@sixb/core 0.1.12 → 0.1.14

package/src/testing/auth-storage-contract.ts

@@ -37,6 +37,24 @@ function sessionInput(
   }
 }
 
+function bearerSessionInput(id: string) {
+  return {
+    id,
+    projectId,
+    userId: "usr_1",
+    strategyId: "magic-link",
+    audience: "atlas" as const,
+    tokenHash: "access-1",
+    createdAt: at("2026-05-14T10:00:00.000Z"),
+    expiresAt: at("2026-06-14T10:00:00.000Z"),
+    bearer: {
+      clientName: "sixb CLI",
+      accessExpiresAt: at("2026-05-14T10:15:00.000Z"),
+      refreshTokenHash: "refresh-1",
+    },
+  }
+}
+
 async function expectAuthError(
   promise: Promise<unknown>,
   code: AuthStorageErrorCode
@@ -63,6 +81,34 @@ async function createUser(
   })
 }
 
+async function completeOidcSignInForAva(
+  storage: AuthStorage,
+  directoryGroupIds: readonly string[] | undefined
+): Promise<void> {
+  await storage.oidcAuthorizationAttempts.create({
+    id: "oidc_directory",
+    projectId,
+    strategyId: "entra",
+    audience: "atlas",
+    stateHash: "directory-state",
+    nonceHash: "nonce-hash",
+    codeVerifier: "verifier",
+    createdAt: at("2026-05-14T10:00:00.000Z"),
+    expiresAt: at("2026-05-14T10:10:00.000Z"),
+  })
+  await storage.completeOidcSignIn({
+    projectId,
+    oidcAuthorizationAttemptId: "oidc_directory",
+    stateHash: "directory-state",
+    completedAt: at("2026-05-14T10:01:00.000Z"),
+    subject: "entra-ava",
+    email: "ava@acme.com",
+    directoryGroupIds,
+    newUserId: "usr_unused",
+    session: sessionInput("ses_directory"),
+  })
+}
+
 /**
  * Runs the shared `AuthStorage` contract against any storage implementation.
  *
@@ -851,8 +897,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           name: "Local CLI",
           kind: "personal",
-          subjectType: "user",
-          subjectId: "usr_1",
+          subject: { type: "user", id: "usr_1" },
           tokenHash: "hash-personal",
           groupIds: ["commercial", "commercial", "finance"],
           createdAt: at("2026-05-14T10:01:00.000Z"),
@@ -893,8 +938,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           name: "Sandbox agent",
           kind: "serviceAccount",
-          subjectType: "serviceAccount",
-          subjectId: "svc_ingest",
+          subject: { type: "serviceAccount", id: "svc_ingest" },
           tokenHash: "hash-service",
           createdAt: at("2026-05-14T10:04:00.000Z"),
           expiresAt: at("2026-05-21T10:04:00.000Z"),
@@ -902,8 +946,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
         await expect(
           storage.accessTokens.list({
             projectId,
-            subjectType: "serviceAccount",
-            subjectId: "svc_ingest",
+            subject: { type: "serviceAccount", id: "svc_ingest" },
           })
         ).resolves.toMatchObject({
           accessTokens: [{ id: "tok_service" }],
@@ -978,8 +1021,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             projectId,
             name: `Token by ${principal.type}`,
             kind: "personal",
-            subjectType: "user",
-            subjectId: "usr_creator",
+            subject: { type: "user", id: "usr_creator" },
             tokenHash: `hash-${tokenId}`,
             createdByPrincipal: principal,
             createdBySessionId: "ses_creator",
@@ -1019,8 +1061,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           projectId,
           name: "Touch token",
           kind: "personal",
-          subjectType: "user",
-          subjectId: "usr_1",
+          subject: { type: "user", id: "usr_1" },
           tokenHash: "hash-touch",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1066,8 +1107,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             projectId,
             name: `Token ${id}`,
             kind: "personal",
-            subjectType: "user",
-            subjectId: "usr_1",
+            subject: { type: "user", id: "usr_1" },
             tokenHash: `hash-${id}`,
             createdAt: at(`2026-05-14T10:0${index}:00.000Z`),
             expiresAt: at(`2026-05-21T10:0${index}:00.000Z`),
@@ -1182,8 +1222,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             projectId,
             name: "Bad kind",
             kind: "serviceAccount",
-            subjectType: "user",
-            subjectId: "usr_1",
+            subject: { type: "user", id: "usr_1" },
             tokenHash: "hash",
             createdAt: at("2026-05-14T10:00:00.000Z"),
             expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1196,8 +1235,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             projectId,
             name: "Missing subject",
             kind: "serviceAccount",
-            subjectType: "serviceAccount",
-            subjectId: "svc_missing",
+            subject: { type: "serviceAccount", id: "svc_missing" },
             tokenHash: "hash",
             createdAt: at("2026-05-14T10:00:00.000Z"),
             expiresAt: at("2026-05-21T10:00:00.000Z"),
@@ -1316,11 +1354,11 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("authorizes a device and atomically creates its one-time access token", async () => {
+    test("authorizes a device and atomically starts its bearer session", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)
         await storage.sessions.create({
-          id: "ses_device",
+          id: "ses_browser",
           projectId,
           userId: "usr_1",
           strategyId: "magic-link",
@@ -1335,72 +1373,149 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           deviceCodeHash: "device-code-hash",
           userCode: "BCDF-HJKM",
           clientName: "sixb CLI",
-          tokenName: "codex",
-          tokenExpiresAt: at("2026-08-12T10:00:00.000Z"),
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-14T10:10:00.000Z"),
         })
 
