMutation) Type() string {
+// Type returns the node type of this mutation (Membership).
+func (m *MembershipMutation) Type() string {
 	return m.typ
 }
 
 // Fields returns all fields that were changed during this mutation. Note that in
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
-func (m *OCIRepositoryMutation) Fields() []string {
-	fields := make([]string, 0, 5)
-	if m.repo != nil {
-		fields = append(fields, ocirepository.FieldRepo)
-	}
-	if m.secret_name != nil {
-		fields = append(fields, ocirepository.FieldSecretName)
+func (m *MembershipMutation) Fields() []string {
+	fields := make([]string, 0, 3)
+	if m.current != nil {
+		fields = append(fields, membership.FieldCurrent)
 	}
 	if m.created_at != nil {
-		fields = append(fields, ocirepository.FieldCreatedAt)
-	}
-	if m.validation_status != nil {
-		fields = append(fields, ocirepository.FieldValidationStatus)
+		fields = append(fields, membership.FieldCreatedAt)
 	}
-	if m.validated_at != nil {
-		fields = append(fields, ocirepository.FieldValidatedAt)
+	if m.updated_at != nil {
+		fields = append(fields, membership.FieldUpdatedAt)
 	}
 	return fields
 }
@@ -2435,18 +2553,14 @@ func (m *OCIRepositoryMutation) Fields() []string {
 // Field returns the value of a field with the given name. The second boolean
 // return value indicates that this field was not set, or was not defined in the
 // schema.
-func (m *OCIRepositoryMutation) Field(name string) (ent.Value, bool) {
+func (m *MembershipMutation) Field(name string) (ent.Value, bool) {
 	switch name {
-	case ocirepository.FieldRepo:
-		return m.Repo()
-	case ocirepository.FieldSecretName:
-		return m.SecretName()
-	case ocirepository.FieldCreatedAt:
+	case membership.FieldCurrent:
+		return m.Current()
+	case membership.FieldCreatedAt:
 		return m.CreatedAt()
-	case ocirepository.FieldValidationStatus:
-		return m.ValidationStatus()
-	case ocirepository.FieldValidatedAt:
-		return m.ValidatedAt()
+	case membership.FieldUpdatedAt:
+		return m.UpdatedAt()
 	}
 	return nil, false
 }
@@ -2454,202 +2568,196 @@ func (m *OCIRepositoryMutation) Field(name string) (ent.Value, bool) {
 // OldField returns the old value of the field from the database. An error is
 // returned if the mutation operation is not UpdateOne, or the query to the
 // database failed.
-func (m *OCIRepositoryMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
+func (m *MembershipMutation) OldField(ctx context.Context, name string) (ent.Value, error) {
 	switch name {
-	case ocirepository.FieldRepo:
-		return m.OldRepo(ctx)
-	case ocirepository.FieldSecretName:
-		return m.OldSecretName(ctx)
-	case ocirepository.FieldCreatedAt:
+	case membership.FieldCurrent:
+		return m.OldCurrent(ctx)
+	case membership.FieldCreatedAt:
 		return m.OldCreatedAt(ctx)
-	case ocirepository.FieldValidationStatus:
-		return m.OldValidationStatus(ctx)
-	case ocirepository.FieldValidatedAt:
-		return m.OldValidatedAt(ctx)
+	case membership.FieldUpdatedAt:
+		return m.OldUpdatedAt(ctx)
 	}
-	return nil, fmt.Errorf("unknown OCIRepository field %s", name)
+	return nil, fmt.Errorf("unknown Membership field %s", name)
 }
 
 // SetField sets the value of a field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *OCIRepositoryMutation) SetField(name string, value ent.Value) error {
+func (m *MembershipMutation) SetField(name string, value ent.Value) error {
 	switch name {
-	case ocirepository.FieldRepo:
-		v, ok := value.(string)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetRepo(v)
-		return nil
-	case ocirepository.FieldSecretName:
-		v, ok := value.(string)
+	case membership.FieldCurrent:
+		v, ok := value.(bool)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetSecretName(v)
+		m.SetCurrent(v)
 		return nil
-	case ocirepository.FieldCreatedAt:
+	case membership.FieldCreatedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetCreatedAt(v)
 		return nil
-	case ocirepository.FieldValidationStatus:
-		v, ok := value.(biz.OCIRepoValidationStatus)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetValidationStatus(v)
-		return nil
-	case ocirepository.FieldValidatedAt:
+	case membership.FieldUpdatedAt:
 		v, ok := value.(time.Time)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
-		m.SetValidatedAt(v)
+		m.SetUpdatedAt(v)
 		return nil
 	}
-	return fmt.Errorf("unknown OCIRepository field %s", name)
+	return fmt.Errorf("unknown Membership field %s", name)
 }
 
 // AddedFields returns all numeric fields that were incremented/decremented during
 // this mutation.
-func (m *OCIRepositoryMutation) AddedFields() []string {
+func (m *MembershipMutation) AddedFields() []string {
 	return nil
 }
 
 // AddedField returns the numeric value that was incremented/decremented on a field
 // with the given name. The second boolean return value indicates that this field
 // was not set, or was not defined in the schema.
-func (m *OCIRepositoryMutation) AddedField(name string) (ent.Value, bool) {
+func (m *MembershipMutation) AddedField(name string) (ent.Value, bool) {
 	return nil, false
 }
 
 // AddField adds the value to the field with the given name. It returns an error if
 // the field is not defined in the schema, or if the type mismatched the field
 // type.
-func (m *OCIRepositoryMutation) AddField(name string, value ent.Value) error {
+func (m *MembershipMutation) AddField(name string, value ent.Value) error {
 	switch name {
 	}
-	return fmt.Errorf("unknown OCIRepository numeric field %s", name)
+	return fmt.Errorf("unknown Membership numeric field %s", name)
 }
 
 // ClearedFields returns all nullable fields that were cleared during this
 // mutation.
-func (m *OCIRepositoryMutation) ClearedFields() []string {
+func (m *MembershipMutation) ClearedFields() []string {
 	return nil
 }
 
 // FieldCleared returns a boolean indicating if a field with the given name was
 // cleared in this mutation.
-func (m *OCIRepositoryMutation) FieldCleared(name string) bool {
+func (m *MembershipMutation) FieldCleared(name string) bool {
 	_, ok := m.clearedFields[name]
 	return ok
 }
 
 // ClearField clears the value of the field with the given name. It returns an
 // error if the field is not defined in the schema.
-func (m *OCIRepositoryMutation) ClearField(name string) error {
-	return fmt.Errorf("unknown OCIRepository nullable field %s", name)
+func (m *MembershipMutation) ClearField(name string) error {
+	return fmt.Errorf("unknown Membership nullable field %s", name)
 }
 
 // ResetField resets all changes in the mutation for the field with the given name.
 // It returns an error if the field is not defined in the schema.
-func (m *OCIRepositoryMutation) ResetField(name string) error {
+func (m *MembershipMutation) ResetField(name string) error {
 	switch name {
-	case ocirepository.FieldRepo:
-		m.ResetRepo()
-		return nil
-	case ocirepository.FieldSecretName:
-		m.ResetSecretName()
+	case membership.FieldCurrent:
+		m.ResetCurrent()
 		return nil
-	case ocirepository.FieldCreatedAt:
+	case membership.FieldCreatedAt:
 		m.ResetCreatedAt()
 		return nil
-	case ocirepository.FieldValidationStatus:
-		m.ResetValidationStatus()
-		return nil
-	case ocirepository.FieldValidatedAt:
-		m.ResetValidatedAt()
+	case membership.FieldUpdatedAt:
+		m.ResetUpdatedAt()
 		return nil
 	}
-	return fmt.Errorf("unknown OCIRepository field %s", name)
+	return fmt.Errorf("unknown Membership field %s", name)
 }
 
 // AddedEdges returns all edge names that were set/added in this mutation.
-func (m *OCIRepositoryMutation) AddedEdges() []string {
-	edges := make([]string, 0, 1)
+func (m *MembershipMutation) AddedEdges() []string {
+	edges := make([]string, 0, 2)
 	if m.organization != nil {
-		edges = append(edges, ocirepository.EdgeOrganization)
+		edges = append(edges, membership.EdgeOrganization)
+	}
+	if m.user != nil {
+		edges = append(edges, membership.EdgeUser)
 	}
 	return edges
 }
 
 // AddedIDs returns all IDs (to other nodes) that were added for the given edge
 // name in this mutation.
-func (m *OCIRepositoryMutation) AddedIDs(name string) []ent.Value {
+func (m *MembershipMutation) AddedIDs(name string) []ent.Value {
 	switch name {
-	case ocirepository.EdgeOrganization:
+	case membership.EdgeOrganization:
 		if id := m.organization; id != nil {
 			return []ent.Value{*id}
 		}
+	case membership.EdgeUser:
+		if id := m.user; id != nil {
+			return []ent.Value{*id}
+		}
 	}
 	return nil
 }
 
 // RemovedEdges returns all edge names that were removed in this mutation.
-func (m *OCIRepositoryMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 1)
+func (m *MembershipMutation) RemovedEdges() []string {
+	edges := make([]string, 0, 2)
 	return edges
 }
 
 // RemovedIDs returns all IDs (to other nodes) that were removed for the edge with
 // the given name in this mutation.
-func (m *OCIRepositoryMutation) RemovedIDs(name string) []ent.Value {
+func (m *MembershipMutation) RemovedIDs(name string) []ent.Value {
 	return nil
 }
 
 // ClearedEdges returns all edge names that were cleared in this mutation.
-func (m *OCIRepositoryMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 1)
+func (m *MembershipMutation) ClearedEdges() []string {
+	edges := make([]string, 0, 2)
 	if m.clearedorganization {
-		edges = append(edges, ocirepository.EdgeOrganization)
+		edges = append(edges, membership.EdgeOrganization)
+	}
+	if m.cleareduser {
+		edges = append(edges, membership.EdgeUser)
 	}
 	return edges
 }
 
 // EdgeCleared returns a boolean which indicates if the edge with the given name
 // was cleared in this mutation.
-func (m *OCIRepositoryMutation) EdgeCleared(name string) bool {
+func (m *MembershipMutation) EdgeCleared(name string) bool {
 	switch name {
-	case ocirepository.EdgeOrganization:
+	case membership.EdgeOrganization:
 		return m.clearedorganization
+	case membership.EdgeUser:
+		return m.cleareduser
 	}
 	return false
 }
 
 // ClearEdge clears the value of the edge with the given name. It returns an error
 // if that edge is not defined in the schema.
-func (m *OCIRepositoryMutation) ClearEdge(name string) error {
+func (m *MembershipMutation) ClearEdge(name string) error {
 	switch name {
-	case ocirepository.EdgeOrganization:
+	case membership.EdgeOrganization:
 		m.ClearOrganization()
 		return nil
+	case membership.EdgeUser:
+		m.ClearUser()
+		return nil
 	}
-	return fmt.Errorf("unknown OCIRepository unique edge %s", name)
+	return fmt.Errorf("unknown Membership unique edge %s", name)
 }
 
 // ResetEdge resets all changes to the edge with the given name in this mutation.
 // It returns an error if the edge is not defined in the schema.
-func (m *OCIRepositoryMutation) ResetEdge(name string) error {
+func (m *MembershipMutation) ResetEdge(name string) error {
 	switch name {
-	case ocirepository.EdgeOrganization:
+	case membership.EdgeOrganization:
 		m.ResetOrganization()
 		return nil
+	case membership.EdgeUser:
+		m.ResetUser()
+		return nil
 	}
-	return fmt.Errorf("unknown OCIRepository edge %s", name)
+	return fmt.Errorf("unknown Membership edge %s", name)
 }
 
 // OrganizationMutation represents an operation that mutates the Organization nodes in the graph.
@@ -2670,9 +2778,9 @@ type OrganizationMutation struct {
 	workflows                 map[uuid.UUID]struct{}
 	removedworkflows          map[uuid.UUID]struct{}
 	clearedworkflows          bool
-	oci_repositories          map[uuid.UUID]struct{}
-	removedoci_repositories   map[uuid.UUID]struct{}
-	clearedoci_repositories   bool
+	cas_backends              map[uuid.UUID]struct{}
+	removedcas_backends       map[uuid.UUID]struct{}
+	clearedcas_backends       bool
 	integrations              map[uuid.UUID]struct{}
 	removedintegrations       map[uuid.UUID]struct{}
 	clearedintegrations       bool
@@ -3019,58 +3127,58 @@ func (m *OrganizationMutation) ResetWorkflows() {
 	m.removedworkflows = nil
 }
 
-// AddOciRepositoryIDs adds the "oci_repositories" edge to the OCIRepository entity by ids.
-func (m *OrganizationMutation) AddOciRepositoryIDs(ids ...uuid.UUID) {
-	if m.oci_repositories == nil {
-		m.oci_repositories = make(map[uuid.UUID]struct{})
+// AddCasBackendIDs adds the "cas_backends" edge to the CASBackend entity by ids.
+func (m *OrganizationMutation) AddCasBackendIDs(ids ...uuid.UUID) {
+	if m.cas_backends == nil {
+		m.cas_backends = make(map[uuid.UUID]struct{})
 	}
 	for i := range ids {
-		m.oci_repositories[ids[i]] = struct{}{}
+		m.cas_backends[ids[i]] = struct{}{}
 	}
 }
 
-// ClearOciRepositories clears the "oci_repositories" edge to the OCIRepository entity.
-func (m *OrganizationMutation) ClearOciRepositories() {
-	m.clearedoci_repositories = true
+// ClearCasBackends clears the "cas_backends" edge to the CASBackend entity.
+func (m *OrganizationMutation) ClearCasBackends() {
+	m.clearedcas_backends = true
 }
 
-// OciRepositoriesCleared reports if the "oci_repositories" edge to the OCIRepository entity was cleared.
-func (m *OrganizationMutation) OciRepositoriesCleared() bool {
-	return m.clearedoci_repositories
+// CasBackendsCleared reports if the "cas_backends" edge to the CASBackend entity was cleared.
+func (m *OrganizationMutation) CasBackendsCleared() bool {
+	return m.clearedcas_backends
 }
 
-// RemoveOciRepositoryIDs removes the "oci_repositories" edge to the OCIRepository entity by IDs.
-func (m *OrganizationMutation) RemoveOciRepositoryIDs(ids ...uuid.UUID) {
-	if m.removedoci_repositories == nil {
-		m.removedoci_repositories = make(map[uuid.UUID]struct{})
+// RemoveCasBackendIDs removes the "cas_backends" edge to the CASBackend entity by IDs.
+func (m *OrganizationMutation) RemoveCasBackendIDs(ids ...uuid.UUID) {
+	if m.removedcas_backends == nil {
+		m.removedcas_backends = make(map[uuid.UUID]struct{})
 	}
 	for i := range ids {
-		delete(m.oci_repositories, ids[i])
-		m.removedoci_repositories[ids[i]] = struct{}{}
+		delete(m.cas_backends, ids[i])
+		m.removedcas_backends[ids[i]] = struct{}{}
 	}
 }
 
-// RemovedOciRepositories returns the removed IDs of the "oci_repositories" edge to the OCIRepository entity.
-func (m *OrganizationMutation) RemovedOciRepositoriesIDs() (ids []uuid.UUID) {
-	for id := range m.removedoci_repositories {
+// RemovedCasBackends returns the removed IDs of the "cas_backends" edge to the CASBackend entity.
+func (m *OrganizationMutation) RemovedCasBackendsIDs() (ids []uuid.UUID) {
+	for id := range m.removedcas_backends {
 		ids = append(ids, id)
 	}
 	return
 }
 
-// OciRepositoriesIDs returns the "oci_repositories" edge IDs in the mutation.
-func (m *OrganizationMutation) OciRepositoriesIDs() (ids []uuid.UUID) {
-	for id := range m.oci_repositories {
+// CasBackendsIDs returns the "cas_backends" edge IDs in the mutation.
+func (m *OrganizationMutation) CasBackendsIDs() (ids []uuid.UUID) {
+	for id := range m.cas_backends {
 		ids = append(ids, id)
 	}
 	return
 }
 
-// ResetOciRepositories resets all changes to the "oci_repositories" edge.
-func (m *OrganizationMutation) ResetOciRepositories() {
-	m.oci_repositories = nil
-	m.clearedoci_repositories = false
-	m.removedoci_repositories = nil
+// ResetCasBackends resets all changes to the "cas_backends" edge.
+func (m *OrganizationMutation) ResetCasBackends() {
+	m.cas_backends = nil
+	m.clearedcas_backends = false
+	m.removedcas_backends = nil
 }
 
 // AddIntegrationIDs adds the "integrations" edge to the Integration entity by ids.
@@ -3287,8 +3395,8 @@ func (m *OrganizationMutation) AddedEdges() []string {
 	if m.workflows != nil {
 		edges = append(edges, organization.EdgeWorkflows)
 	}
-	if m.oci_repositories != nil {
-		edges = append(edges, organization.EdgeOciRepositories)
+	if m.cas_backends != nil {
+		edges = append(edges, organization.EdgeCasBackends)
 	}
 	if m.integrations != nil {
 		edges = append(edges, organization.EdgeIntegrations)
@@ -3318,9 +3426,9 @@ func (m *OrganizationMutation) AddedIDs(name string) []ent.Value {
 			ids = append(ids, id)
 		}
 		return ids
-	case organization.EdgeOciRepositories:
-		ids := make([]ent.Value, 0, len(m.oci_repositories))
-		for id := range m.oci_repositories {
+	case organization.EdgeCasBackends:
+		ids := make([]ent.Value, 0, len(m.cas_backends))
+		for id := range m.cas_backends {
 			ids = append(ids, id)
 		}
 		return ids
@@ -3346,8 +3454,8 @@ func (m *OrganizationMutation) RemovedEdges() []string {
 	if m.removedworkflows != nil {
 		edges = append(edges, organization.EdgeWorkflows)
 	}
-	if m.removedoci_repositories != nil {
-		edges = append(edges, organization.EdgeOciRepositories)
+	if m.removedcas_backends != nil {
+		edges = append(edges, organization.EdgeCasBackends)
 	}
 	if m.removedintegrations != nil {
 		edges = append(edges, organization.EdgeIntegrations)
@@ -3377,9 +3485,9 @@ func (m *OrganizationMutation) RemovedIDs(name string) []ent.Value {
 			ids = append(ids, id)
 		}
 		return ids
-	case organization.EdgeOciRepositories:
-		ids := make([]ent.Value, 0, len(m.removedoci_repositories))
-		for id := range m.removedoci_repositories {
+	case organization.EdgeCasBackends:
+		ids := make([]ent.Value, 0, len(m.removedcas_backends))
+		for id := range m.removedcas_backends {
 			ids = append(ids, id)
 		}
 		return ids
@@ -3405,8 +3513,8 @@ func (m *OrganizationMutation) ClearedEdges() []string {
 	if m.clearedworkflows {
 		edges = append(edges, organization.EdgeWorkflows)
 	}
-	if m.clearedoci_repositories {
-		edges = append(edges, organization.EdgeOciRepositories)
+	if m.clearedcas_backends {
+		edges = append(edges, organization.EdgeCasBackends)
 	}
 	if m.clearedintegrations {
 		edges = append(edges, organization.EdgeIntegrations)
@@ -3424,8 +3532,8 @@ func (m *OrganizationMutation) EdgeCleared(name string) bool {
 		return m.clearedworkflow_contracts
 	case organization.EdgeWorkflows:
 		return m.clearedworkflows
-	case organization.EdgeOciRepositories:
-		return m.clearedoci_repositories
+	case organization.EdgeCasBackends:
+		return m.clearedcas_backends
 	case organization.EdgeIntegrations:
 		return m.clearedintegrations
 	}
@@ -3453,8 +3561,8 @@ func (m *OrganizationMutation) ResetEdge(name string) error {
 	case organization.EdgeWorkflows:
 		m.ResetWorkflows()
 		return nil
-	case organization.EdgeOciRepositories:
-		m.ResetOciRepositories()
+	case organization.EdgeCasBackends:
+		m.ResetCasBackends()
 		return nil
 	case organization.EdgeIntegrations:
 		m.ResetIntegrations()
diff --git a/app/controlplane/internal/data/ent/ocirepository.go b/app/controlplane/internal/data/ent/ocirepository.go
deleted file mode 100644
index c91efc8b6..000000000
--- a/app/controlplane/internal/data/ent/ocirepository.go
+++ /dev/null
@@ -1,193 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ent
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"entgo.io/ent"
-	"entgo.io/ent/dialect/sql"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
-	"github.com/google/uuid"
-)
-
-// OCIRepository is the model entity for the OCIRepository schema.
-type OCIRepository struct {
-	config `json:"-"`
-	// ID of the ent.
-	ID uuid.UUID `json:"id,omitempty"`
-	// Repo holds the value of the "repo" field.
-	Repo string `json:"repo,omitempty"`
-	// SecretName holds the value of the "secret_name" field.
-	SecretName string `json:"secret_name,omitempty"`
-	// CreatedAt holds the value of the "created_at" field.
-	CreatedAt time.Time `json:"created_at,omitempty"`
-	// ValidationStatus holds the value of the "validation_status" field.
-	ValidationStatus biz.OCIRepoValidationStatus `json:"validation_status,omitempty"`
-	// ValidatedAt holds the value of the "validated_at" field.
-	ValidatedAt time.Time `json:"validated_at,omitempty"`
-	// Edges holds the relations/edges for other nodes in the graph.
-	// The values are being populated by the OCIRepositoryQuery when eager-loading is set.
-	Edges                         OCIRepositoryEdges `json:"edges"`
-	organization_oci_repositories *uuid.UUID
-	selectValues                  sql.SelectValues
-}
-
-// OCIRepositoryEdges holds the relations/edges for other nodes in the graph.
-type OCIRepositoryEdges struct {
-	// Organization holds the value of the organization edge.
-	Organization *Organization `json:"organization,omitempty"`
-	// loadedTypes holds the information for reporting if a
-	// type was loaded (or requested) in eager-loading or not.
-	loadedTypes [1]bool
-}
-
-// OrganizationOrErr returns the Organization value or an error if the edge
-// was not loaded in eager-loading, or loaded but was not found.
-func (e OCIRepositoryEdges) OrganizationOrErr() (*Organization, error) {
-	if e.loadedTypes[0] {
-		if e.Organization == nil {
-			// Edge was loaded but was not found.
-			return nil, &NotFoundError{label: organization.Label}
-		}
-		return e.Organization, nil
-	}
-	return nil, &NotLoadedError{edge: "organization"}
-}
-
-// scanValues returns the types for scanning values from sql.Rows.
-func (*OCIRepository) scanValues(columns []string) ([]any, error) {
-	values := make([]any, len(columns))
-	for i := range columns {
-		switch columns[i] {
-		case ocirepository.FieldRepo, ocirepository.FieldSecretName, ocirepository.FieldValidationStatus:
-			values[i] = new(sql.NullString)
-		case ocirepository.FieldCreatedAt, ocirepository.FieldValidatedAt:
-			values[i] = new(sql.NullTime)
-		case ocirepository.FieldID:
-			values[i] = new(uuid.UUID)
-		case ocirepository.ForeignKeys[0]: // organization_oci_repositories
-			values[i] = &sql.NullScanner{S: new(uuid.UUID)}
-		default:
-			values[i] = new(sql.UnknownType)
-		}
-	}
-	return values, nil
-}
-
-// assignValues assigns the values that were returned from sql.Rows (after scanning)
-// to the OCIRepository fields.
-func (or *OCIRepository) assignValues(columns []string, values []any) error {
-	if m, n := len(values), len(columns); m < n {
-		return fmt.Errorf("mismatch number of scan values: %d != %d", m, n)
-	}
-	for i := range columns {
-		switch columns[i] {
-		case ocirepository.FieldID:
-			if value, ok := values[i].(*uuid.UUID); !ok {
-				return fmt.Errorf("unexpected type %T for field id", values[i])
-			} else if value != nil {
-				or.ID = *value
-			}
-		case ocirepository.FieldRepo:
-			if value, ok := values[i].(*sql.NullString); !ok {
-				return fmt.Errorf("unexpected type %T for field repo", values[i])
-			} else if value.Valid {
-				or.Repo = value.String
-			}
-		case ocirepository.FieldSecretName:
-			if value, ok := values[i].(*sql.NullString); !ok {
-				return fmt.Errorf("unexpected type %T for field secret_name", values[i])
-			} else if value.Valid {
-				or.SecretName = value.String
-			}
-		case ocirepository.FieldCreatedAt:
-			if value, ok := values[i].(*sql.NullTime); !ok {
-				return fmt.Errorf("unexpected type %T for field created_at", values[i])
-			} else if value.Valid {
-				or.CreatedAt = value.Time
-			}
-		case ocirepository.FieldValidationStatus:
-			if value, ok := values[i].(*sql.NullString); !ok {
-				return fmt.Errorf("unexpected type %T for field validation_status", values[i])
-			} else if value.Valid {
-				or.ValidationStatus = biz.OCIRepoValidationStatus(value.String)
-			}
-		case ocirepository.FieldValidatedAt:
-			if value, ok := values[i].(*sql.NullTime); !ok {
-				return fmt.Errorf("unexpected type %T for field validated_at", values[i])
-			} else if value.Valid {
-				or.ValidatedAt = value.Time
-			}
-		case ocirepository.ForeignKeys[0]:
-			if value, ok := values[i].(*sql.NullScanner); !ok {
-				return fmt.Errorf("unexpected type %T for field organization_oci_repositories", values[i])
-			} else if value.Valid {
-				or.organization_oci_repositories = new(uuid.UUID)
-				*or.organization_oci_repositories = *value.S.(*uuid.UUID)
-			}
-		default:
-			or.selectValues.Set(columns[i], values[i])
-		}
-	}
-	return nil
-}
-
-// Value returns the ent.Value that was dynamically selected and assigned to the OCIRepository.
-// This includes values selected through modifiers, order, etc.
-func (or *OCIRepository) Value(name string) (ent.Value, error) {
-	return or.selectValues.Get(name)
-}
-
-// QueryOrganization queries the "organization" edge of the OCIRepository entity.
-func (or *OCIRepository) QueryOrganization() *OrganizationQuery {
-	return NewOCIRepositoryClient(or.config).QueryOrganization(or)
-}
-
-// Update returns a builder for updating this OCIRepository.
-// Note that you need to call OCIRepository.Unwrap() before calling this method if this OCIRepository
-// was returned from a transaction, and the transaction was committed or rolled back.
-func (or *OCIRepository) Update() *OCIRepositoryUpdateOne {
-	return NewOCIRepositoryClient(or.config).UpdateOne(or)
-}
-
-// Unwrap unwraps the OCIRepository entity that was returned from a transaction after it was closed,
-// so that all future queries will be executed through the driver which created the transaction.
-func (or *OCIRepository) Unwrap() *OCIRepository {
-	_tx, ok := or.config.driver.(*txDriver)
-	if !ok {
-		panic("ent: OCIRepository is not a transactional entity")
-	}
-	or.config.driver = _tx.drv
-	return or
-}
-
-// String implements the fmt.Stringer.
-func (or *OCIRepository) String() string {
-	var builder strings.Builder
-	builder.WriteString("OCIRepository(")
-	builder.WriteString(fmt.Sprintf("id=%v, ", or.ID))
-	builder.WriteString("repo=")
-	builder.WriteString(or.Repo)
-	builder.WriteString(", ")
-	builder.WriteString("secret_name=")
-	builder.WriteString(or.SecretName)
-	builder.WriteString(", ")
-	builder.WriteString("created_at=")
-	builder.WriteString(or.CreatedAt.Format(time.ANSIC))
-	builder.WriteString(", ")
-	builder.WriteString("validation_status=")
-	builder.WriteString(fmt.Sprintf("%v", or.ValidationStatus))
-	builder.WriteString(", ")
-	builder.WriteString("validated_at=")
-	builder.WriteString(or.ValidatedAt.Format(time.ANSIC))
-	builder.WriteByte(')')
-	return builder.String()
-}
-
-// OCIRepositories is a parsable slice of OCIRepository.
-type OCIRepositories []*OCIRepository
diff --git a/app/controlplane/internal/data/ent/ocirepository/where.go b/app/controlplane/internal/data/ent/ocirepository/where.go
deleted file mode 100644
index 01433a032..000000000
--- a/app/controlplane/internal/data/ent/ocirepository/where.go
+++ /dev/null
@@ -1,373 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ocirepository
-
-import (
-	"time"
-
-	"entgo.io/ent/dialect/sql"
-	"entgo.io/ent/dialect/sql/sqlgraph"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
-	"github.com/google/uuid"
-)
-
-// ID filters vertices based on their ID field.
-func ID(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldID, id))
-}
-
-// IDEQ applies the EQ predicate on the ID field.
-func IDEQ(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldID, id))
-}
-
-// IDNEQ applies the NEQ predicate on the ID field.
-func IDNEQ(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNEQ(FieldID, id))
-}
-
-// IDIn applies the In predicate on the ID field.
-func IDIn(ids ...uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldIn(FieldID, ids...))
-}
-
-// IDNotIn applies the NotIn predicate on the ID field.
-func IDNotIn(ids ...uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNotIn(FieldID, ids...))
-}
-
-// IDGT applies the GT predicate on the ID field.
-func IDGT(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGT(FieldID, id))
-}
-
-// IDGTE applies the GTE predicate on the ID field.
-func IDGTE(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGTE(FieldID, id))
-}
-
-// IDLT applies the LT predicate on the ID field.
-func IDLT(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLT(FieldID, id))
-}
-
-// IDLTE applies the LTE predicate on the ID field.
-func IDLTE(id uuid.UUID) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLTE(FieldID, id))
-}
-
-// Repo applies equality check predicate on the "repo" field. It's identical to RepoEQ.
-func Repo(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldRepo, v))
-}
-
-// SecretName applies equality check predicate on the "secret_name" field. It's identical to SecretNameEQ.
-func SecretName(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldSecretName, v))
-}
-
-// CreatedAt applies equality check predicate on the "created_at" field. It's identical to CreatedAtEQ.
-func CreatedAt(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldCreatedAt, v))
-}
-
-// ValidatedAt applies equality check predicate on the "validated_at" field. It's identical to ValidatedAtEQ.
-func ValidatedAt(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldValidatedAt, v))
-}
-
-// RepoEQ applies the EQ predicate on the "repo" field.
-func RepoEQ(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldRepo, v))
-}
-
-// RepoNEQ applies the NEQ predicate on the "repo" field.
-func RepoNEQ(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNEQ(FieldRepo, v))
-}
-
-// RepoIn applies the In predicate on the "repo" field.
-func RepoIn(vs ...string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldIn(FieldRepo, vs...))
-}
-
-// RepoNotIn applies the NotIn predicate on the "repo" field.
-func RepoNotIn(vs ...string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNotIn(FieldRepo, vs...))
-}
-
-// RepoGT applies the GT predicate on the "repo" field.
-func RepoGT(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGT(FieldRepo, v))
-}
-
-// RepoGTE applies the GTE predicate on the "repo" field.
-func RepoGTE(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGTE(FieldRepo, v))
-}
-
-// RepoLT applies the LT predicate on the "repo" field.
-func RepoLT(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLT(FieldRepo, v))
-}
-
-// RepoLTE applies the LTE predicate on the "repo" field.
-func RepoLTE(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLTE(FieldRepo, v))
-}
-
-// RepoContains applies the Contains predicate on the "repo" field.
-func RepoContains(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldContains(FieldRepo, v))
-}
-
-// RepoHasPrefix applies the HasPrefix predicate on the "repo" field.
-func RepoHasPrefix(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldHasPrefix(FieldRepo, v))
-}
-
-// RepoHasSuffix applies the HasSuffix predicate on the "repo" field.
-func RepoHasSuffix(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldHasSuffix(FieldRepo, v))
-}
-
-// RepoEqualFold applies the EqualFold predicate on the "repo" field.
-func RepoEqualFold(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEqualFold(FieldRepo, v))
-}
-
-// RepoContainsFold applies the ContainsFold predicate on the "repo" field.
-func RepoContainsFold(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldContainsFold(FieldRepo, v))
-}
-
-// SecretNameEQ applies the EQ predicate on the "secret_name" field.
-func SecretNameEQ(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldSecretName, v))
-}
-
-// SecretNameNEQ applies the NEQ predicate on the "secret_name" field.
-func SecretNameNEQ(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNEQ(FieldSecretName, v))
-}
-
-// SecretNameIn applies the In predicate on the "secret_name" field.
-func SecretNameIn(vs ...string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldIn(FieldSecretName, vs...))
-}
-
-// SecretNameNotIn applies the NotIn predicate on the "secret_name" field.
-func SecretNameNotIn(vs ...string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNotIn(FieldSecretName, vs...))
-}
-
-// SecretNameGT applies the GT predicate on the "secret_name" field.
-func SecretNameGT(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGT(FieldSecretName, v))
-}
-
-// SecretNameGTE applies the GTE predicate on the "secret_name" field.
-func SecretNameGTE(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGTE(FieldSecretName, v))
-}
-
-// SecretNameLT applies the LT predicate on the "secret_name" field.
-func SecretNameLT(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLT(FieldSecretName, v))
-}
-
-// SecretNameLTE applies the LTE predicate on the "secret_name" field.
-func SecretNameLTE(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLTE(FieldSecretName, v))
-}
-
-// SecretNameContains applies the Contains predicate on the "secret_name" field.
-func SecretNameContains(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldContains(FieldSecretName, v))
-}
-
-// SecretNameHasPrefix applies the HasPrefix predicate on the "secret_name" field.
-func SecretNameHasPrefix(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldHasPrefix(FieldSecretName, v))
-}
-
-// SecretNameHasSuffix applies the HasSuffix predicate on the "secret_name" field.
-func SecretNameHasSuffix(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldHasSuffix(FieldSecretName, v))
-}
-
-// SecretNameEqualFold applies the EqualFold predicate on the "secret_name" field.
-func SecretNameEqualFold(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEqualFold(FieldSecretName, v))
-}
-
-// SecretNameContainsFold applies the ContainsFold predicate on the "secret_name" field.
-func SecretNameContainsFold(v string) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldContainsFold(FieldSecretName, v))
-}
-
-// CreatedAtEQ applies the EQ predicate on the "created_at" field.
-func CreatedAtEQ(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldCreatedAt, v))
-}
-
-// CreatedAtNEQ applies the NEQ predicate on the "created_at" field.
-func CreatedAtNEQ(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNEQ(FieldCreatedAt, v))
-}
-
-// CreatedAtIn applies the In predicate on the "created_at" field.
-func CreatedAtIn(vs ...time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldIn(FieldCreatedAt, vs...))
-}
-
-// CreatedAtNotIn applies the NotIn predicate on the "created_at" field.
-func CreatedAtNotIn(vs ...time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNotIn(FieldCreatedAt, vs...))
-}
-
-// CreatedAtGT applies the GT predicate on the "created_at" field.
-func CreatedAtGT(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGT(FieldCreatedAt, v))
-}
-
-// CreatedAtGTE applies the GTE predicate on the "created_at" field.
-func CreatedAtGTE(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGTE(FieldCreatedAt, v))
-}
-
-// CreatedAtLT applies the LT predicate on the "created_at" field.
-func CreatedAtLT(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLT(FieldCreatedAt, v))
-}
-
-// CreatedAtLTE applies the LTE predicate on the "created_at" field.
-func CreatedAtLTE(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLTE(FieldCreatedAt, v))
-}
-
-// ValidationStatusEQ applies the EQ predicate on the "validation_status" field.
-func ValidationStatusEQ(v biz.OCIRepoValidationStatus) predicate.OCIRepository {
-	vc := v
-	return predicate.OCIRepository(sql.FieldEQ(FieldValidationStatus, vc))
-}
-
-// ValidationStatusNEQ applies the NEQ predicate on the "validation_status" field.
-func ValidationStatusNEQ(v biz.OCIRepoValidationStatus) predicate.OCIRepository {
-	vc := v
-	return predicate.OCIRepository(sql.FieldNEQ(FieldValidationStatus, vc))
-}
-
-// ValidationStatusIn applies the In predicate on the "validation_status" field.
-func ValidationStatusIn(vs ...biz.OCIRepoValidationStatus) predicate.OCIRepository {
-	v := make([]any, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OCIRepository(sql.FieldIn(FieldValidationStatus, v...))
-}
-
-// ValidationStatusNotIn applies the NotIn predicate on the "validation_status" field.
-func ValidationStatusNotIn(vs ...biz.OCIRepoValidationStatus) predicate.OCIRepository {
-	v := make([]any, len(vs))
-	for i := range v {
-		v[i] = vs[i]
-	}
-	return predicate.OCIRepository(sql.FieldNotIn(FieldValidationStatus, v...))
-}
-
-// ValidatedAtEQ applies the EQ predicate on the "validated_at" field.
-func ValidatedAtEQ(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldEQ(FieldValidatedAt, v))
-}
-
-// ValidatedAtNEQ applies the NEQ predicate on the "validated_at" field.
-func ValidatedAtNEQ(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNEQ(FieldValidatedAt, v))
-}
-
-// ValidatedAtIn applies the In predicate on the "validated_at" field.
-func ValidatedAtIn(vs ...time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldIn(FieldValidatedAt, vs...))
-}
-
-// ValidatedAtNotIn applies the NotIn predicate on the "validated_at" field.
-func ValidatedAtNotIn(vs ...time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldNotIn(FieldValidatedAt, vs...))
-}
-
-// ValidatedAtGT applies the GT predicate on the "validated_at" field.
-func ValidatedAtGT(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGT(FieldValidatedAt, v))
-}
-
-// ValidatedAtGTE applies the GTE predicate on the "validated_at" field.
-func ValidatedAtGTE(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldGTE(FieldValidatedAt, v))
-}
-
-// ValidatedAtLT applies the LT predicate on the "validated_at" field.
-func ValidatedAtLT(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLT(FieldValidatedAt, v))
-}
-
-// ValidatedAtLTE applies the LTE predicate on the "validated_at" field.
-func ValidatedAtLTE(v time.Time) predicate.OCIRepository {
-	return predicate.OCIRepository(sql.FieldLTE(FieldValidatedAt, v))
-}
-
-// HasOrganization applies the HasEdge predicate on the "organization" edge.
-func HasOrganization() predicate.OCIRepository {
-	return predicate.OCIRepository(func(s *sql.Selector) {
-		step := sqlgraph.NewStep(
-			sqlgraph.From(Table, FieldID),
-			sqlgraph.Edge(sqlgraph.M2O, true, OrganizationTable, OrganizationColumn),
-		)
-		sqlgraph.HasNeighbors(s, step)
-	})
-}
-
-// HasOrganizationWith applies the HasEdge predicate on the "organization" edge with a given conditions (other predicates).
-func HasOrganizationWith(preds ...predicate.Organization) predicate.OCIRepository {
-	return predicate.OCIRepository(func(s *sql.Selector) {
-		step := newOrganizationStep()
-		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
-			for _, p := range preds {
-				p(s)
-			}
-		})
-	})
-}
-
-// And groups predicates with the AND operator between them.
-func And(predicates ...predicate.OCIRepository) predicate.OCIRepository {
-	return predicate.OCIRepository(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for _, p := range predicates {
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
-}
-
-// Or groups predicates with the OR operator between them.
-func Or(predicates ...predicate.OCIRepository) predicate.OCIRepository {
-	return predicate.OCIRepository(func(s *sql.Selector) {
-		s1 := s.Clone().SetP(nil)
-		for i, p := range predicates {
-			if i > 0 {
-				s1.Or()
-			}
-			p(s1)
-		}
-		s.Where(s1.P())
-	})
-}
-
-// Not applies the not operator on the given predicate.
-func Not(p predicate.OCIRepository) predicate.OCIRepository {
-	return predicate.OCIRepository(func(s *sql.Selector) {
-		p(s.Not())
-	})
-}
diff --git a/app/controlplane/internal/data/ent/ocirepository_create.go b/app/controlplane/internal/data/ent/ocirepository_create.go
deleted file mode 100644
index 6c6920f53..000000000
--- a/app/controlplane/internal/data/ent/ocirepository_create.go
+++ /dev/null