         await expect(
           storage.deviceAuthorizations.getByUserCode({ projectId, userCode: "BCDF-HJKM" })
-        ).resolves.toMatchObject({ id: "dva_1", status: "pending" })
+        ).resolves.toMatchObject({ id: "dva_1", status: "pending", clientName: "sixb CLI" })
         await storage.deviceAuthorizations.approve({
           projectId,
           id: "dva_1",
           userId: "usr_1",
-          sessionId: "ses_device",
+          sessionId: "ses_browser",
           approvedAt: at("2026-05-14T10:01:00.000Z"),
         })
 
-        const completed = await storage.completeDeviceAuthorization({
-          projectId,
-          id: "dva_1",
-          deviceCodeHash: "device-code-hash",
-          completedAt: at("2026-05-14T10:02:00.000Z"),
-          accessToken: {
-            id: "tok_device",
-            projectId,
-            name: "codex",
-            kind: "personal",
-            subjectType: "user",
-            subjectId: "usr_1",
-            tokenHash: "access-token-hash",
-            createdByPrincipal: { type: "user", id: "usr_1" },
-            createdBySessionId: "ses_device",
-            createdAt: at("2026-05-14T10:02:00.000Z"),
-            expiresAt: at("2026-08-12T10:00:00.000Z"),
-          },
-        })
-
-        expect(completed.authorization).toMatchObject({ status: "consumed" })
-        expect(completed.accessToken).toMatchObject({ id: "tok_device", subjectId: "usr_1" })
-        await expectAuthError(
+        const complete = (id: string) =>
           storage.completeDeviceAuthorization({
             projectId,
             id: "dva_1",
             deviceCodeHash: "device-code-hash",
-            completedAt: at("2026-05-14T10:03:00.000Z"),
-            accessToken: {
-              id: "tok_device_2",
-              projectId,
-              name: "codex",
-              kind: "personal",
-              subjectType: "user",
-              subjectId: "usr_1",
-              tokenHash: "access-token-hash-2",
-              createdBySessionId: "ses_device",
-              createdAt: at("2026-05-14T10:03:00.000Z"),
-              expiresAt: at("2026-08-12T10:00:00.000Z"),
-            },
-          }),
-          "invalid_device_authorization"
-        )
+            completedAt: at("2026-05-14T10:02:00.000Z"),
+            session: bearerSessionInput(id),
+          })
+        const completed = await complete("ses_cli")
+
+        expect(completed.authorization).toMatchObject({ status: "consumed" })
+        expect(completed.session).toMatchObject({
+          id: "ses_cli",
+          userId: "usr_1",
+          bearer: { clientName: "sixb CLI", refreshTokenHash: "refresh-1" },
+        })
+        await expectAuthError(complete("ses_cli_2"), "invalid_device_authorization")
+        await expect(storage.sessions.getById({ projectId, id: "ses_cli_2" })).resolves.toBeNull()
+      })
+    })
+
+    test("keeps bearer and cookie session credentials apart", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.sessions.create(bearerSessionInput("ses_cli"))
+        await storage.sessions.create({
+          ...bearerSessionInput("ses_cookie"),
+          tokenHash: "cookie-hash",
+          bearer: undefined,
+        })
+        const now = at("2026-05-14T10:05:00.000Z")
+
+        await expect(
+          storage.sessions.findValidByAccessTokenHash({
+            projectId,
+            id: "ses_cli",
+            tokenHash: "access-1",
+            now,
+          })
+        ).resolves.toMatchObject({ id: "ses_cli" })
+        // A bearer access token never works as a cookie secret, and a cookie never as a token.
+        await expect(
+          storage.sessions.findValidByTokenHash({
+            projectId,
+            id: "ses_cli",
+            audience: "atlas",
+            tokenHash: "access-1",
+            now,
+          })
+        ).resolves.toBeNull()
+        await expect(
+          storage.sessions.findValidByAccessTokenHash({
+            projectId,
+            id: "ses_cookie",
+            tokenHash: "cookie-hash",
+            now,
+          })
+        ).resolves.toBeNull()
+        // The access token expires before its session.
         await expect(
-          storage.accessTokens.getById({ projectId, id: "tok_device_2" })
+          storage.sessions.findValidByAccessTokenHash({
+            projectId,
+            id: "ses_cli",
+            tokenHash: "access-1",
+            now: at("2026-05-14T10:15:00.000Z"),
+          })
         ).resolves.toBeNull()
       })
     })
 