@@ -1,336 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ent
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"entgo.io/ent/dialect/sql/sqlgraph"
-	"entgo.io/ent/schema/field"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
-	"github.com/google/uuid"
-)
-
-// OCIRepositoryCreate is the builder for creating a OCIRepository entity.
-type OCIRepositoryCreate struct {
-	config
-	mutation *OCIRepositoryMutation
-	hooks    []Hook
-}
-
-// SetRepo sets the "repo" field.
-func (orc *OCIRepositoryCreate) SetRepo(s string) *OCIRepositoryCreate {
-	orc.mutation.SetRepo(s)
-	return orc
-}
-
-// SetSecretName sets the "secret_name" field.
-func (orc *OCIRepositoryCreate) SetSecretName(s string) *OCIRepositoryCreate {
-	orc.mutation.SetSecretName(s)
-	return orc
-}
-
-// SetCreatedAt sets the "created_at" field.
-func (orc *OCIRepositoryCreate) SetCreatedAt(t time.Time) *OCIRepositoryCreate {
-	orc.mutation.SetCreatedAt(t)
-	return orc
-}
-
-// SetNillableCreatedAt sets the "created_at" field if the given value is not nil.
-func (orc *OCIRepositoryCreate) SetNillableCreatedAt(t *time.Time) *OCIRepositoryCreate {
-	if t != nil {
-		orc.SetCreatedAt(*t)
-	}
-	return orc
-}
-
-// SetValidationStatus sets the "validation_status" field.
-func (orc *OCIRepositoryCreate) SetValidationStatus(brvs biz.OCIRepoValidationStatus) *OCIRepositoryCreate {
-	orc.mutation.SetValidationStatus(brvs)
-	return orc
-}
-
-// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
-func (orc *OCIRepositoryCreate) SetNillableValidationStatus(brvs *biz.OCIRepoValidationStatus) *OCIRepositoryCreate {
-	if brvs != nil {
-		orc.SetValidationStatus(*brvs)
-	}
-	return orc
-}
-
-// SetValidatedAt sets the "validated_at" field.
-func (orc *OCIRepositoryCreate) SetValidatedAt(t time.Time) *OCIRepositoryCreate {
-	orc.mutation.SetValidatedAt(t)
-	return orc
-}
-
-// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
-func (orc *OCIRepositoryCreate) SetNillableValidatedAt(t *time.Time) *OCIRepositoryCreate {
-	if t != nil {
-		orc.SetValidatedAt(*t)
-	}
-	return orc
-}
-
-// SetID sets the "id" field.
-func (orc *OCIRepositoryCreate) SetID(u uuid.UUID) *OCIRepositoryCreate {
-	orc.mutation.SetID(u)
-	return orc
-}
-
-// SetNillableID sets the "id" field if the given value is not nil.
-func (orc *OCIRepositoryCreate) SetNillableID(u *uuid.UUID) *OCIRepositoryCreate {
-	if u != nil {
-		orc.SetID(*u)
-	}
-	return orc
-}
-
-// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
-func (orc *OCIRepositoryCreate) SetOrganizationID(id uuid.UUID) *OCIRepositoryCreate {
-	orc.mutation.SetOrganizationID(id)
-	return orc
-}
-
-// SetOrganization sets the "organization" edge to the Organization entity.
-func (orc *OCIRepositoryCreate) SetOrganization(o *Organization) *OCIRepositoryCreate {
-	return orc.SetOrganizationID(o.ID)
-}
-
-// Mutation returns the OCIRepositoryMutation object of the builder.
-func (orc *OCIRepositoryCreate) Mutation() *OCIRepositoryMutation {
-	return orc.mutation
-}
-
-// Save creates the OCIRepository in the database.
-func (orc *OCIRepositoryCreate) Save(ctx context.Context) (*OCIRepository, error) {
-	orc.defaults()
-	return withHooks(ctx, orc.sqlSave, orc.mutation, orc.hooks)
-}
-
-// SaveX calls Save and panics if Save returns an error.
-func (orc *OCIRepositoryCreate) SaveX(ctx context.Context) *OCIRepository {
-	v, err := orc.Save(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return v
-}
-
-// Exec executes the query.
-func (orc *OCIRepositoryCreate) Exec(ctx context.Context) error {
-	_, err := orc.Save(ctx)
-	return err
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (orc *OCIRepositoryCreate) ExecX(ctx context.Context) {
-	if err := orc.Exec(ctx); err != nil {
-		panic(err)
-	}
-}
-
-// defaults sets the default values of the builder before save.
-func (orc *OCIRepositoryCreate) defaults() {
-	if _, ok := orc.mutation.CreatedAt(); !ok {
-		v := ocirepository.DefaultCreatedAt()
-		orc.mutation.SetCreatedAt(v)
-	}
-	if _, ok := orc.mutation.ValidationStatus(); !ok {
-		v := ocirepository.DefaultValidationStatus
-		orc.mutation.SetValidationStatus(v)
-	}
-	if _, ok := orc.mutation.ValidatedAt(); !ok {
-		v := ocirepository.DefaultValidatedAt()
-		orc.mutation.SetValidatedAt(v)
-	}
-	if _, ok := orc.mutation.ID(); !ok {
-		v := ocirepository.DefaultID()
-		orc.mutation.SetID(v)
-	}
-}
-
-// check runs all checks and user-defined validators on the builder.
-func (orc *OCIRepositoryCreate) check() error {
-	if _, ok := orc.mutation.Repo(); !ok {
-		return &ValidationError{Name: "repo", err: errors.New(`ent: missing required field "OCIRepository.repo"`)}
-	}
-	if _, ok := orc.mutation.SecretName(); !ok {
-		return &ValidationError{Name: "secret_name", err: errors.New(`ent: missing required field "OCIRepository.secret_name"`)}
-	}
-	if _, ok := orc.mutation.CreatedAt(); !ok {
-		return &ValidationError{Name: "created_at", err: errors.New(`ent: missing required field "OCIRepository.created_at"`)}
-	}
-	if _, ok := orc.mutation.ValidationStatus(); !ok {
-		return &ValidationError{Name: "validation_status", err: errors.New(`ent: missing required field "OCIRepository.validation_status"`)}
-	}
-	if v, ok := orc.mutation.ValidationStatus(); ok {
-		if err := ocirepository.ValidationStatusValidator(v); err != nil {
-			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "OCIRepository.validation_status": %w`, err)}
-		}
-	}
-	if _, ok := orc.mutation.ValidatedAt(); !ok {
-		return &ValidationError{Name: "validated_at", err: errors.New(`ent: missing required field "OCIRepository.validated_at"`)}
-	}
-	if _, ok := orc.mutation.OrganizationID(); !ok {
-		return &ValidationError{Name: "organization", err: errors.New(`ent: missing required edge "OCIRepository.organization"`)}
-	}
-	return nil
-}
-
-func (orc *OCIRepositoryCreate) sqlSave(ctx context.Context) (*OCIRepository, error) {
-	if err := orc.check(); err != nil {
-		return nil, err
-	}
-	_node, _spec := orc.createSpec()
-	if err := sqlgraph.CreateNode(ctx, orc.driver, _spec); err != nil {
-		if sqlgraph.IsConstraintError(err) {
-			err = &ConstraintError{msg: err.Error(), wrap: err}
-		}
-		return nil, err
-	}
-	if _spec.ID.Value != nil {
-		if id, ok := _spec.ID.Value.(*uuid.UUID); ok {
-			_node.ID = *id
-		} else if err := _node.ID.Scan(_spec.ID.Value); err != nil {
-			return nil, err
-		}
-	}
-	orc.mutation.id = &_node.ID
-	orc.mutation.done = true
-	return _node, nil
-}
-
-func (orc *OCIRepositoryCreate) createSpec() (*OCIRepository, *sqlgraph.CreateSpec) {
-	var (
-		_node = &OCIRepository{config: orc.config}
-		_spec = sqlgraph.NewCreateSpec(ocirepository.Table, sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID))
-	)
-	if id, ok := orc.mutation.ID(); ok {
-		_node.ID = id
-		_spec.ID.Value = &id
-	}
-	if value, ok := orc.mutation.Repo(); ok {
-		_spec.SetField(ocirepository.FieldRepo, field.TypeString, value)
-		_node.Repo = value
-	}
-	if value, ok := orc.mutation.SecretName(); ok {
-		_spec.SetField(ocirepository.FieldSecretName, field.TypeString, value)
-		_node.SecretName = value
-	}
-	if value, ok := orc.mutation.CreatedAt(); ok {
-		_spec.SetField(ocirepository.FieldCreatedAt, field.TypeTime, value)
-		_node.CreatedAt = value
-	}
-	if value, ok := orc.mutation.ValidationStatus(); ok {
-		_spec.SetField(ocirepository.FieldValidationStatus, field.TypeEnum, value)
-		_node.ValidationStatus = value
-	}
-	if value, ok := orc.mutation.ValidatedAt(); ok {
-		_spec.SetField(ocirepository.FieldValidatedAt, field.TypeTime, value)
-		_node.ValidatedAt = value
-	}
-	if nodes := orc.mutation.OrganizationIDs(); len(nodes) > 0 {
-		edge := &sqlgraph.EdgeSpec{
-			Rel:     sqlgraph.M2O,
-			Inverse: true,
-			Table:   ocirepository.OrganizationTable,
-			Columns: []string{ocirepository.OrganizationColumn},
-			Bidi:    false,
-			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
-			},
-		}
-		for _, k := range nodes {
-			edge.Target.Nodes = append(edge.Target.Nodes, k)
-		}
-		_node.organization_oci_repositories = &nodes[0]
-		_spec.Edges = append(_spec.Edges, edge)
-	}
-	return _node, _spec
-}
-
-// OCIRepositoryCreateBulk is the builder for creating many OCIRepository entities in bulk.
-type OCIRepositoryCreateBulk struct {
-	config
-	builders []*OCIRepositoryCreate
-}
-
-// Save creates the OCIRepository entities in the database.
-func (orcb *OCIRepositoryCreateBulk) Save(ctx context.Context) ([]*OCIRepository, error) {
-	specs := make([]*sqlgraph.CreateSpec, len(orcb.builders))
-	nodes := make([]*OCIRepository, len(orcb.builders))
-	mutators := make([]Mutator, len(orcb.builders))
-	for i := range orcb.builders {
-		func(i int, root context.Context) {
-			builder := orcb.builders[i]
-			builder.defaults()
-			var mut Mutator = MutateFunc(func(ctx context.Context, m Mutation) (Value, error) {
-				mutation, ok := m.(*OCIRepositoryMutation)
-				if !ok {
-					return nil, fmt.Errorf("unexpected mutation type %T", m)
-				}
-				if err := builder.check(); err != nil {
-					return nil, err
-				}
-				builder.mutation = mutation
-				var err error
-				nodes[i], specs[i] = builder.createSpec()
-				if i < len(mutators)-1 {
-					_, err = mutators[i+1].Mutate(root, orcb.builders[i+1].mutation)
-				} else {
-					spec := &sqlgraph.BatchCreateSpec{Nodes: specs}
-					// Invoke the actual operation on the latest mutation in the chain.
-					if err = sqlgraph.BatchCreate(ctx, orcb.driver, spec); err != nil {
-						if sqlgraph.IsConstraintError(err) {
-							err = &ConstraintError{msg: err.Error(), wrap: err}
-						}
-					}
-				}
-				if err != nil {
-					return nil, err
-				}
-				mutation.id = &nodes[i].ID
-				mutation.done = true
-				return nodes[i], nil
-			})
-			for i := len(builder.hooks) - 1; i >= 0; i-- {
-				mut = builder.hooks[i](mut)
-			}
-			mutators[i] = mut
-		}(i, ctx)
-	}
-	if len(mutators) > 0 {
-		if _, err := mutators[0].Mutate(ctx, orcb.builders[0].mutation); err != nil {
-			return nil, err
-		}
-	}
-	return nodes, nil
-}
-
-// SaveX is like Save, but panics if an error occurs.
-func (orcb *OCIRepositoryCreateBulk) SaveX(ctx context.Context) []*OCIRepository {
-	v, err := orcb.Save(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return v
-}
-
-// Exec executes the query.
-func (orcb *OCIRepositoryCreateBulk) Exec(ctx context.Context) error {
-	_, err := orcb.Save(ctx)
-	return err
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (orcb *OCIRepositoryCreateBulk) ExecX(ctx context.Context) {
-	if err := orcb.Exec(ctx); err != nil {
-		panic(err)
-	}
-}
diff --git a/app/controlplane/internal/data/ent/ocirepository_delete.go b/app/controlplane/internal/data/ent/ocirepository_delete.go
deleted file mode 100644
index cbff7b236..000000000
--- a/app/controlplane/internal/data/ent/ocirepository_delete.go
+++ /dev/null
@@ -1,88 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ent
-
-import (
-	"context"
-
-	"entgo.io/ent/dialect/sql"
-	"entgo.io/ent/dialect/sql/sqlgraph"
-	"entgo.io/ent/schema/field"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
-)
-
-// OCIRepositoryDelete is the builder for deleting a OCIRepository entity.
-type OCIRepositoryDelete struct {
-	config
-	hooks    []Hook
-	mutation *OCIRepositoryMutation
-}
-
-// Where appends a list predicates to the OCIRepositoryDelete builder.
-func (ord *OCIRepositoryDelete) Where(ps ...predicate.OCIRepository) *OCIRepositoryDelete {
-	ord.mutation.Where(ps...)
-	return ord
-}
-
-// Exec executes the deletion query and returns how many vertices were deleted.
-func (ord *OCIRepositoryDelete) Exec(ctx context.Context) (int, error) {
-	return withHooks(ctx, ord.sqlExec, ord.mutation, ord.hooks)
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (ord *OCIRepositoryDelete) ExecX(ctx context.Context) int {
-	n, err := ord.Exec(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return n
-}
-
-func (ord *OCIRepositoryDelete) sqlExec(ctx context.Context) (int, error) {
-	_spec := sqlgraph.NewDeleteSpec(ocirepository.Table, sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID))
-	if ps := ord.mutation.predicates; len(ps) > 0 {
-		_spec.Predicate = func(selector *sql.Selector) {
-			for i := range ps {
-				ps[i](selector)
-			}
-		}
-	}
-	affected, err := sqlgraph.DeleteNodes(ctx, ord.driver, _spec)
-	if err != nil && sqlgraph.IsConstraintError(err) {
-		err = &ConstraintError{msg: err.Error(), wrap: err}
-	}
-	ord.mutation.done = true
-	return affected, err
-}
-
-// OCIRepositoryDeleteOne is the builder for deleting a single OCIRepository entity.
-type OCIRepositoryDeleteOne struct {
-	ord *OCIRepositoryDelete
-}
-
-// Where appends a list predicates to the OCIRepositoryDelete builder.
-func (ordo *OCIRepositoryDeleteOne) Where(ps ...predicate.OCIRepository) *OCIRepositoryDeleteOne {
-	ordo.ord.mutation.Where(ps...)
-	return ordo
-}
-
-// Exec executes the deletion query.
-func (ordo *OCIRepositoryDeleteOne) Exec(ctx context.Context) error {
-	n, err := ordo.ord.Exec(ctx)
-	switch {
-	case err != nil:
-		return err
-	case n == 0:
-		return &NotFoundError{ocirepository.Label}
-	default:
-		return nil
-	}
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (ordo *OCIRepositoryDeleteOne) ExecX(ctx context.Context) {
-	if err := ordo.Exec(ctx); err != nil {
-		panic(err)
-	}
-}
diff --git a/app/controlplane/internal/data/ent/ocirepository_query.go b/app/controlplane/internal/data/ent/ocirepository_query.go
deleted file mode 100644
index 83055f7cf..000000000
--- a/app/controlplane/internal/data/ent/ocirepository_query.go
+++ /dev/null
@@ -1,614 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ent
-
-import (
-	"context"
-	"fmt"
-	"math"
-
-	"entgo.io/ent/dialect/sql"
-	"entgo.io/ent/dialect/sql/sqlgraph"
-	"entgo.io/ent/schema/field"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
-	"github.com/google/uuid"
-)
-
-// OCIRepositoryQuery is the builder for querying OCIRepository entities.
-type OCIRepositoryQuery struct {
-	config
-	ctx              *QueryContext
-	order            []ocirepository.OrderOption
-	inters           []Interceptor
-	predicates       []predicate.OCIRepository
-	withOrganization *OrganizationQuery
-	withFKs          bool
-	// intermediate query (i.e. traversal path).
-	sql  *sql.Selector
-	path func(context.Context) (*sql.Selector, error)
-}
-
-// Where adds a new predicate for the OCIRepositoryQuery builder.
-func (orq *OCIRepositoryQuery) Where(ps ...predicate.OCIRepository) *OCIRepositoryQuery {
-	orq.predicates = append(orq.predicates, ps...)
-	return orq
-}
-
-// Limit the number of records to be returned by this query.
-func (orq *OCIRepositoryQuery) Limit(limit int) *OCIRepositoryQuery {
-	orq.ctx.Limit = &limit
-	return orq
-}
-
-// Offset to start from.
-func (orq *OCIRepositoryQuery) Offset(offset int) *OCIRepositoryQuery {
-	orq.ctx.Offset = &offset
-	return orq
-}
-
-// Unique configures the query builder to filter duplicate records on query.
-// By default, unique is set to true, and can be disabled using this method.
-func (orq *OCIRepositoryQuery) Unique(unique bool) *OCIRepositoryQuery {
-	orq.ctx.Unique = &unique
-	return orq
-}
-
-// Order specifies how the records should be ordered.
-func (orq *OCIRepositoryQuery) Order(o ...ocirepository.OrderOption) *OCIRepositoryQuery {
-	orq.order = append(orq.order, o...)
-	return orq
-}
-
-// QueryOrganization chains the current query on the "organization" edge.
-func (orq *OCIRepositoryQuery) QueryOrganization() *OrganizationQuery {
-	query := (&OrganizationClient{config: orq.config}).Query()
-	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
-		if err := orq.prepareQuery(ctx); err != nil {
-			return nil, err
-		}
-		selector := orq.sqlQuery(ctx)
-		if err := selector.Err(); err != nil {
-			return nil, err
-		}
-		step := sqlgraph.NewStep(
-			sqlgraph.From(ocirepository.Table, ocirepository.FieldID, selector),
-			sqlgraph.To(organization.Table, organization.FieldID),
-			sqlgraph.Edge(sqlgraph.M2O, true, ocirepository.OrganizationTable, ocirepository.OrganizationColumn),
-		)
-		fromU = sqlgraph.SetNeighbors(orq.driver.Dialect(), step)
-		return fromU, nil
-	}
-	return query
-}
-
-// First returns the first OCIRepository entity from the query.
-// Returns a *NotFoundError when no OCIRepository was found.
-func (orq *OCIRepositoryQuery) First(ctx context.Context) (*OCIRepository, error) {
-	nodes, err := orq.Limit(1).All(setContextOp(ctx, orq.ctx, "First"))
-	if err != nil {
-		return nil, err
-	}
-	if len(nodes) == 0 {
-		return nil, &NotFoundError{ocirepository.Label}
-	}
-	return nodes[0], nil
-}
-
-// FirstX is like First, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) FirstX(ctx context.Context) *OCIRepository {
-	node, err := orq.First(ctx)
-	if err != nil && !IsNotFound(err) {
-		panic(err)
-	}
-	return node
-}
-
-// FirstID returns the first OCIRepository ID from the query.
-// Returns a *NotFoundError when no OCIRepository ID was found.
-func (orq *OCIRepositoryQuery) FirstID(ctx context.Context) (id uuid.UUID, err error) {
-	var ids []uuid.UUID
-	if ids, err = orq.Limit(1).IDs(setContextOp(ctx, orq.ctx, "FirstID")); err != nil {
-		return
-	}
-	if len(ids) == 0 {
-		err = &NotFoundError{ocirepository.Label}
-		return
-	}
-	return ids[0], nil
-}
-
-// FirstIDX is like FirstID, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) FirstIDX(ctx context.Context) uuid.UUID {
-	id, err := orq.FirstID(ctx)
-	if err != nil && !IsNotFound(err) {
-		panic(err)
-	}
-	return id
-}
-
-// Only returns a single OCIRepository entity found by the query, ensuring it only returns one.
-// Returns a *NotSingularError when more than one OCIRepository entity is found.
-// Returns a *NotFoundError when no OCIRepository entities are found.
-func (orq *OCIRepositoryQuery) Only(ctx context.Context) (*OCIRepository, error) {
-	nodes, err := orq.Limit(2).All(setContextOp(ctx, orq.ctx, "Only"))
-	if err != nil {
-		return nil, err
-	}
-	switch len(nodes) {
-	case 1:
-		return nodes[0], nil
-	case 0:
-		return nil, &NotFoundError{ocirepository.Label}
-	default:
-		return nil, &NotSingularError{ocirepository.Label}
-	}
-}
-
-// OnlyX is like Only, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) OnlyX(ctx context.Context) *OCIRepository {
-	node, err := orq.Only(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return node
-}
-
-// OnlyID is like Only, but returns the only OCIRepository ID in the query.
-// Returns a *NotSingularError when more than one OCIRepository ID is found.
-// Returns a *NotFoundError when no entities are found.
-func (orq *OCIRepositoryQuery) OnlyID(ctx context.Context) (id uuid.UUID, err error) {
-	var ids []uuid.UUID
-	if ids, err = orq.Limit(2).IDs(setContextOp(ctx, orq.ctx, "OnlyID")); err != nil {
-		return
-	}
-	switch len(ids) {
-	case 1:
-		id = ids[0]
-	case 0:
-		err = &NotFoundError{ocirepository.Label}
-	default:
-		err = &NotSingularError{ocirepository.Label}
-	}
-	return
-}
-
-// OnlyIDX is like OnlyID, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) OnlyIDX(ctx context.Context) uuid.UUID {
-	id, err := orq.OnlyID(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return id
-}
-
-// All executes the query and returns a list of OCIRepositories.
-func (orq *OCIRepositoryQuery) All(ctx context.Context) ([]*OCIRepository, error) {
-	ctx = setContextOp(ctx, orq.ctx, "All")
-	if err := orq.prepareQuery(ctx); err != nil {
-		return nil, err
-	}
-	qr := querierAll[[]*OCIRepository, *OCIRepositoryQuery]()
-	return withInterceptors[[]*OCIRepository](ctx, orq, qr, orq.inters)
-}
-
-// AllX is like All, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) AllX(ctx context.Context) []*OCIRepository {
-	nodes, err := orq.All(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return nodes
-}
-
-// IDs executes the query and returns a list of OCIRepository IDs.
-func (orq *OCIRepositoryQuery) IDs(ctx context.Context) (ids []uuid.UUID, err error) {
-	if orq.ctx.Unique == nil && orq.path != nil {
-		orq.Unique(true)
-	}
-	ctx = setContextOp(ctx, orq.ctx, "IDs")
-	if err = orq.Select(ocirepository.FieldID).Scan(ctx, &ids); err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-// IDsX is like IDs, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) IDsX(ctx context.Context) []uuid.UUID {
-	ids, err := orq.IDs(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return ids
-}
-
-// Count returns the count of the given query.
-func (orq *OCIRepositoryQuery) Count(ctx context.Context) (int, error) {
-	ctx = setContextOp(ctx, orq.ctx, "Count")
-	if err := orq.prepareQuery(ctx); err != nil {
-		return 0, err
-	}
-	return withInterceptors[int](ctx, orq, querierCount[*OCIRepositoryQuery](), orq.inters)
-}
-
-// CountX is like Count, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) CountX(ctx context.Context) int {
-	count, err := orq.Count(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return count
-}
-
-// Exist returns true if the query has elements in the graph.
-func (orq *OCIRepositoryQuery) Exist(ctx context.Context) (bool, error) {
-	ctx = setContextOp(ctx, orq.ctx, "Exist")
-	switch _, err := orq.FirstID(ctx); {
-	case IsNotFound(err):
-		return false, nil
-	case err != nil:
-		return false, fmt.Errorf("ent: check existence: %w", err)
-	default:
-		return true, nil
-	}
-}
-
-// ExistX is like Exist, but panics if an error occurs.
-func (orq *OCIRepositoryQuery) ExistX(ctx context.Context) bool {
-	exist, err := orq.Exist(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return exist
-}
-
-// Clone returns a duplicate of the OCIRepositoryQuery builder, including all associated steps. It can be
-// used to prepare common query builders and use them differently after the clone is made.
-func (orq *OCIRepositoryQuery) Clone() *OCIRepositoryQuery {
-	if orq == nil {
-		return nil
-	}
-	return &OCIRepositoryQuery{
-		config:           orq.config,
-		ctx:              orq.ctx.Clone(),
-		order:            append([]ocirepository.OrderOption{}, orq.order...),
-		inters:           append([]Interceptor{}, orq.inters...),
-		predicates:       append([]predicate.OCIRepository{}, orq.predicates...),
-		withOrganization: orq.withOrganization.Clone(),
-		// clone intermediate query.
-		sql:  orq.sql.Clone(),
-		path: orq.path,
-	}
-}
-
-// WithOrganization tells the query-builder to eager-load the nodes that are connected to
-// the "organization" edge. The optional arguments are used to configure the query builder of the edge.
-func (orq *OCIRepositoryQuery) WithOrganization(opts ...func(*OrganizationQuery)) *OCIRepositoryQuery {
-	query := (&OrganizationClient{config: orq.config}).Query()
-	for _, opt := range opts {
-		opt(query)
-	}
-	orq.withOrganization = query
-	return orq
-}
-
-// GroupBy is used to group vertices by one or more fields/columns.
-// It is often used with aggregate functions, like: count, max, mean, min, sum.
-//
-// Example:
-//
-//	var v []struct {
-//		Repo string `json:"repo,omitempty"`
-//		Count int `json:"count,omitempty"`
-//	}
-//
-//	client.OCIRepository.Query().
-//		GroupBy(ocirepository.FieldRepo).
-//		Aggregate(ent.Count()).
-//		Scan(ctx, &v)
-func (orq *OCIRepositoryQuery) GroupBy(field string, fields ...string) *OCIRepositoryGroupBy {
-	orq.ctx.Fields = append([]string{field}, fields...)
-	grbuild := &OCIRepositoryGroupBy{build: orq}
-	grbuild.flds = &orq.ctx.Fields
-	grbuild.label = ocirepository.Label
-	grbuild.scan = grbuild.Scan
-	return grbuild
-}
-
-// Select allows the selection one or more fields/columns for the given query,
-// instead of selecting all fields in the entity.
-//
-// Example:
-//
-//	var v []struct {
-//		Repo string `json:"repo,omitempty"`
-//	}
-//
-//	client.OCIRepository.Query().
-//		Select(ocirepository.FieldRepo).
-//		Scan(ctx, &v)
-func (orq *OCIRepositoryQuery) Select(fields ...string) *OCIRepositorySelect {
-	orq.ctx.Fields = append(orq.ctx.Fields, fields...)
-	sbuild := &OCIRepositorySelect{OCIRepositoryQuery: orq}
-	sbuild.label = ocirepository.Label
-	sbuild.flds, sbuild.scan = &orq.ctx.Fields, sbuild.Scan
-	return sbuild
-}
-
-// Aggregate returns a OCIRepositorySelect configured with the given aggregations.
-func (orq *OCIRepositoryQuery) Aggregate(fns ...AggregateFunc) *OCIRepositorySelect {
-	return orq.Select().Aggregate(fns...)
-}
-
-func (orq *OCIRepositoryQuery) prepareQuery(ctx context.Context) error {
-	for _, inter := range orq.inters {
-		if inter == nil {
-			return fmt.Errorf("ent: uninitialized interceptor (forgotten import ent/runtime?)")
-		}
-		if trv, ok := inter.(Traverser); ok {
-			if err := trv.Traverse(ctx, orq); err != nil {
-				return err
-			}
-		}
-	}
-	for _, f := range orq.ctx.Fields {
-		if !ocirepository.ValidColumn(f) {
-			return &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
-		}
-	}
-	if orq.path != nil {
-		prev, err := orq.path(ctx)
-		if err != nil {
-			return err
-		}
-		orq.sql = prev
-	}
-	return nil
-}
-
-func (orq *OCIRepositoryQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*OCIRepository, error) {
-	var (
-		nodes       = []*OCIRepository{}
-		withFKs     = orq.withFKs
-		_spec       = orq.querySpec()
-		loadedTypes = [1]bool{
-			orq.withOrganization != nil,
-		}
-	)
-	if orq.withOrganization != nil {
-		withFKs = true
-	}
-	if withFKs {
-		_spec.Node.Columns = append(_spec.Node.Columns, ocirepository.ForeignKeys...)
-	}
-	_spec.ScanValues = func(columns []string) ([]any, error) {
-		return (*OCIRepository).scanValues(nil, columns)
-	}
-	_spec.Assign = func(columns []string, values []any) error {
-		node := &OCIRepository{config: orq.config}
-		nodes = append(nodes, node)
-		node.Edges.loadedTypes = loadedTypes
-		return node.assignValues(columns, values)
-	}
-	for i := range hooks {
-		hooks[i](ctx, _spec)
-	}
-	if err := sqlgraph.QueryNodes(ctx, orq.driver, _spec); err != nil {
-		return nil, err
-	}
-	if len(nodes) == 0 {
-		return nodes, nil
-	}
-	if query := orq.withOrganization; query != nil {
-		if err := orq.loadOrganization(ctx, query, nodes, nil,
-			func(n *OCIRepository, e *Organization) { n.Edges.Organization = e }); err != nil {
-			return nil, err
-		}
-	}
-	return nodes, nil
-}
-
-func (orq *OCIRepositoryQuery) loadOrganization(ctx context.Context, query *OrganizationQuery, nodes []*OCIRepository, init func(*OCIRepository), assign func(*OCIRepository, *Organization)) error {
-	ids := make([]uuid.UUID, 0, len(nodes))
-	nodeids := make(map[uuid.UUID][]*OCIRepository)
-	for i := range nodes {
-		if nodes[i].organization_oci_repositories == nil {
-			continue
-		}
-		fk := *nodes[i].organization_oci_repositories
-		if _, ok := nodeids[fk]; !ok {
-			ids = append(ids, fk)
-		}
-		nodeids[fk] = append(nodeids[fk], nodes[i])
-	}
-	if len(ids) == 0 {
-		return nil
-	}
-	query.Where(organization.IDIn(ids...))
-	neighbors, err := query.All(ctx)
-	if err != nil {
-		return err
-	}
-	for _, n := range neighbors {
-		nodes, ok := nodeids[n.ID]
-		if !ok {
-			return fmt.Errorf(`unexpected foreign-key "organization_oci_repositories" returned %v`, n.ID)
-		}
-		for i := range nodes {
-			assign(nodes[i], n)
-		}
-	}
-	return nil
-}
-
-func (orq *OCIRepositoryQuery) sqlCount(ctx context.Context) (int, error) {
-	_spec := orq.querySpec()
-	_spec.Node.Columns = orq.ctx.Fields
-	if len(orq.ctx.Fields) > 0 {
-		_spec.Unique = orq.ctx.Unique != nil && *orq.ctx.Unique
-	}
-	return sqlgraph.CountNodes(ctx, orq.driver, _spec)
-}
-
-func (orq *OCIRepositoryQuery) querySpec() *sqlgraph.QuerySpec {
-	_spec := sqlgraph.NewQuerySpec(ocirepository.Table, ocirepository.Columns, sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID))
-	_spec.From = orq.sql
-	if unique := orq.ctx.Unique; unique != nil {
-		_spec.Unique = *unique
-	} else if orq.path != nil {
-		_spec.Unique = true
-	}
-	if fields := orq.ctx.Fields; len(fields) > 0 {
-		_spec.Node.Columns = make([]string, 0, len(fields))
-		_spec.Node.Columns = append(_spec.Node.Columns, ocirepository.FieldID)
-		for i := range fields {
-			if fields[i] != ocirepository.FieldID {
-				_spec.Node.Columns = append(_spec.Node.Columns, fields[i])
-			}
-		}
-	}
-	if ps := orq.predicates; len(ps) > 0 {
-		_spec.Predicate = func(selector *sql.Selector) {
-			for i := range ps {
-				ps[i](selector)
-			}
-		}
-	}
-	if limit := orq.ctx.Limit; limit != nil {
-		_spec.Limit = *limit
-	}
-	if offset := orq.ctx.Offset; offset != nil {
-		_spec.Offset = *offset
-	}
-	if ps := orq.order; len(ps) > 0 {
-		_spec.Order = func(selector *sql.Selector) {
-			for i := range ps {
-				ps[i](selector)
-			}
-		}
-	}
-	return _spec
-}
-
-func (orq *OCIRepositoryQuery) sqlQuery(ctx context.Context) *sql.Selector {
-	builder := sql.Dialect(orq.driver.Dialect())
-	t1 := builder.Table(ocirepository.Table)
-	columns := orq.ctx.Fields
-	if len(columns) == 0 {
-		columns = ocirepository.Columns
-	}
-	selector := builder.Select(t1.Columns(columns...)...).From(t1)
-	if orq.sql != nil {
-		selector = orq.sql
-		selector.Select(selector.Columns(columns...)...)
-	}
-	if orq.ctx.Unique != nil && *orq.ctx.Unique {
-		selector.Distinct()
-	}
-	for _, p := range orq.predicates {
-		p(selector)
-	}
-	for _, p := range orq.order {
-		p(selector)
-	}
-	if offset := orq.ctx.Offset; offset != nil {
-		// limit is mandatory for offset clause. We start
-		// with default value, and override it below if needed.
-		selector.Offset(*offset).Limit(math.MaxInt32)
-	}
-	if limit := orq.ctx.Limit; limit != nil {
-		selector.Limit(*limit)
-	}
-	return selector
-}
-
-// OCIRepositoryGroupBy is the group-by builder for OCIRepository entities.
-type OCIRepositoryGroupBy struct {
-	selector
-	build *OCIRepositoryQuery
-}
-
-// Aggregate adds the given aggregation functions to the group-by query.
-func (orgb *OCIRepositoryGroupBy) Aggregate(fns ...AggregateFunc) *OCIRepositoryGroupBy {
-	orgb.fns = append(orgb.fns, fns...)
-	return orgb
-}
-
-// Scan applies the selector query and scans the result into the given value.
-func (orgb *OCIRepositoryGroupBy) Scan(ctx context.Context, v any) error {
-	ctx = setContextOp(ctx, orgb.build.ctx, "GroupBy")
-	if err := orgb.build.prepareQuery(ctx); err != nil {
-		return err
-	}
-	return scanWithInterceptors[*OCIRepositoryQuery, *OCIRepositoryGroupBy](ctx, orgb.build, orgb, orgb.build.inters, v)
-}
-
-func (orgb *OCIRepositoryGroupBy) sqlScan(ctx context.Context, root *OCIRepositoryQuery, v any) error {
-	selector := root.sqlQuery(ctx).Select()
-	aggregation := make([]string, 0, len(orgb.fns))
-	for _, fn := range orgb.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	if len(selector.SelectedColumns()) == 0 {
-		columns := make([]string, 0, len(*orgb.flds)+len(orgb.fns))
-		for _, f := range *orgb.flds {
-			columns = append(columns, selector.C(f))
-		}
-		columns = append(columns, aggregation...)
-		selector.Select(columns...)
-	}
-	selector.GroupBy(selector.Columns(*orgb.flds...)...)
-	if err := selector.Err(); err != nil {
-		return err
-	}
-	rows := &sql.Rows{}
-	query, args := selector.Query()
-	if err := orgb.build.driver.Query(ctx, query, args, rows); err != nil {
-		return err
-	}
-	defer rows.Close()
-	return sql.ScanSlice(rows, v)
-}
-
-// OCIRepositorySelect is the builder for selecting fields of OCIRepository entities.
-type OCIRepositorySelect struct {
-	*OCIRepositoryQuery
-	selector
-}
-
-// Aggregate adds the given aggregation functions to the selector query.
-func (ors *OCIRepositorySelect) Aggregate(fns ...AggregateFunc) *OCIRepositorySelect {
-	ors.fns = append(ors.fns, fns...)
-	return ors
-}
-
-// Scan applies the selector query and scans the result into the given value.
-func (ors *OCIRepositorySelect) Scan(ctx context.Context, v any) error {
-	ctx = setContextOp(ctx, ors.ctx, "Select")
-	if err := ors.prepareQuery(ctx); err != nil {
-		return err
-	}
-	return scanWithInterceptors[*OCIRepositoryQuery, *OCIRepositorySelect](ctx, ors.OCIRepositoryQuery, ors, ors.inters, v)
-}
-
-func (ors *OCIRepositorySelect) sqlScan(ctx context.Context, root *OCIRepositoryQuery, v any) error {
-	selector := root.sqlQuery(ctx)
-	aggregation := make([]string, 0, len(ors.fns))
-	for _, fn := range ors.fns {
-		aggregation = append(aggregation, fn(selector))
-	}
-	switch n := len(*ors.selector.flds); {
-	case n == 0 && len(aggregation) > 0:
-		selector.Select(aggregation...)
-	case n != 0 && len(aggregation) > 0:
-		selector.AppendSelect(aggregation...)
-	}
-	rows := &sql.Rows{}
-	query, args := selector.Query()
-	if err := ors.driver.Query(ctx, query, args, rows); err != nil {
-		return err
-	}
-	defer rows.Close()
-	return sql.ScanSlice(rows, v)
-}
diff --git a/app/controlplane/internal/data/ent/ocirepository_update.go b/app/controlplane/internal/data/ent/ocirepository_update.go
deleted file mode 100644
index f2e0e7cb0..000000000
--- a/app/controlplane/internal/data/ent/ocirepository_update.go
+++ /dev/null
@@ -1,407 +0,0 @@
-// Code generated by ent, DO NOT EDIT.
-
-package ent
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"entgo.io/ent/dialect/sql"
-	"entgo.io/ent/dialect/sql/sqlgraph"
-	"entgo.io/ent/schema/field"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
-	"github.com/google/uuid"
-)
-
-// OCIRepositoryUpdate is the builder for updating OCIRepository entities.
-type OCIRepositoryUpdate struct {
-	config
-	hooks    []Hook
-	mutation *OCIRepositoryMutation
-}
-
-// Where appends a list predicates to the OCIRepositoryUpdate builder.
-func (oru *OCIRepositoryUpdate) Where(ps ...predicate.OCIRepository) *OCIRepositoryUpdate {
-	oru.mutation.Where(ps...)
-	return oru
-}
-
-// SetRepo sets the "repo" field.
-func (oru *OCIRepositoryUpdate) SetRepo(s string) *OCIRepositoryUpdate {
-	oru.mutation.SetRepo(s)
-	return oru
-}
-
-// SetSecretName sets the "secret_name" field.
-func (oru *OCIRepositoryUpdate) SetSecretName(s string) *OCIRepositoryUpdate {
-	oru.mutation.SetSecretName(s)
-	return oru
-}
-
-// SetValidationStatus sets the "validation_status" field.
-func (oru *OCIRepositoryUpdate) SetValidationStatus(brvs biz.OCIRepoValidationStatus) *OCIRepositoryUpdate {
-	oru.mutation.SetValidationStatus(brvs)
-	return oru
-}
-
-// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
-func (oru *OCIRepositoryUpdate) SetNillableValidationStatus(brvs *biz.OCIRepoValidationStatus) *OCIRepositoryUpdate {
-	if brvs != nil {
-		oru.SetValidationStatus(*brvs)
-	}
-	return oru
-}
-
-// SetValidatedAt sets the "validated_at" field.
-func (oru *OCIRepositoryUpdate) SetValidatedAt(t time.Time) *OCIRepositoryUpdate {
-	oru.mutation.SetValidatedAt(t)
-	return oru
-}
-
-// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
-func (oru *OCIRepositoryUpdate) SetNillableValidatedAt(t *time.Time) *OCIRepositoryUpdate {
-	if t != nil {
-		oru.SetValidatedAt(*t)
-	}
-	return oru
-}
-
-// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
-func (oru *OCIRepositoryUpdate) SetOrganizationID(id uuid.UUID) *OCIRepositoryUpdate {
-	oru.mutation.SetOrganizationID(id)
-	return oru
-}
-
-// SetOrganization sets the "organization" edge to the Organization entity.
-func (oru *OCIRepositoryUpdate) SetOrganization(o *Organization) *OCIRepositoryUpdate {
-	return oru.SetOrganizationID(o.ID)
-}
-
-// Mutation returns the OCIRepositoryMutation object of the builder.
-func (oru *OCIRepositoryUpdate) Mutation() *OCIRepositoryMutation {
-	return oru.mutation
-}
-
-// ClearOrganization clears the "organization" edge to the Organization entity.
-func (oru *OCIRepositoryUpdate) ClearOrganization() *OCIRepositoryUpdate {
-	oru.mutation.ClearOrganization()
-	return oru
-}
-
-// Save executes the query and returns the number of nodes affected by the update operation.
-func (oru *OCIRepositoryUpdate) Save(ctx context.Context) (int, error) {
-	return withHooks(ctx, oru.sqlSave, oru.mutation, oru.hooks)
-}
-
-// SaveX is like Save, but panics if an error occurs.
-func (oru *OCIRepositoryUpdate) SaveX(ctx context.Context) int {
-	affected, err := oru.Save(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return affected
-}
-
-// Exec executes the query.
-func (oru *OCIRepositoryUpdate) Exec(ctx context.Context) error {
-	_, err := oru.Save(ctx)
-	return err
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (oru *OCIRepositoryUpdate) ExecX(ctx context.Context) {
-	if err := oru.Exec(ctx); err != nil {
-		panic(err)
-	}
-}
-
-// check runs all checks and user-defined validators on the builder.
-func (oru *OCIRepositoryUpdate) check() error {
-	if v, ok := oru.mutation.ValidationStatus(); ok {
-		if err := ocirepository.ValidationStatusValidator(v); err != nil {
-			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "OCIRepository.validation_status": %w`, err)}
-		}
-	}
-	if _, ok := oru.mutation.OrganizationID(); oru.mutation.OrganizationCleared() && !ok {
-		return errors.New(`ent: clearing a required unique edge "OCIRepository.organization"`)
-	}
-	return nil
-}
-
-func (oru *OCIRepositoryUpdate) sqlSave(ctx context.Context) (n int, err error) {
-	if err := oru.check(); err != nil {
-		return n, err
-	}
-	_spec := sqlgraph.NewUpdateSpec(ocirepository.Table, ocirepository.Columns, sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID))
-	if ps := oru.mutation.predicates; len(ps) > 0 {
-		_spec.Predicate = func(selector *sql.Selector) {
-			for i := range ps {
-				ps[i](selector)
-			}
-		}
-	}
-	if value, ok := oru.mutation.Repo(); ok {
-		_spec.SetField(ocirepository.FieldRepo, field.TypeString, value)
-	}
-	if value, ok := oru.mutation.SecretName(); ok {
-		_spec.SetField(ocirepository.FieldSecretName, field.TypeString, value)
-	}
-	if value, ok := oru.mutation.ValidationStatus(); ok {
-		_spec.SetField(ocirepository.FieldValidationStatus, field.TypeEnum, value)
-	}
-	if value, ok := oru.mutation.ValidatedAt(); ok {
-		_spec.SetField(ocirepository.FieldValidatedAt, field.TypeTime, value)
-	}
-	if oru.mutation.OrganizationCleared() {
-		edge := &sqlgraph.EdgeSpec{
-			Rel:     sqlgraph.M2O,
-			Inverse: true,
-			Table:   ocirepository.OrganizationTable,
-			Columns: []string{ocirepository.OrganizationColumn},
-			Bidi:    false,
-			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
-			},
-		}
-		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
-	}
-	if nodes := oru.mutation.OrganizationIDs(); len(nodes) > 0 {
-		edge := &sqlgraph.EdgeSpec{
-			Rel:     sqlgraph.M2O,
-			Inverse: true,
-			Table:   ocirepository.OrganizationTable,
-			Columns: []string{ocirepository.OrganizationColumn},
-			Bidi:    false,
-			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
-			},
-		}
-		for _, k := range nodes {
-			edge.Target.Nodes = append(edge.Target.Nodes, k)
-		}
-		_spec.Edges.Add = append(_spec.Edges.Add, edge)
-	}
-	if n, err = sqlgraph.UpdateNodes(ctx, oru.driver, _spec); err != nil {
-		if _, ok := err.(*sqlgraph.NotFoundError); ok {
-			err = &NotFoundError{ocirepository.Label}
-		} else if sqlgraph.IsConstraintError(err) {
-			err = &ConstraintError{msg: err.Error(), wrap: err}
-		}
-		return 0, err
-	}
-	oru.mutation.done = true
-	return n, nil
-}
-
-// OCIRepositoryUpdateOne is the builder for updating a single OCIRepository entity.
-type OCIRepositoryUpdateOne struct {
-	config
-	fields   []string
-	hooks    []Hook
-	mutation *OCIRepositoryMutation
-}
-
-// SetRepo sets the "repo" field.
-func (oruo *OCIRepositoryUpdateOne) SetRepo(s string) *OCIRepositoryUpdateOne {
-	oruo.mutation.SetRepo(s)
-	return oruo
-}
-
-// SetSecretName sets the "secret_name" field.
-func (oruo *OCIRepositoryUpdateOne) SetSecretName(s string) *OCIRepositoryUpdateOne {
-	oruo.mutation.SetSecretName(s)
-	return oruo
-}
-
-// SetValidationStatus sets the "validation_status" field.
-func (oruo *OCIRepositoryUpdateOne) SetValidationStatus(brvs biz.OCIRepoValidationStatus) *OCIRepositoryUpdateOne {
-	oruo.mutation.SetValidationStatus(brvs)
-	return oruo
-}
-
-// SetNillableValidationStatus sets the "validation_status" field if the given value is not nil.
-func (oruo *OCIRepositoryUpdateOne) SetNillableValidationStatus(brvs *biz.OCIRepoValidationStatus) *OCIRepositoryUpdateOne {
-	if brvs != nil {
-		oruo.SetValidationStatus(*brvs)
-	}
-	return oruo
-}
-
-// SetValidatedAt sets the "validated_at" field.
-func (oruo *OCIRepositoryUpdateOne) SetValidatedAt(t time.Time) *OCIRepositoryUpdateOne {
-	oruo.mutation.SetValidatedAt(t)
-	return oruo
-}
-
-// SetNillableValidatedAt sets the "validated_at" field if the given value is not nil.
-func (oruo *OCIRepositoryUpdateOne) SetNillableValidatedAt(t *time.Time) *OCIRepositoryUpdateOne {
-	if t != nil {
-		oruo.SetValidatedAt(*t)
-	}
-	return oruo
-}
-
-// SetOrganizationID sets the "organization" edge to the Organization entity by ID.
-func (oruo *OCIRepositoryUpdateOne) SetOrganizationID(id uuid.UUID) *OCIRepositoryUpdateOne {
-	oruo.mutation.SetOrganizationID(id)
-	return oruo
-}
-
-// SetOrganization sets the "organization" edge to the Organization entity.
-func (oruo *OCIRepositoryUpdateOne) SetOrganization(o *Organization) *OCIRepositoryUpdateOne {
-	return oruo.SetOrganizationID(o.ID)
-}
-
-// Mutation returns the OCIRepositoryMutation object of the builder.
-func (oruo *OCIRepositoryUpdateOne) Mutation() *OCIRepositoryMutation {
-	return oruo.mutation
-}
-
-// ClearOrganization clears the "organization" edge to the Organization entity.
-func (oruo *OCIRepositoryUpdateOne) ClearOrganization() *OCIRepositoryUpdateOne {
-	oruo.mutation.ClearOrganization()
-	return oruo
-}
-
-// Where appends a list predicates to the OCIRepositoryUpdate builder.
-func (oruo *OCIRepositoryUpdateOne) Where(ps ...predicate.OCIRepository) *OCIRepositoryUpdateOne {
-	oruo.mutation.Where(ps...)
-	return oruo
-}
-
-// Select allows selecting one or more fields (columns) of the returned entity.
-// The default is selecting all fields defined in the entity schema.
-func (oruo *OCIRepositoryUpdateOne) Select(field string, fields ...string) *OCIRepositoryUpdateOne {
-	oruo.fields = append([]string{field}, fields...)
-	return oruo
-}
-
-// Save executes the query and returns the updated OCIRepository entity.
-func (oruo *OCIRepositoryUpdateOne) Save(ctx context.Context) (*OCIRepository, error) {
-	return withHooks(ctx, oruo.sqlSave, oruo.mutation, oruo.hooks)
-}
-
-// SaveX is like Save, but panics if an error occurs.
-func (oruo *OCIRepositoryUpdateOne) SaveX(ctx context.Context) *OCIRepository {
-	node, err := oruo.Save(ctx)
-	if err != nil {
-		panic(err)
-	}
-	return node
-}
-
-// Exec executes the query on the entity.
-func (oruo *OCIRepositoryUpdateOne) Exec(ctx context.Context) error {
-	_, err := oruo.Save(ctx)
-	return err
-}
-
-// ExecX is like Exec, but panics if an error occurs.
-func (oruo *OCIRepositoryUpdateOne) ExecX(ctx context.Context) {
-	if err := oruo.Exec(ctx); err != nil {
-		panic(err)
-	}
-}
-
-// check runs all checks and user-defined validators on the builder.
-func (oruo *OCIRepositoryUpdateOne) check() error {
-	if v, ok := oruo.mutation.ValidationStatus(); ok {
-		if err := ocirepository.ValidationStatusValidator(v); err != nil {
-			return &ValidationError{Name: "validation_status", err: fmt.Errorf(`ent: validator failed for field "OCIRepository.validation_status": %w`, err)}
-		}
-	}
-	if _, ok := oruo.mutation.OrganizationID(); oruo.mutation.OrganizationCleared() && !ok {
-		return errors.New(`ent: clearing a required unique edge "OCIRepository.organization"`)
-	}
-	return nil
-}
-
-func (oruo *OCIRepositoryUpdateOne) sqlSave(ctx context.Context) (_node *OCIRepository, err error) {
-	if err := oruo.check(); err != nil {
-		return _node, err
-	}
-	_spec := sqlgraph.NewUpdateSpec(ocirepository.Table, ocirepository.Columns, sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID))
-	id, ok := oruo.mutation.ID()
-	if !ok {
-		return nil, &ValidationError{Name: "id", err: errors.New(`ent: missing "OCIRepository.id" for update`)}
-	}
-	_spec.Node.ID.Value = id
-	if fields := oruo.fields; len(fields) > 0 {
-		_spec.Node.Columns = make([]string, 0, len(fields))
-		_spec.Node.Columns = append(_spec.Node.Columns, ocirepository.FieldID)
-		for _, f := range fields {
-			if !ocirepository.ValidColumn(f) {
-				return nil, &ValidationError{Name: f, err: fmt.Errorf("ent: invalid field %q for query", f)}
-			}
-			if f != ocirepository.FieldID {
-				_spec.Node.Columns = append(_spec.Node.Columns, f)
-			}
-		}
-	}
-	if ps := oruo.mutation.predicates; len(ps) > 0 {
-		_spec.Predicate = func(selector *sql.Selector) {
-			for i := range ps {
-				ps[i](selector)
-			}
-		}
-	}
-	if value, ok := oruo.mutation.Repo(); ok {
-		_spec.SetField(ocirepository.FieldRepo, field.TypeString, value)
-	}
-	if value, ok := oruo.mutation.SecretName(); ok {
-		_spec.SetField(ocirepository.FieldSecretName, field.TypeString, value)
-	}
-	if value, ok := oruo.mutation.ValidationStatus(); ok {
-		_spec.SetField(ocirepository.FieldValidationStatus, field.TypeEnum, value)
-	}
-	if value, ok := oruo.mutation.ValidatedAt(); ok {
-		_spec.SetField(ocirepository.FieldValidatedAt, field.TypeTime, value)
-	}
-	if oruo.mutation.OrganizationCleared() {
-		edge := &sqlgraph.EdgeSpec{
-			Rel:     sqlgraph.M2O,
-			Inverse: true,
-			Table:   ocirepository.OrganizationTable,
-			Columns: []string{ocirepository.OrganizationColumn},
-			Bidi:    false,
-			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
-			},
-		}
-		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
-	}
-	if nodes := oruo.mutation.OrganizationIDs(); len(nodes) > 0 {
-		edge := &sqlgraph.EdgeSpec{
-			Rel:     sqlgraph.M2O,
-			Inverse: true,
-			Table:   ocirepository.OrganizationTable,
-			Columns: []string{ocirepository.OrganizationColumn},
-			Bidi:    false,
-			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(organization.FieldID, field.TypeUUID),
-			},
-		}
-		for _, k := range nodes {
-			edge.Target.Nodes = append(edge.Target.Nodes, k)
-		}
-		_spec.Edges.Add = append(_spec.Edges.Add, edge)
-	}
-	_node = &OCIRepository{config: oruo.config}
-	_spec.Assign = _node.assignValues
-	_spec.ScanValues = _node.scanValues
-	if err = sqlgraph.UpdateNode(ctx, oruo.driver, _spec); err != nil {
-		if _, ok := err.(*sqlgraph.NotFoundError); ok {
-			err = &NotFoundError{ocirepository.Label}
-		} else if sqlgraph.IsConstraintError(err) {
-			err = &ConstraintError{msg: err.Error(), wrap: err}
-		}
-		return nil, err
-	}
-	oruo.mutation.done = true
-	return _node, nil
-}
diff --git a/app/controlplane/internal/data/ent/organization.go b/app/controlplane/internal/data/ent/organization.go
index e5c3a6b53..7930ab825 100644
--- a/app/controlplane/internal/data/ent/organization.go
+++ b/app/controlplane/internal/data/ent/organization.go
@@ -36,8 +36,8 @@ type OrganizationEdges struct {
 	WorkflowContracts []*WorkflowContract `json:"workflow_contracts,omitempty"`
 	// Workflows holds the value of the workflows edge.
 	Workflows []*Workflow `json:"workflows,omitempty"`
-	// OciRepositories holds the value of the oci_repositories edge.
-	OciRepositories []*OCIRepository `json:"oci_repositories,omitempty"`
+	// CasBackends holds the value of the cas_backends edge.
+	CasBackends []*CASBackend `json:"cas_backends,omitempty"`
 	// Integrations holds the value of the integrations edge.
 	Integrations []*Integration `json:"integrations,omitempty"`
 	// loadedTypes holds the information for reporting if a
@@ -72,13 +72,13 @@ func (e OrganizationEdges) WorkflowsOrErr() ([]*Workflow, error) {
 	return nil, &NotLoadedError{edge: "workflows"}
 }
 
-// OciRepositoriesOrErr returns the OciRepositories value or an error if the edge
+// CasBackendsOrErr returns the CasBackends value or an error if the edge
 // was not loaded in eager-loading.
-func (e OrganizationEdges) OciRepositoriesOrErr() ([]*OCIRepository, error) {
+func (e OrganizationEdges) CasBackendsOrErr() ([]*CASBackend, error) {
 	if e.loadedTypes[3] {
-		return e.OciRepositories, nil
+		return e.CasBackends, nil
 	}
-	return nil, &NotLoadedError{edge: "oci_repositories"}
+	return nil, &NotLoadedError{edge: "cas_backends"}
 }
 
 // IntegrationsOrErr returns the Integrations value or an error if the edge
@@ -162,9 +162,9 @@ func (o *Organization) QueryWorkflows() *WorkflowQuery {
 	return NewOrganizationClient(o.config).QueryWorkflows(o)
 }
 
-// QueryOciRepositories queries the "oci_repositories" edge of the Organization entity.
-func (o *Organization) QueryOciRepositories() *OCIRepositoryQuery {
-	return NewOrganizationClient(o.config).QueryOciRepositories(o)
+// QueryCasBackends queries the "cas_backends" edge of the Organization entity.
+func (o *Organization) QueryCasBackends() *CASBackendQuery {
+	return NewOrganizationClient(o.config).QueryCasBackends(o)
 }
 
 // QueryIntegrations queries the "integrations" edge of the Organization entity.
diff --git a/app/controlplane/internal/data/ent/organization/organization.go b/app/controlplane/internal/data/ent/organization/organization.go
index f2c5169af..5c1ccaf97 100644
--- a/app/controlplane/internal/data/ent/organization/organization.go
+++ b/app/controlplane/internal/data/ent/organization/organization.go
@@ -25,8 +25,8 @@ const (
 	EdgeWorkflowContracts = "workflow_contracts"
 	// EdgeWorkflows holds the string denoting the workflows edge name in mutations.
 	EdgeWorkflows = "workflows"
-	// EdgeOciRepositories holds the string denoting the oci_repositories edge name in mutations.
-	EdgeOciRepositories = "oci_repositories"
+	// EdgeCasBackends holds the string denoting the cas_backends edge name in mutations.
+	EdgeCasBackends = "cas_backends"
 	// EdgeIntegrations holds the string denoting the integrations edge name in mutations.
 	EdgeIntegrations = "integrations"
 	// Table holds the table name of the organization in the database.
@@ -52,13 +52,13 @@ const (
 	WorkflowsInverseTable = "workflows"
 	// WorkflowsColumn is the table column denoting the workflows relation/edge.
 	WorkflowsColumn = "organization_id"
-	// OciRepositoriesTable is the table that holds the oci_repositories relation/edge.
-	OciRepositoriesTable = "oci_repositories"
-	// OciRepositoriesInverseTable is the table name for the OCIRepository entity.
-	// It exists in this package in order to avoid circular dependency with the "ocirepository" package.
-	OciRepositoriesInverseTable = "oci_repositories"
-	// OciRepositoriesColumn is the table column denoting the oci_repositories relation/edge.
-	OciRepositoriesColumn = "organization_oci_repositories"
+	// CasBackendsTable is the table that holds the cas_backends relation/edge.
+	CasBackendsTable = "cas_backends"
+	// CasBackendsInverseTable is the table name for the CASBackend entity.
+	// It exists in this package in order to avoid circular dependency with the "casbackend" package.
+	CasBackendsInverseTable = "cas_backends"
+	// CasBackendsColumn is the table column denoting the cas_backends relation/edge.
+	CasBackendsColumn = "organization_cas_backends"
 	// IntegrationsTable is the table that holds the integrations relation/edge.
 	IntegrationsTable = "integrations"
 	// IntegrationsInverseTable is the table name for the Integration entity.
@@ -154,17 +154,17 @@ func ByWorkflows(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
 	}
 }
 
-// ByOciRepositoriesCount orders the results by oci_repositories count.
-func ByOciRepositoriesCount(opts ...sql.OrderTermOption) OrderOption {
+// ByCasBackendsCount orders the results by cas_backends count.
+func ByCasBackendsCount(opts ...sql.OrderTermOption) OrderOption {
 	return func(s *sql.Selector) {
-		sqlgraph.OrderByNeighborsCount(s, newOciRepositoriesStep(), opts...)
+		sqlgraph.OrderByNeighborsCount(s, newCasBackendsStep(), opts...)
 	}
 }
 
-// ByOciRepositories orders the results by oci_repositories terms.
-func ByOciRepositories(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
+// ByCasBackends orders the results by cas_backends terms.
+func ByCasBackends(term sql.OrderTerm, terms ...sql.OrderTerm) OrderOption {
 	return func(s *sql.Selector) {
-		sqlgraph.OrderByNeighborTerms(s, newOciRepositoriesStep(), append([]sql.OrderTerm{term}, terms...)...)
+		sqlgraph.OrderByNeighborTerms(s, newCasBackendsStep(), append([]sql.OrderTerm{term}, terms...)...)
 	}
 }
 
@@ -202,11 +202,11 @@ func newWorkflowsStep() *sqlgraph.Step {
 		sqlgraph.Edge(sqlgraph.O2M, false, WorkflowsTable, WorkflowsColumn),
 	)
 }
-func newOciRepositoriesStep() *sqlgraph.Step {
+func newCasBackendsStep() *sqlgraph.Step {
 	return sqlgraph.NewStep(
 		sqlgraph.From(Table, FieldID),
-		sqlgraph.To(OciRepositoriesInverseTable, FieldID),
-		sqlgraph.Edge(sqlgraph.O2M, false, OciRepositoriesTable, OciRepositoriesColumn),
+		sqlgraph.To(CasBackendsInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.O2M, false, CasBackendsTable, CasBackendsColumn),
 	)
 }
 func newIntegrationsStep() *sqlgraph.Step {
diff --git a/app/controlplane/internal/data/ent/organization/where.go b/app/controlplane/internal/data/ent/organization/where.go
index c4a09281f..292eb826b 100644
--- a/app/controlplane/internal/data/ent/organization/where.go
+++ b/app/controlplane/internal/data/ent/organization/where.go
@@ -240,21 +240,21 @@ func HasWorkflowsWith(preds ...predicate.Workflow) predicate.Organization {
 	})
 }
 
-// HasOciRepositories applies the HasEdge predicate on the "oci_repositories" edge.
-func HasOciRepositories() predicate.Organization {
+// HasCasBackends applies the HasEdge predicate on the "cas_backends" edge.
+func HasCasBackends() predicate.Organization {
 	return predicate.Organization(func(s *sql.Selector) {
 		step := sqlgraph.NewStep(
 			sqlgraph.From(Table, FieldID),
-			sqlgraph.Edge(sqlgraph.O2M, false, OciRepositoriesTable, OciRepositoriesColumn),
+			sqlgraph.Edge(sqlgraph.O2M, false, CasBackendsTable, CasBackendsColumn),
 		)
 		sqlgraph.HasNeighbors(s, step)
 	})
 }
 
-// HasOciRepositoriesWith applies the HasEdge predicate on the "oci_repositories" edge with a given conditions (other predicates).
-func HasOciRepositoriesWith(preds ...predicate.OCIRepository) predicate.Organization {
+// HasCasBackendsWith applies the HasEdge predicate on the "cas_backends" edge with a given conditions (other predicates).
+func HasCasBackendsWith(preds ...predicate.CASBackend) predicate.Organization {
 	return predicate.Organization(func(s *sql.Selector) {
-		step := newOciRepositoriesStep()
+		step := newCasBackendsStep()
 		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
 			for _, p := range preds {
 				p(s)
diff --git a/app/controlplane/internal/data/ent/organization_create.go b/app/controlplane/internal/data/ent/organization_create.go
index bb8478ca1..74c3634c3 100644
--- a/app/controlplane/internal/data/ent/organization_create.go
+++ b/app/controlplane/internal/data/ent/organization_create.go
@@ -10,9 +10,9 @@ import (
 
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/workflow"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/workflowcontract"
@@ -113,19 +113,19 @@ func (oc *OrganizationCreate) AddWorkflows(w ...*Workflow) *OrganizationCreate {
 	return oc.AddWorkflowIDs(ids...)
 }
 
-// AddOciRepositoryIDs adds the "oci_repositories" edge to the OCIRepository entity by IDs.
-func (oc *OrganizationCreate) AddOciRepositoryIDs(ids ...uuid.UUID) *OrganizationCreate {
-	oc.mutation.AddOciRepositoryIDs(ids...)
+// AddCasBackendIDs adds the "cas_backends" edge to the CASBackend entity by IDs.
+func (oc *OrganizationCreate) AddCasBackendIDs(ids ...uuid.UUID) *OrganizationCreate {
+	oc.mutation.AddCasBackendIDs(ids...)
 	return oc
 }
 
-// AddOciRepositories adds the "oci_repositories" edges to the OCIRepository entity.
-func (oc *OrganizationCreate) AddOciRepositories(o ...*OCIRepository) *OrganizationCreate {
-	ids := make([]uuid.UUID, len(o))
-	for i := range o {
-		ids[i] = o[i].ID
+// AddCasBackends adds the "cas_backends" edges to the CASBackend entity.
+func (oc *OrganizationCreate) AddCasBackends(c ...*CASBackend) *OrganizationCreate {
+	ids := make([]uuid.UUID, len(c))
+	for i := range c {
+		ids[i] = c[i].ID
 	}
-	return oc.AddOciRepositoryIDs(ids...)
+	return oc.AddCasBackendIDs(ids...)
 }
 
 // AddIntegrationIDs adds the "integrations" edge to the Integration entity by IDs.
@@ -291,15 +291,15 @@ func (oc *OrganizationCreate) createSpec() (*Organization, *sqlgraph.CreateSpec)
 		}
 		_spec.Edges = append(_spec.Edges, edge)
 	}
-	if nodes := oc.mutation.OciRepositoriesIDs(); len(nodes) > 0 {
+	if nodes := oc.mutation.CasBackendsIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		for _, k := range nodes {
diff --git a/app/controlplane/internal/data/ent/organization_query.go b/app/controlplane/internal/data/ent/organization_query.go
index 8e4ca36ac..d6c1b6e89 100644
--- a/app/controlplane/internal/data/ent/organization_query.go
+++ b/app/controlplane/internal/data/ent/organization_query.go
@@ -11,9 +11,9 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/workflow"
@@ -31,7 +31,7 @@ type OrganizationQuery struct {
 	withMemberships       *MembershipQuery
 	withWorkflowContracts *WorkflowContractQuery
 	withWorkflows         *WorkflowQuery
-	withOciRepositories   *OCIRepositoryQuery
+	withCasBackends       *CASBackendQuery
 	withIntegrations      *IntegrationQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -135,9 +135,9 @@ func (oq *OrganizationQuery) QueryWorkflows() *WorkflowQuery {
 	return query
 }
 
-// QueryOciRepositories chains the current query on the "oci_repositories" edge.
-func (oq *OrganizationQuery) QueryOciRepositories() *OCIRepositoryQuery {
-	query := (&OCIRepositoryClient{config: oq.config}).Query()
+// QueryCasBackends chains the current query on the "cas_backends" edge.
+func (oq *OrganizationQuery) QueryCasBackends() *CASBackendQuery {
+	query := (&CASBackendClient{config: oq.config}).Query()
 	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
 		if err := oq.prepareQuery(ctx); err != nil {
 			return nil, err
@@ -148,8 +148,8 @@ func (oq *OrganizationQuery) QueryOciRepositories() *OCIRepositoryQuery {
 		}
 		step := sqlgraph.NewStep(
 			sqlgraph.From(organization.Table, organization.FieldID, selector),
-			sqlgraph.To(ocirepository.Table, ocirepository.FieldID),
-			sqlgraph.Edge(sqlgraph.O2M, false, organization.OciRepositoriesTable, organization.OciRepositoriesColumn),
+			sqlgraph.To(casbackend.Table, casbackend.FieldID),
+			sqlgraph.Edge(sqlgraph.O2M, false, organization.CasBackendsTable, organization.CasBackendsColumn),
 		)
 		fromU = sqlgraph.SetNeighbors(oq.driver.Dialect(), step)
 		return fromU, nil
@@ -374,7 +374,7 @@ func (oq *OrganizationQuery) Clone() *OrganizationQuery {
 		withMemberships:       oq.withMemberships.Clone(),
 		withWorkflowContracts: oq.withWorkflowContracts.Clone(),
 		withWorkflows:         oq.withWorkflows.Clone(),
-		withOciRepositories:   oq.withOciRepositories.Clone(),
+		withCasBackends:       oq.withCasBackends.Clone(),
 		withIntegrations:      oq.withIntegrations.Clone(),
 		// clone intermediate query.
 		sql:  oq.sql.Clone(),
@@ -415,14 +415,14 @@ func (oq *OrganizationQuery) WithWorkflows(opts ...func(*WorkflowQuery)) *Organi
 	return oq
 }
 
-// WithOciRepositories tells the query-builder to eager-load the nodes that are connected to
-// the "oci_repositories" edge. The optional arguments are used to configure the query builder of the edge.
-func (oq *OrganizationQuery) WithOciRepositories(opts ...func(*OCIRepositoryQuery)) *OrganizationQuery {
-	query := (&OCIRepositoryClient{config: oq.config}).Query()
+// WithCasBackends tells the query-builder to eager-load the nodes that are connected to
+// the "cas_backends" edge. The optional arguments are used to configure the query builder of the edge.
+func (oq *OrganizationQuery) WithCasBackends(opts ...func(*CASBackendQuery)) *OrganizationQuery {
+	query := (&CASBackendClient{config: oq.config}).Query()
 	for _, opt := range opts {
 		opt(query)
 	}
-	oq.withOciRepositories = query
+	oq.withCasBackends = query
 	return oq
 }
 
@@ -519,7 +519,7 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 			oq.withMemberships != nil,
 			oq.withWorkflowContracts != nil,
 			oq.withWorkflows != nil,
-			oq.withOciRepositories != nil,
+			oq.withCasBackends != nil,
 			oq.withIntegrations != nil,
 		}
 	)
@@ -564,10 +564,10 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 			return nil, err
 		}
 	}
-	if query := oq.withOciRepositories; query != nil {
-		if err := oq.loadOciRepositories(ctx, query, nodes,
-			func(n *Organization) { n.Edges.OciRepositories = []*OCIRepository{} },
-			func(n *Organization, e *OCIRepository) { n.Edges.OciRepositories = append(n.Edges.OciRepositories, e) }); err != nil {
+	if query := oq.withCasBackends; query != nil {
+		if err := oq.loadCasBackends(ctx, query, nodes,
+			func(n *Organization) { n.Edges.CasBackends = []*CASBackend{} },
+			func(n *Organization, e *CASBackend) { n.Edges.CasBackends = append(n.Edges.CasBackends, e) }); err != nil {
 			return nil, err
 		}
 	}
@@ -674,7 +674,7 @@ func (oq *OrganizationQuery) loadWorkflows(ctx context.Context, query *WorkflowQ
 	}
 	return nil
 }
-func (oq *OrganizationQuery) loadOciRepositories(ctx context.Context, query *OCIRepositoryQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *OCIRepository)) error {
+func (oq *OrganizationQuery) loadCasBackends(ctx context.Context, query *CASBackendQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *CASBackend)) error {
 	fks := make([]driver.Value, 0, len(nodes))
 	nodeids := make(map[uuid.UUID]*Organization)
 	for i := range nodes {
@@ -685,21 +685,21 @@ func (oq *OrganizationQuery) loadOciRepositories(ctx context.Context, query *OCI
 		}
 	}
 	query.withFKs = true
-	query.Where(predicate.OCIRepository(func(s *sql.Selector) {
-		s.Where(sql.InValues(s.C(organization.OciRepositoriesColumn), fks...))
+	query.Where(predicate.CASBackend(func(s *sql.Selector) {
+		s.Where(sql.InValues(s.C(organization.CasBackendsColumn), fks...))
 	}))
 	neighbors, err := query.All(ctx)
 	if err != nil {
 		return err
 	}
 	for _, n := range neighbors {
-		fk := n.organization_oci_repositories
+		fk := n.organization_cas_backends
 		if fk == nil {
-			return fmt.Errorf(`foreign-key "organization_oci_repositories" is nil for node %v`, n.ID)
+			return fmt.Errorf(`foreign-key "organization_cas_backends" is nil for node %v`, n.ID)
 		}
 		node, ok := nodeids[*fk]
 		if !ok {
-			return fmt.Errorf(`unexpected referenced foreign-key "organization_oci_repositories" returned %v for node %v`, *fk, n.ID)
+			return fmt.Errorf(`unexpected referenced foreign-key "organization_cas_backends" returned %v for node %v`, *fk, n.ID)
 		}
 		assign(node, n)
 	}
diff --git a/app/controlplane/internal/data/ent/organization_update.go b/app/controlplane/internal/data/ent/organization_update.go
index 507e77a7e..a2ab8e2e3 100644
--- a/app/controlplane/internal/data/ent/organization_update.go
+++ b/app/controlplane/internal/data/ent/organization_update.go
@@ -10,9 +10,9 @@ import (
 	"entgo.io/ent/dialect/sql"
 	"entgo.io/ent/dialect/sql/sqlgraph"
 	"entgo.io/ent/schema/field"
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/predicate"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/workflow"
@@ -92,19 +92,19 @@ func (ou *OrganizationUpdate) AddWorkflows(w ...*Workflow) *OrganizationUpdate {
 	return ou.AddWorkflowIDs(ids...)
 }
 
-// AddOciRepositoryIDs adds the "oci_repositories" edge to the OCIRepository entity by IDs.
-func (ou *OrganizationUpdate) AddOciRepositoryIDs(ids ...uuid.UUID) *OrganizationUpdate {
-	ou.mutation.AddOciRepositoryIDs(ids...)
+// AddCasBackendIDs adds the "cas_backends" edge to the CASBackend entity by IDs.
+func (ou *OrganizationUpdate) AddCasBackendIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.AddCasBackendIDs(ids...)
 	return ou
 }
 
-// AddOciRepositories adds the "oci_repositories" edges to the OCIRepository entity.
-func (ou *OrganizationUpdate) AddOciRepositories(o ...*OCIRepository) *OrganizationUpdate {
-	ids := make([]uuid.UUID, len(o))
-	for i := range o {
-		ids[i] = o[i].ID
+// AddCasBackends adds the "cas_backends" edges to the CASBackend entity.
+func (ou *OrganizationUpdate) AddCasBackends(c ...*CASBackend) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(c))
+	for i := range c {
+		ids[i] = c[i].ID
 	}
-	return ou.AddOciRepositoryIDs(ids...)
+	return ou.AddCasBackendIDs(ids...)
 }
 
 // AddIntegrationIDs adds the "integrations" edge to the Integration entity by IDs.
@@ -190,25 +190,25 @@ func (ou *OrganizationUpdate) RemoveWorkflows(w ...*Workflow) *OrganizationUpdat
 	return ou.RemoveWorkflowIDs(ids...)
 }
 
-// ClearOciRepositories clears all "oci_repositories" edges to the OCIRepository entity.
-func (ou *OrganizationUpdate) ClearOciRepositories() *OrganizationUpdate {
-	ou.mutation.ClearOciRepositories()
+// ClearCasBackends clears all "cas_backends" edges to the CASBackend entity.
+func (ou *OrganizationUpdate) ClearCasBackends() *OrganizationUpdate {
+	ou.mutation.ClearCasBackends()
 	return ou
 }
 
-// RemoveOciRepositoryIDs removes the "oci_repositories" edge to OCIRepository entities by IDs.
-func (ou *OrganizationUpdate) RemoveOciRepositoryIDs(ids ...uuid.UUID) *OrganizationUpdate {
-	ou.mutation.RemoveOciRepositoryIDs(ids...)
+// RemoveCasBackendIDs removes the "cas_backends" edge to CASBackend entities by IDs.
+func (ou *OrganizationUpdate) RemoveCasBackendIDs(ids ...uuid.UUID) *OrganizationUpdate {
+	ou.mutation.RemoveCasBackendIDs(ids...)
 	return ou
 }
 
-// RemoveOciRepositories removes "oci_repositories" edges to OCIRepository entities.
-func (ou *OrganizationUpdate) RemoveOciRepositories(o ...*OCIRepository) *OrganizationUpdate {
-	ids := make([]uuid.UUID, len(o))
-	for i := range o {
-		ids[i] = o[i].ID
+// RemoveCasBackends removes "cas_backends" edges to CASBackend entities.
+func (ou *OrganizationUpdate) RemoveCasBackends(c ...*CASBackend) *OrganizationUpdate {
+	ids := make([]uuid.UUID, len(c))
+	for i := range c {
+		ids[i] = c[i].ID
 	}
-	return ou.RemoveOciRepositoryIDs(ids...)
+	return ou.RemoveCasBackendIDs(ids...)
 }
 
 // ClearIntegrations clears all "integrations" edges to the Integration entity.
@@ -406,28 +406,28 @@ func (ou *OrganizationUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
-	if ou.mutation.OciRepositoriesCleared() {
+	if ou.mutation.CasBackendsCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ou.mutation.RemovedOciRepositoriesIDs(); len(nodes) > 0 && !ou.mutation.OciRepositoriesCleared() {
+	if nodes := ou.mutation.RemovedCasBackendsIDs(); len(nodes) > 0 && !ou.mutation.CasBackendsCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		for _, k := range nodes {
@@ -435,15 +435,15 @@ func (ou *OrganizationUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ou.mutation.OciRepositoriesIDs(); len(nodes) > 0 {
+	if nodes := ou.mutation.CasBackendsIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		for _, k := range nodes {
@@ -575,19 +575,19 @@ func (ouo *OrganizationUpdateOne) AddWorkflows(w ...*Workflow) *OrganizationUpda
 	return ouo.AddWorkflowIDs(ids...)
 }
 
-// AddOciRepositoryIDs adds the "oci_repositories" edge to the OCIRepository entity by IDs.
-func (ouo *OrganizationUpdateOne) AddOciRepositoryIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
-	ouo.mutation.AddOciRepositoryIDs(ids...)
+// AddCasBackendIDs adds the "cas_backends" edge to the CASBackend entity by IDs.
+func (ouo *OrganizationUpdateOne) AddCasBackendIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.AddCasBackendIDs(ids...)
 	return ouo
 }
 
-// AddOciRepositories adds the "oci_repositories" edges to the OCIRepository entity.
-func (ouo *OrganizationUpdateOne) AddOciRepositories(o ...*OCIRepository) *OrganizationUpdateOne {
-	ids := make([]uuid.UUID, len(o))
-	for i := range o {
-		ids[i] = o[i].ID
+// AddCasBackends adds the "cas_backends" edges to the CASBackend entity.
+func (ouo *OrganizationUpdateOne) AddCasBackends(c ...*CASBackend) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(c))
+	for i := range c {
+		ids[i] = c[i].ID
 	}
-	return ouo.AddOciRepositoryIDs(ids...)
+	return ouo.AddCasBackendIDs(ids...)
 }
 
 // AddIntegrationIDs adds the "integrations" edge to the Integration entity by IDs.
@@ -673,25 +673,25 @@ func (ouo *OrganizationUpdateOne) RemoveWorkflows(w ...*Workflow) *OrganizationU
 	return ouo.RemoveWorkflowIDs(ids...)
 }
 
-// ClearOciRepositories clears all "oci_repositories" edges to the OCIRepository entity.
-func (ouo *OrganizationUpdateOne) ClearOciRepositories() *OrganizationUpdateOne {
-	ouo.mutation.ClearOciRepositories()
+// ClearCasBackends clears all "cas_backends" edges to the CASBackend entity.
+func (ouo *OrganizationUpdateOne) ClearCasBackends() *OrganizationUpdateOne {
+	ouo.mutation.ClearCasBackends()
 	return ouo
 }
 
-// RemoveOciRepositoryIDs removes the "oci_repositories" edge to OCIRepository entities by IDs.
-func (ouo *OrganizationUpdateOne) RemoveOciRepositoryIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
-	ouo.mutation.RemoveOciRepositoryIDs(ids...)
+// RemoveCasBackendIDs removes the "cas_backends" edge to CASBackend entities by IDs.
+func (ouo *OrganizationUpdateOne) RemoveCasBackendIDs(ids ...uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.RemoveCasBackendIDs(ids...)
 	return ouo
 }
 
-// RemoveOciRepositories removes "oci_repositories" edges to OCIRepository entities.
-func (ouo *OrganizationUpdateOne) RemoveOciRepositories(o ...*OCIRepository) *OrganizationUpdateOne {
-	ids := make([]uuid.UUID, len(o))
-	for i := range o {
-		ids[i] = o[i].ID
+// RemoveCasBackends removes "cas_backends" edges to CASBackend entities.
+func (ouo *OrganizationUpdateOne) RemoveCasBackends(c ...*CASBackend) *OrganizationUpdateOne {
+	ids := make([]uuid.UUID, len(c))
+	for i := range c {
+		ids[i] = c[i].ID
 	}
-	return ouo.RemoveOciRepositoryIDs(ids...)
+	return ouo.RemoveCasBackendIDs(ids...)
 }
 
 // ClearIntegrations clears all "integrations" edges to the Integration entity.
@@ -919,28 +919,28 @@ func (ouo *OrganizationUpdateOne) sqlSave(ctx context.Context) (_node *Organizat
 		}
 		_spec.Edges.Add = append(_spec.Edges.Add, edge)
 	}
-	if ouo.mutation.OciRepositoriesCleared() {
+	if ouo.mutation.CasBackendsCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ouo.mutation.RemovedOciRepositoriesIDs(); len(nodes) > 0 && !ouo.mutation.OciRepositoriesCleared() {
+	if nodes := ouo.mutation.RemovedCasBackendsIDs(); len(nodes) > 0 && !ouo.mutation.CasBackendsCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		for _, k := range nodes {
@@ -948,15 +948,15 @@ func (ouo *OrganizationUpdateOne) sqlSave(ctx context.Context) (_node *Organizat
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ouo.mutation.OciRepositoriesIDs(); len(nodes) > 0 {
+	if nodes := ouo.mutation.CasBackendsIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.O2M,
 			Inverse: false,
-			Table:   organization.OciRepositoriesTable,
-			Columns: []string{organization.OciRepositoriesColumn},
+			Table:   organization.CasBackendsTable,
+			Columns: []string{organization.CasBackendsColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
-				IDSpec: sqlgraph.NewFieldSpec(ocirepository.FieldID, field.TypeUUID),
+				IDSpec: sqlgraph.NewFieldSpec(casbackend.FieldID, field.TypeUUID),
 			},
 		}
 		for _, k := range nodes {
diff --git a/app/controlplane/internal/data/ent/predicate/predicate.go b/app/controlplane/internal/data/ent/predicate/predicate.go
index 839344e67..c5f8d0a07 100644
--- a/app/controlplane/internal/data/ent/predicate/predicate.go
+++ b/app/controlplane/internal/data/ent/predicate/predicate.go
@@ -6,6 +6,9 @@ import (
 	"entgo.io/ent/dialect/sql"
 )
 
+// CASBackend is the predicate function for casbackend builders.
+type CASBackend func(*sql.Selector)
+
 // Integration is the predicate function for integration builders.
 type Integration func(*sql.Selector)
 
@@ -15,9 +18,6 @@ type IntegrationAttachment func(*sql.Selector)
 // Membership is the predicate function for membership builders.
 type Membership func(*sql.Selector)
 
-// OCIRepository is the predicate function for ocirepository builders.
-type OCIRepository func(*sql.Selector)
-
 // Organization is the predicate function for organization builders.
 type Organization func(*sql.Selector)
 
diff --git a/app/controlplane/internal/data/ent/runtime.go b/app/controlplane/internal/data/ent/runtime.go
index 472842d12..8c776c567 100644
--- a/app/controlplane/internal/data/ent/runtime.go
+++ b/app/controlplane/internal/data/ent/runtime.go
@@ -5,10 +5,10 @@ package ent
 import (
 	"time"
 
+	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/casbackend"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integration"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/integrationattachment"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/membership"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/organization"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/robotaccount"
 	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/schema"
@@ -24,6 +24,24 @@ import (
 // (default values, validators, hooks and policies) and stitches it
 // to their package variables.
 func init() {
+	casbackendFields := schema.CASBackend{}.Fields()
+	_ = casbackendFields
+	// casbackendDescCreatedAt is the schema descriptor for created_at field.
+	casbackendDescCreatedAt := casbackendFields[3].Descriptor()
+	// casbackend.DefaultCreatedAt holds the default value on creation for the created_at field.
+	casbackend.DefaultCreatedAt = casbackendDescCreatedAt.Default.(func() time.Time)
+	// casbackendDescValidatedAt is the schema descriptor for validated_at field.
+	casbackendDescValidatedAt := casbackendFields[5].Descriptor()
+	// casbackend.DefaultValidatedAt holds the default value on creation for the validated_at field.
+	casbackend.DefaultValidatedAt = casbackendDescValidatedAt.Default.(func() time.Time)
+	// casbackendDescDefault is the schema descriptor for default field.
+	casbackendDescDefault := casbackendFields[7].Descriptor()
+	// casbackend.DefaultDefault holds the default value on creation for the default field.
+	casbackend.DefaultDefault = casbackendDescDefault.Default.(bool)
+	// casbackendDescID is the schema descriptor for id field.
+	casbackendDescID := casbackendFields[0].Descriptor()
+	// casbackend.DefaultID holds the default value on creation for the id field.
+	casbackend.DefaultID = casbackendDescID.Default.(func() uuid.UUID)
 	integrationFields := schema.Integration{}.Fields()
 	_ = integrationFields
 	// integrationDescCreatedAt is the schema descriptor for created_at field.
@@ -62,20 +80,6 @@ func init() {
 	membershipDescID := membershipFields[0].Descriptor()
 	// membership.DefaultID holds the default value on creation for the id field.
 	membership.DefaultID = membershipDescID.Default.(func() uuid.UUID)
-	ocirepositoryFields := schema.OCIRepository{}.Fields()
-	_ = ocirepositoryFields
-	// ocirepositoryDescCreatedAt is the schema descriptor for created_at field.
-	ocirepositoryDescCreatedAt := ocirepositoryFields[3].Descriptor()
-	// ocirepository.DefaultCreatedAt holds the default value on creation for the created_at field.
-	ocirepository.DefaultCreatedAt = ocirepositoryDescCreatedAt.Default.(func() time.Time)
-	// ocirepositoryDescValidatedAt is the schema descriptor for validated_at field.
-	ocirepositoryDescValidatedAt := ocirepositoryFields[5].Descriptor()
-	// ocirepository.DefaultValidatedAt holds the default value on creation for the validated_at field.
-	ocirepository.DefaultValidatedAt = ocirepositoryDescValidatedAt.Default.(func() time.Time)
-	// ocirepositoryDescID is the schema descriptor for id field.
-	ocirepositoryDescID := ocirepositoryFields[0].Descriptor()
-	// ocirepository.DefaultID holds the default value on creation for the id field.
-	ocirepository.DefaultID = ocirepositoryDescID.Default.(func() uuid.UUID)
 	organizationFields := schema.Organization{}.Fields()
 	_ = organizationFields
 	// organizationDescName is the schema descriptor for name field.
diff --git a/app/controlplane/internal/data/ent/schema-viz.html b/app/controlplane/internal/data/ent/schema-viz.html
index 8a4ec5088..e06df0b73 100644
--- a/app/controlplane/internal/data/ent/schema-viz.html
+++ b/app/controlplane/internal/data/ent/schema-viz.html
@@ -70,7 +70,7 @@
     }
 
     
-    const entGraph = JSON.parse("{\"nodes\":[{\"id\":\"Integration\",\"fields\":[{\"name\":\"kind\",\"type\":\"string\"},{\"name\":\"description\",\"type\":\"string\"},{\"name\":\"secret_name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"configuration\",\"type\":\"[]byte\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"IntegrationAttachment\",\"fields\":[{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"configuration\",\"type\":\"[]byte\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"Membership\",\"fields\":[{\"name\":\"current\",\"type\":\"bool\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"updated_at\",\"type\":\"time.Time\"}]},{\"id\":\"OCIRepository\",\"fields\":[{\"name\":\"repo\",\"type\":\"string\"},{\"name\":\"secret_name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"validation_status\",\"type\":\"biz.OCIRepoValidationStatus\"},{\"name\":\"validated_at\",\"type\":\"time.Time\"}]},{\"id\":\"Organization\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"RobotAccount\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"revoked_at\",\"type\":\"time.Time\"}]},{\"id\":\"User\",\"fields\":[{\"name\":\"email\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"Workflow\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"project\",\"type\":\"string\"},{\"name\":\"team\",\"type\":\"string\"},{\"name\":\"runs_count\",\"type\":\"int\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowContract\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowContractVersion\",\"fields\":[{\"name\":\"body\",\"type\":\"[]byte\"},{\"name\":\"revision\",\"type\":\"int\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowRun\",\"fields\":[{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"finished_at\",\"type\":\"time.Time\"},{\"name\":\"state\",\"type\":\"biz.WorkflowRunStatus\"},{\"name\":\"reason\",\"type\":\"string\"},{\"name\":\"run_url\",\"type\":\"string\"},{\"name\":\"runner_type\",\"type\":\"string\"},{\"name\":\"attestation\",\"type\":\"*dsse.Envelope\"}]}],\"edges\":[{\"from\":\"IntegrationAttachment\",\"to\":\"Integration\",\"label\":\"integration\"},{\"from\":\"IntegrationAttachment\",\"to\":\"Workflow\",\"label\":\"workflow\"},{\"from\":\"Organization\",\"to\":\"Membership\",\"label\":\"memberships\"},{\"from\":\"Organization\",\"to\":\"WorkflowContract\",\"label\":\"workflow_contracts\"},{\"from\":\"Organization\",\"to\":\"Workflow\",\"label\":\"workflows\"},{\"from\":\"Organization\",\"to\":\"OCIRepository\",\"label\":\"oci_repositories\"},{\"from\":\"Organization\",\"to\":\"Integration\",\"label\":\"integrations\"},{\"from\":\"RobotAccount\",\"to\":\"WorkflowRun\",\"label\":\"workflowruns\"},{\"from\":\"User\",\"to\":\"Membership\",\"label\":\"memberships\"},{\"from\":\"Workflow\",\"to\":\"RobotAccount\",\"label\":\"robotaccounts\"},{\"from\":\"Workflow\",\"to\":\"WorkflowRun\",\"label\":\"workflowruns\"},{\"from\":\"Workflow\",\"to\":\"WorkflowContract\",\"label\":\"contract\"},{\"from\":\"WorkflowContract\",\"to\":\"WorkflowContractVersion\",\"label\":\"versions\"},{\"from\":\"WorkflowRun\",\"to\":\"WorkflowContractVersion\",\"label\":\"contract_version\"}]}");
+    const entGraph = JSON.parse("{\"nodes\":[{\"id\":\"CASBackend\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"secret_name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"validation_status\",\"type\":\"biz.CASBackendValidationStatus\"},{\"name\":\"validated_at\",\"type\":\"time.Time\"},{\"name\":\"provider\",\"type\":\"biz.CASBackendProvider\"},{\"name\":\"default\",\"type\":\"bool\"}]},{\"id\":\"Integration\",\"fields\":[{\"name\":\"kind\",\"type\":\"string\"},{\"name\":\"description\",\"type\":\"string\"},{\"name\":\"secret_name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"configuration\",\"type\":\"[]byte\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"IntegrationAttachment\",\"fields\":[{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"configuration\",\"type\":\"[]byte\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"Membership\",\"fields\":[{\"name\":\"current\",\"type\":\"bool\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"updated_at\",\"type\":\"time.Time\"}]},{\"id\":\"Organization\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"RobotAccount\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"revoked_at\",\"type\":\"time.Time\"}]},{\"id\":\"User\",\"fields\":[{\"name\":\"email\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"Workflow\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"project\",\"type\":\"string\"},{\"name\":\"team\",\"type\":\"string\"},{\"name\":\"runs_count\",\"type\":\"int\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowContract\",\"fields\":[{\"name\":\"name\",\"type\":\"string\"},{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"deleted_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowContractVersion\",\"fields\":[{\"name\":\"body\",\"type\":\"[]byte\"},{\"name\":\"revision\",\"type\":\"int\"},{\"name\":\"created_at\",\"type\":\"time.Time\"}]},{\"id\":\"WorkflowRun\",\"fields\":[{\"name\":\"created_at\",\"type\":\"time.Time\"},{\"name\":\"finished_at\",\"type\":\"time.Time\"},{\"name\":\"state\",\"type\":\"biz.WorkflowRunStatus\"},{\"name\":\"reason\",\"type\":\"string\"},{\"name\":\"run_url\",\"type\":\"string\"},{\"name\":\"runner_type\",\"type\":\"string\"},{\"name\":\"attestation\",\"type\":\"*dsse.Envelope\"}]}],\"edges\":[{\"from\":\"IntegrationAttachment\",\"to\":\"Integration\",\"label\":\"integration\"},{\"from\":\"IntegrationAttachment\",\"to\":\"Workflow\",\"label\":\"workflow\"},{\"from\":\"Organization\",\"to\":\"Membership\",\"label\":\"memberships\"},{\"from\":\"Organization\",\"to\":\"WorkflowContract\",\"label\":\"workflow_contracts\"},{\"from\":\"Organization\",\"to\":\"Workflow\",\"label\":\"workflows\"},{\"from\":\"Organization\",\"to\":\"CASBackend\",\"label\":\"cas_backends\"},{\"from\":\"Organization\",\"to\":\"Integration\",\"label\":\"integrations\"},{\"from\":\"RobotAccount\",\"to\":\"WorkflowRun\",\"label\":\"workflowruns\"},{\"from\":\"User\",\"to\":\"Membership\",\"label\":\"memberships\"},{\"from\":\"Workflow\",\"to\":\"RobotAccount\",\"label\":\"robotaccounts\"},{\"from\":\"Workflow\",\"to\":\"WorkflowRun\",\"label\":\"workflowruns\"},{\"from\":\"Workflow\",\"to\":\"WorkflowContract\",\"label\":\"contract\"},{\"from\":\"WorkflowContract\",\"to\":\"WorkflowContractVersion\",\"label\":\"versions\"},{\"from\":\"WorkflowRun\",\"to\":\"WorkflowContractVersion\",\"label\":\"contract_version\"}]}");
     const nodes = new vis.DataSet((entGraph.nodes || []).map(n =>
     ({
       id: n.id,
diff --git a/app/controlplane/internal/data/ent/schema/ocirepository.go b/app/controlplane/internal/data/ent/schema/casbackend.go
similarity index 72%
rename from app/controlplane/internal/data/ent/schema/ocirepository.go
rename to app/controlplane/internal/data/ent/schema/casbackend.go
index 7c3e8f4ce..d1085c870 100644
--- a/app/controlplane/internal/data/ent/schema/ocirepository.go
+++ b/app/controlplane/internal/data/ent/schema/casbackend.go
@@ -26,32 +26,32 @@ import (
 	"github.com/google/uuid"
 )
 
-// OCIRepository holds the schema definition for the OCIRepository entity.
-type OCIRepository struct {
+// CASBackend holds the schema definition for the CASBackend entity.
+type CASBackend struct {
 	ent.Schema
 }
 
-// Fields of the OCIRepository.
-func (OCIRepository) Fields() []ent.Field {
+func (CASBackend) Fields() []ent.Field {
 	return []ent.Field{
 		field.UUID("id", uuid.UUID{}).Default(uuid.New).Unique(),
-		field.String("repo"),
+		field.String("name"),
 		field.String("secret_name"),
 		field.Time("created_at").
 			Default(time.Now).
 			Immutable().
 			Annotations(&entsql.Annotation{Default: "CURRENT_TIMESTAMP"}),
 		field.Enum("validation_status").
-			GoType(biz.OCIRepoValidationStatus("")).
-			Default(string(biz.OCIRepoValidationOK)),
+			GoType(biz.CASBackendValidationStatus("")).
+			Default(string(biz.CASBackendValidationOK)),
 		field.Time("validated_at").Default(time.Now).
 			Annotations(&entsql.Annotation{Default: "CURRENT_TIMESTAMP"}),
+		field.Enum("provider").GoType(biz.CASBackendProvider("")),
+		field.Bool("default").Default(false),
 	}
 }
 
-// Edges of the OCIRepository.
-func (OCIRepository) Edges() []ent.Edge {
+func (CASBackend) Edges() []ent.Edge {
 	return []ent.Edge{
-		edge.From("organization", Organization.Type).Ref("oci_repositories").Unique().Required(),
+		edge.From("organization", Organization.Type).Ref("cas_backends").Unique().Required(),
 	}
 }
diff --git a/app/controlplane/internal/data/ent/schema/organization.go b/app/controlplane/internal/data/ent/schema/organization.go
index 956bc044b..ce6dad5fc 100644
--- a/app/controlplane/internal/data/ent/schema/organization.go
+++ b/app/controlplane/internal/data/ent/schema/organization.go
@@ -51,7 +51,7 @@ func (Organization) Edges() []ent.Edge {
 		edge.To("memberships", Membership.Type).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
 		edge.To("workflow_contracts", WorkflowContract.Type).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
 		edge.To("workflows", Workflow.Type).StorageKey(edge.Column("organization_id")).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
-		edge.To("oci_repositories", OCIRepository.Type).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
+		edge.To("cas_backends", CASBackend.Type).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
 		edge.To("integrations", Integration.Type).Annotations(entsql.Annotation{OnDelete: entsql.Cascade}),
 	}
 }
diff --git a/app/controlplane/internal/data/ent/tx.go b/app/controlplane/internal/data/ent/tx.go
index f64b86a65..10affe5b8 100644
--- a/app/controlplane/internal/data/ent/tx.go
+++ b/app/controlplane/internal/data/ent/tx.go
@@ -12,14 +12,14 @@ import (
 // Tx is a transactional client that is created by calling Client.Tx().
 type Tx struct {
 	config
+	// CASBackend is the client for interacting with the CASBackend builders.
+	CASBackend *CASBackendClient
 	// Integration is the client for interacting with the Integration builders.
 	Integration *IntegrationClient
 	// IntegrationAttachment is the client for interacting with the IntegrationAttachment builders.
 	IntegrationAttachment *IntegrationAttachmentClient
 	// Membership is the client for interacting with the Membership builders.
 	Membership *MembershipClient
-	// OCIRepository is the client for interacting with the OCIRepository builders.
-	OCIRepository *OCIRepositoryClient
 	// Organization is the client for interacting with the Organization builders.
 	Organization *OrganizationClient
 	// RobotAccount is the client for interacting with the RobotAccount builders.
@@ -165,10 +165,10 @@ func (tx *Tx) Client() *Client {
 }
 
 func (tx *Tx) init() {
+	tx.CASBackend = NewCASBackendClient(tx.config)
 	tx.Integration = NewIntegrationClient(tx.config)
 	tx.IntegrationAttachment = NewIntegrationAttachmentClient(tx.config)
 	tx.Membership = NewMembershipClient(tx.config)
-	tx.OCIRepository = NewOCIRepositoryClient(tx.config)
 	tx.Organization = NewOrganizationClient(tx.config)
 	tx.RobotAccount = NewRobotAccountClient(tx.config)
 	tx.User = NewUserClient(tx.config)
@@ -185,7 +185,7 @@ func (tx *Tx) init() {
 // of them in order to commit or rollback the transaction.
 //
 // If a closed transaction is embedded in one of the generated entities, and the entity
-// applies a query, for example: Integration.QueryXXX(), the query will be executed
+// applies a query, for example: CASBackend.QueryXXX(), the query will be executed
 // through the driver which created this transaction.
 //
 // Note that txDriver is not goroutine safe.
diff --git a/app/controlplane/internal/data/ocirepository.go b/app/controlplane/internal/data/ocirepository.go
deleted file mode 100644
index 3697ed199..000000000
--- a/app/controlplane/internal/data/ocirepository.go
+++ /dev/null
@@ -1,120 +0,0 @@
-//
-// Copyright 2023 The Chainloop Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package data
-
-import (
-	"context"
-	"time"
-
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent"
-	"github.com/chainloop-dev/chainloop/app/controlplane/internal/data/ent/ocirepository"
-	"github.com/go-kratos/kratos/v2/log"
-	"github.com/google/uuid"
-)
-
-type OCIRepositoryRepo struct {
-	data *Data
-	log  *log.Helper
-}
-
-func NewOCIRepositoryRepo(data *Data, logger log.Logger) biz.OCIRepositoryRepo {
-	return &OCIRepositoryRepo{
-		data: data,
-		log:  log.NewHelper(logger),
-	}
-}
-
-func (r *OCIRepositoryRepo) FindMainRepo(ctx context.Context, orgID uuid.UUID) (*biz.OCIRepository, error) {
-	repo, err := orgScopedQuery(r.data.db, orgID).
-		QueryOciRepositories().Only(ctx)
-	if err != nil && !ent.IsNotFound(err) {
-		return nil, err
-	}
-
-	return entOCIRepoToBiz(repo), nil
-}
-
-func (r *OCIRepositoryRepo) Create(ctx context.Context, opts *biz.OCIRepoCreateOpts) (*biz.OCIRepository, error) {
-	repo, err := r.data.db.OCIRepository.Create().
-		SetOrganizationID(opts.OrgID).
-		SetRepo(opts.Repository).
-		SetSecretName(opts.SecretName).
-		Save(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	return entOCIRepoToBiz(repo), nil
-}
-
-func (r *OCIRepositoryRepo) Update(ctx context.Context, opts *biz.OCIRepoUpdateOpts) (*biz.OCIRepository, error) {
-	repo, err := r.data.db.OCIRepository.UpdateOneID(opts.ID).
-		SetRepo(opts.Repository).
-		SetSecretName(opts.SecretName).
-		Save(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	return entOCIRepoToBiz(repo), nil
-}
-
-// FindByID finds an OCI repository by ID in the given organization.
-// If not found, returns nil and no error
-func (r *OCIRepositoryRepo) FindByID(ctx context.Context, id uuid.UUID) (*biz.OCIRepository, error) {
-	repo, err := r.data.db.OCIRepository.Query().WithOrganization().Where(ocirepository.ID(id)).Only(ctx)
-	if err != nil && !ent.IsNotFound(err) {
-		return nil, err
-	} else if repo == nil {
-		return nil, nil
-	}
-
-	return entOCIRepoToBiz(repo), nil
-}
-
-func (r *OCIRepositoryRepo) Delete(ctx context.Context, id uuid.UUID) error {
-	return r.data.db.OCIRepository.DeleteOneID(id).Exec(ctx)
-}
-
-// UpdateValidationStatus updates the validation status of an OCI repository
-func (r *OCIRepositoryRepo) UpdateValidationStatus(ctx context.Context, id uuid.UUID, status biz.OCIRepoValidationStatus) error {
-	return r.data.db.OCIRepository.UpdateOneID(id).
-		SetValidationStatus(status).
-		SetValidatedAt(time.Now()).
-		Exec(ctx)
-}
-
-func entOCIRepoToBiz(repo *ent.OCIRepository) *biz.OCIRepository {
-	if repo == nil {
-		return nil
-	}
-
-	r := &biz.OCIRepository{
-		ID:               repo.ID.String(),
-		Repo:             repo.Repo,
-		SecretName:       repo.SecretName,
-		CreatedAt:        toTimePtr(repo.CreatedAt),
-		ValidatedAt:      toTimePtr(repo.ValidatedAt),
-		ValidationStatus: repo.ValidationStatus,
-	}
-
-	if org := repo.Edges.Organization; org != nil {
-		r.OrganizationID = org.ID.String()
-	}
-
-	return r
-}
diff --git a/app/controlplane/internal/server/grpc.go b/app/controlplane/internal/server/grpc.go
index 6f1994838..7b9629829 100644
--- a/app/controlplane/internal/server/grpc.go
+++ b/app/controlplane/internal/server/grpc.go
@@ -45,17 +45,17 @@ import (
 
 type Opts struct {
 	// UseCases
-	UserUseCase          *biz.UserUseCase
-	RobotAccountUseCase  *biz.RobotAccountUseCase
-	OCIRepositoryUseCase *biz.OCIRepositoryUseCase
-	CASClientUseCase     *biz.CASClientUseCase
-	IntegrationUseCase   *biz.IntegrationUseCase
+	UserUseCase         *biz.UserUseCase
+	RobotAccountUseCase *biz.RobotAccountUseCase
+	CASBackendUseCase   *biz.CASBackendUseCase
+	CASClientUseCase    *biz.CASClientUseCase
+	IntegrationUseCase  *biz.IntegrationUseCase
 	// Services
 	WorkflowSvc         *service.WorkflowService
 	AuthSvc             *service.AuthService
 	RobotAccountSvc     *service.RobotAccountService
 	WorkflowRunSvc      *service.WorkflowRunService
-	AttesstationSvc     *service.AttestationService
+	AttestationSvc      *service.AttestationService
 	WorkflowContractSvc *service.WorkflowContractService
 	ContextSvc          *service.ContextService
 	CASCredsSvc         *service.CASCredentialsService
@@ -92,7 +92,7 @@ func NewGRPCServer(opts *Opts) *grpc.Server {
 	v1.RegisterStatusServiceServer(srv, service.NewStatusService(opts.AuthSvc.AuthURLs.Login, Version, opts.CASClientUseCase))
 	v1.RegisterRobotAccountServiceServer(srv, opts.RobotAccountSvc)
 	v1.RegisterWorkflowRunServiceServer(srv, opts.WorkflowRunSvc)
-	v1.RegisterAttestationServiceServer(srv, opts.AttesstationSvc)
+	v1.RegisterAttestationServiceServer(srv, opts.AttestationSvc)
 	v1.RegisterWorkflowContractServiceServer(srv, opts.WorkflowContractSvc)
 	v1.RegisterCASCredentialsServiceServer(srv, opts.CASCredsSvc)
 	v1.RegisterOCIRepositoryServiceServer(srv, opts.OCIRepositorySvc)
@@ -137,7 +137,7 @@ func craftMiddleware(opts *Opts) []middleware.Middleware {
 			// 3 - Make sure its account is fully functional
 			selector.Server(
 				usercontext.CheckUserInAllowList(opts.AuthConfig.AllowList),
-				usercontext.CheckOrgRequirements(opts.OCIRepositoryUseCase),
+				usercontext.CheckOrgRequirements(opts.CASBackendUseCase),
 			).Match(requireFullyConfiguredOrgMatcher()).Build(),
 		).Match(requireCurrentUserMatcher()).Build(),
 	)
diff --git a/app/controlplane/internal/service/attestation.go b/app/controlplane/internal/service/attestation.go
index 20446ba29..35cb66354 100644
--- a/app/controlplane/internal/service/attestation.go
+++ b/app/controlplane/internal/service/attestation.go
@@ -41,7 +41,7 @@ type AttestationService struct {
 	wrUseCase               *biz.WorkflowRunUseCase
 	workflowUseCase         *biz.WorkflowUseCase
 	workflowContractUseCase *biz.WorkflowContractUseCase
-	ociUC                   *biz.OCIRepositoryUseCase
+	ociUC                   *biz.CASBackendUseCase
 	credsReader             credentials.Reader
 	integrationUseCase      *biz.IntegrationUseCase
 	integrationDispatcher   *dispatcher.FanOutDispatcher
@@ -52,7 +52,7 @@ type NewAttestationServiceOpts struct {
 	WorkflowRunUC      *biz.WorkflowRunUseCase
 	WorkflowUC         *biz.WorkflowUseCase
 	WorkflowContractUC *biz.WorkflowContractUseCase
-	OCIUC              *biz.OCIRepositoryUseCase
+	OCIUC              *biz.CASBackendUseCase
 	CredsReader        credentials.Reader
 	IntegrationUseCase *biz.IntegrationUseCase
 	CasCredsUseCase    *biz.CASCredentialsUseCase
@@ -168,7 +168,7 @@ func (s *AttestationService) Store(ctx context.Context, req *cpAPI.AttestationSe
 	}
 
 	// find the CAS oci credentials so the dispatcher can download the materials if needed
-	repo, err := s.ociUC.FindMainRepo(context.Background(), robotAccount.OrgID)
+	repo, err := s.ociUC.FindDefaultBackend(context.Background(), robotAccount.OrgID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to find main repository: %w", err)
 	}
@@ -227,7 +227,7 @@ func (s *AttestationService) GetUploadCreds(ctx context.Context, _ *cpAPI.Attest
 		return nil, errors.NotFound("not found", "workflow not found")
 	}
 
-	repo, err := s.ociUC.FindMainRepo(ctx, wf.OrgID.String())
+	repo, err := s.ociUC.FindDefaultBackend(ctx, wf.OrgID.String())
 	if err != nil {
 		return nil, sl.LogAndMaskErr(err, s.log)
 	}
diff --git a/app/controlplane/internal/service/cascredential.go b/app/controlplane/internal/service/cascredential.go
index 90d6c7320..81a75e9ec 100644
--- a/app/controlplane/internal/service/cascredential.go
+++ b/app/controlplane/internal/service/cascredential.go
@@ -31,10 +31,10 @@ type CASCredentialsService struct {
 	pb.UnimplementedCASCredentialsServiceServer
 
 	casUC *biz.CASCredentialsUseCase
-	ociUC *biz.OCIRepositoryUseCase
+	ociUC *biz.CASBackendUseCase
 }
 
-func NewCASCredentialsService(casUC *biz.CASCredentialsUseCase, ociUC *biz.OCIRepositoryUseCase, opts ...NewOpt) *CASCredentialsService {
+func NewCASCredentialsService(casUC *biz.CASCredentialsUseCase, ociUC *biz.CASBackendUseCase, opts ...NewOpt) *CASCredentialsService {
 	return &CASCredentialsService{
 		service: newService(opts...),
 		casUC:   casUC,
@@ -58,7 +58,7 @@ func (s *CASCredentialsService) Get(ctx context.Context, req *pb.CASCredentialsS
 	}
 
 	// Get repository to provide the secret name
-	repo, err := s.ociUC.FindMainRepo(ctx, currentOrg.ID)
+	repo, err := s.ociUC.FindDefaultBackend(ctx, currentOrg.ID)
 	if err != nil {
 		return nil, sl.LogAndMaskErr(err, s.log)
 	}
diff --git a/app/controlplane/internal/service/context.go b/app/controlplane/internal/service/context.go
index be1d0b640..7c0ce84db 100644
--- a/app/controlplane/internal/service/context.go
+++ b/app/controlplane/internal/service/context.go
@@ -28,10 +28,10 @@ type ContextService struct {
 	*service
 	pb.UnimplementedContextServiceServer
 
-	uc *biz.OCIRepositoryUseCase
+	uc *biz.CASBackendUseCase
 }
 
-func NewContextService(repoUC *biz.OCIRepositoryUseCase, opts ...NewOpt) *ContextService {
+func NewContextService(repoUC *biz.CASBackendUseCase, opts ...NewOpt) *ContextService {
 	return &ContextService{
 		service: newService(opts...),
 		uc:      repoUC,
@@ -51,7 +51,7 @@ func (s *ContextService) Current(ctx context.Context, _ *pb.ContextServiceCurren
 		CurrentOrg: bizOrgToPb((*biz.Organization)(currentOrg)),
 	}
 
-	repo, err := s.uc.FindMainRepo(ctx, currentOrg.ID)
+	repo, err := s.uc.FindDefaultBackend(ctx, currentOrg.ID)
 	if err != nil {
 		return nil, sl.LogAndMaskErr(err, s.log)
 	}
diff --git a/app/controlplane/internal/service/ocirepository.go b/app/controlplane/internal/service/ocirepository.go
index 3544b85b0..8a708aa34 100644
--- a/app/controlplane/internal/service/ocirepository.go
+++ b/app/controlplane/internal/service/ocirepository.go
@@ -31,10 +31,10 @@ type OCIRepositoryService struct {
 	pb.UnimplementedOCIRepositoryServiceServer
 	*service
 
-	uc *biz.OCIRepositoryUseCase
+	uc *biz.CASBackendUseCase
 }
 
-func NewOCIRepositoryService(uc *biz.OCIRepositoryUseCase, opts ...NewOpt) *OCIRepositoryService {
+func NewOCIRepositoryService(uc *biz.CASBackendUseCase, opts ...NewOpt) *OCIRepositoryService {
 	return &OCIRepositoryService{
 		service: newService(opts...),
 		uc:      uc,
@@ -67,7 +67,8 @@ func (s *OCIRepositoryService) Save(ctx context.Context, req *pb.OCIRepositorySe
 		return nil, errors.BadRequest("wrong credentials", "the provided registry credentials are invalid")
 	}
 
-	_, err = s.uc.CreateOrUpdate(ctx, currentOrg.ID, req.Repository, username, password)
+	// For now we only support one backend which is set as default
+	_, err = s.uc.CreateOrUpdate(ctx, currentOrg.ID, req.Repository, username, password, biz.CASBackendOCI, true)
 	if err != nil {
 		return nil, sl.LogAndMaskErr(err, s.log)
 	}
@@ -75,15 +76,15 @@ func (s *OCIRepositoryService) Save(ctx context.Context, req *pb.OCIRepositorySe
 	return &pb.OCIRepositoryServiceSaveResponse{}, nil
 }
 
-func bizOCIRepoToPb(repo *biz.OCIRepository) *pb.OCIRepositoryItem {
+func bizOCIRepoToPb(repo *biz.CASBackend) *pb.OCIRepositoryItem {
 	r := &pb.OCIRepositoryItem{
-		Id: repo.ID, Repo: repo.Repo, CreatedAt: timestamppb.New(*repo.CreatedAt),
+		Id: repo.ID, Repo: repo.Name, CreatedAt: timestamppb.New(*repo.CreatedAt),
 	}
 
 	switch repo.ValidationStatus {
-	case biz.OCIRepoValidationOK:
+	case biz.CASBackendValidationOK:
 		r.ValidationStatus = pb.OCIRepositoryItem_VALIDATION_STATUS_OK
-	case biz.OCIRepoValidationFailed:
+	case biz.CASBackendValidationFailed:
 		r.ValidationStatus = pb.OCIRepositoryItem_VALIDATION_STATUS_INVALID
 	}
 
diff --git a/app/controlplane/internal/usercontext/orgrequirements_middleware.go b/app/controlplane/internal/usercontext/orgrequirements_middleware.go
index d63c1af57..272f6a74b 100644
--- a/app/controlplane/internal/usercontext/orgrequirements_middleware.go
+++ b/app/controlplane/internal/usercontext/orgrequirements_middleware.go
@@ -26,7 +26,7 @@ import (
 	"github.com/go-kratos/kratos/v2/middleware"
 )
 
-func CheckOrgRequirements(uc biz.OCIRepositoryReader) middleware.Middleware {
+func CheckOrgRequirements(uc biz.CASBackendReader) middleware.Middleware {
 	return func(handler middleware.Handler) middleware.Handler {
 		return func(ctx context.Context, req interface{}) (interface{}, error) {
 			org := CurrentOrg(ctx)
@@ -36,7 +36,7 @@ func CheckOrgRequirements(uc biz.OCIRepositoryReader) middleware.Middleware {
 			}
 
 			// 1 - Figure out main repository for this organization
-			repo, err := uc.FindMainRepo(ctx, org.ID)
+			repo, err := uc.FindDefaultBackend(ctx, org.ID)
 			if err != nil {
 				return nil, fmt.Errorf("checking for repositories in the org: %w", err)
 			} else if repo == nil {
@@ -52,7 +52,7 @@ func CheckOrgRequirements(uc biz.OCIRepositoryReader) middleware.Middleware {
 			}
 
 			// 2 - compare the status
-			if repo.ValidationStatus != biz.OCIRepoValidationOK {
+			if repo.ValidationStatus != biz.CASBackendValidationOK {
 				return nil, v1.ErrorOciRepositoryErrorReasonInvalid("your OCI repository can't be reached")
 			}
 
@@ -62,7 +62,7 @@ func CheckOrgRequirements(uc biz.OCIRepositoryReader) middleware.Middleware {
 }
 
 // validateRepoIfNeeded will re-run a validation and return the updated repository
-func validateRepo(ctx context.Context, uc biz.OCIRepositoryReader, repo *biz.OCIRepository) (*biz.OCIRepository, error) {
+func validateRepo(ctx context.Context, uc biz.CASBackendReader, repo *biz.CASBackend) (*biz.CASBackend, error) {
 	// re-run the validation
 	if err := uc.PerformValidation(ctx, repo.ID); err != nil {
 		return nil, fmt.Errorf("performing validation: %w", err)
@@ -81,9 +81,9 @@ const validationTimeOffset = 5 * time.Minute
 
 // Since this check happens synchronously on every request it has a big performance impact
 // that's why we run it only in refresh windows
-func shouldRevalidate(repo *biz.OCIRepository) bool {
+func shouldRevalidate(repo *biz.CASBackend) bool {
 	// If the validation is currently failed we want to make sure we re-validate
-	if repo.ValidationStatus == biz.OCIRepoValidationFailed {
+	if repo.ValidationStatus == biz.CASBackendValidationFailed {
 		return true
 	}
 
diff --git a/app/controlplane/internal/usercontext/orgrequirements_middleware_test.go b/app/controlplane/internal/usercontext/orgrequirements_middleware_test.go
index d6b49f3e5..e06aba8dc 100644
--- a/app/controlplane/internal/usercontext/orgrequirements_middleware_test.go
+++ b/app/controlplane/internal/usercontext/orgrequirements_middleware_test.go
@@ -30,31 +30,31 @@ import (
 func TestShouldRevalidate(t *testing.T) {
 	testCases := []struct {
 		name            string
-		repoStatus      biz.OCIRepoValidationStatus
+		repoStatus      biz.CASBackendValidationStatus
 		repoValidatedAt time.Time
 		expected        bool
 	}{
 		{
 			name:            "should revalidate if status is not ok and new",
-			repoStatus:      biz.OCIRepoValidationFailed,
+			repoStatus:      biz.CASBackendValidationFailed,
 			repoValidatedAt: time.Now(),
 			expected:        true,
 		},
 		{
 			name:            "should revalidate if status is not ok and old",
-			repoStatus:      biz.OCIRepoValidationFailed,
+			repoStatus:      biz.CASBackendValidationFailed,
 			repoValidatedAt: time.Now().Add(-2 * validationTimeOffset),
 			expected:        true,
 		},
 		{
 			name:            "should revalidate if status is ok but validated at is too old",
-			repoStatus:      biz.OCIRepoValidationOK,
+			repoStatus:      biz.CASBackendValidationOK,
 			repoValidatedAt: time.Now().Add(-2 * validationTimeOffset),
 			expected:        true,
 		},
 		{
 			name:            "should not revalidate if status is ok and validated at is recent",
-			repoStatus:      biz.OCIRepoValidationOK,
+			repoStatus:      biz.CASBackendValidationOK,
 			repoValidatedAt: time.Now().Add(-(validationTimeOffset - time.Second)),
 			expected:        false,
 		},
@@ -62,7 +62,7 @@ func TestShouldRevalidate(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			repo := &biz.OCIRepository{
+			repo := &biz.CASBackend{
 				ValidationStatus: tc.repoStatus,
 				ValidatedAt:      &tc.repoValidatedAt,
 			}
@@ -75,10 +75,10 @@ func TestShouldRevalidate(t *testing.T) {
 func TestValidateRepo(t *testing.T) {
 	ctx := context.Background()
 	assert := assert.New(t)
-	repo := &biz.OCIRepository{ID: uuid.NewString(), ValidatedAt: toTimePtr(time.Now())}
+	repo := &biz.CASBackend{ID: uuid.NewString(), ValidatedAt: toTimePtr(time.Now())}
 
 	t.Run("validation error", func(t *testing.T) {
-		useCase := mocks.NewOCIRepositoryReader(t)
+		useCase := mocks.NewCASBackendReader(t)
 		useCase.On("PerformValidation", ctx, repo.ID).Return(errors.New("validation error"))
 		got, err := validateRepo(ctx, useCase, repo)
 		assert.Error(err)
@@ -86,10 +86,10 @@ func TestValidateRepo(t *testing.T) {
 	})
 
 	t.Run("validation ok, returns updated repo", func(t *testing.T) {
-		useCase := mocks.NewOCIRepositoryReader(t)
+		useCase := mocks.NewCASBackendReader(t)
 		useCase.On("PerformValidation", ctx, repo.ID).Return(nil)
 
-		want := &biz.OCIRepository{ID: repo.ID, ValidatedAt: toTimePtr(time.Now())}
+		want := &biz.CASBackend{ID: repo.ID, ValidatedAt: toTimePtr(time.Now())}
 		useCase.On("FindByID", ctx, repo.ID).Return(want, nil)
 		got, err := validateRepo(ctx, useCase, repo)
 		assert.NoError(err)