+    test("rotates refresh tokens, tolerates a lost response, and revokes on reuse", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.sessions.create({
+          ...bearerSessionInput("ses_cli"),
+          absoluteExpiresAt: at("2026-06-20T00:00:00.000Z"),
+        })
+        const rotate = (refreshTokenHash: string, now: string, generation: number) =>
+          storage.sessions.rotateRefreshToken({
+            projectId,
+            id: "ses_cli",
+            refreshTokenHash,
+            now: at(now),
+            reuseGraceMs: 60_000,
+            next: {
+              tokenHash: `access-${generation}`,
+              accessExpiresAt: new Date(at(now).getTime() + 15 * 60_000),
+              refreshTokenHash: `refresh-${generation}`,
+              expiresAt: at("2026-07-01T00:00:00.000Z"),
+            },
+          })
+
+        const rotated = await rotate("refresh-1", "2026-05-15T10:00:00.000Z", 2)
+        expect(rotated).toMatchObject({
+          status: "rotated",
+          session: {
+            tokenHash: "access-2",
+            bearer: { refreshTokenHash: "refresh-2", previousRefreshTokenHash: "refresh-1" },
+          },
+        })
+        // The idle deadline moves, but never past the absolute one.
+        expect(rotated.status === "rotated" && rotated.session.expiresAt.toISOString()).toBe(
+          "2026-06-20T00:00:00.000Z"
+        )
+        // The response was lost; the client retries with the token it still has.
+        await expect(rotate("refresh-1", "2026-05-15T10:00:30.000Z", 3)).resolves.toMatchObject({
+          status: "rotated",
+          session: { bearer: { refreshTokenHash: "refresh-3" } },
+        })
+        // An unknown token fails without touching the session.
+        await expect(rotate("guess", "2026-05-15T10:01:00.000Z", 4)).resolves.toEqual({
+          status: "invalid",
+        })
+        expect((await storage.sessions.getById({ projectId, id: "ses_cli" }))?.revokedAt).toBe(
+          undefined
+        )
+        // A replaced token after the grace window means a copy is in use: end the session.
+        await expect(rotate("refresh-2", "2026-05-15T10:05:00.000Z", 4)).resolves.toEqual({
+          status: "reused",
+        })
+        await expect(rotate("refresh-3", "2026-05-15T10:05:01.000Z", 5)).resolves.toEqual({
+          status: "invalid",
+        })
+        const session = await storage.sessions.getById({ projectId, id: "ses_cli" })
+        expect(session?.revokedAt).toBeInstanceOf(Date)
+      })
+    })
+
     test("completes magic-link sign-in for an existing user", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)
@@ -1634,91 +1749,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("closes bootstrap user creation when an active user already exists", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com",
-        })
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "founder@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at("2026-05-14T10:01:00.000Z"),
-          expiresAt: at("2026-05-14T10:16:00.000Z"),
-        })
-
-        await expectAuthError(
-          storage.completeMagicLinkSignIn({
-            projectId,
-            magicLinkId: "ml_1",
-            tokenHash: "link-hash",
-            completedAt: at("2026-05-14T10:03:00.000Z"),
-            newUserId: "usr_founder",
-            allowUserCreationWithoutInvitation: true,
-            requireNoActiveUsersForUserCreation: true,
-            session: sessionInput("ses_founder"),
-          }),
-          "user_creation_not_allowed"
-        )
-        await expect(
-          storage.users.getByEmail({ projectId, email: "founder@acme.com" })
-        ).resolves.toBeNull()
-        await expect(storage.magicLinks.getById({ projectId, id: "ml_1" })).resolves.toMatchObject({
-          consumedAt: at("2026-05-14T10:03:00.000Z"),
-        })
-      })
-    })
-
-    test("does not apply the bootstrap closure guard to invited user creation", async () => {
-      await withStorage(async (storage) => {
-        await createUser(storage, {
-          id: "usr_existing",
-          email: "existing@acme.com",
-        })
-        await storage.invitations.createOrUpdateActive({
-          id: "inv_1",
-          projectId,
-          email: "invited@acme.com",
-          groupIds: ["commercial"],
-          createdAt: at("2026-05-14T10:00:00.000Z"),
-          expiresAt: at("2026-05-21T10:00:00.000Z"),
-        })
-        await storage.magicLinks.create({
-          id: "ml_1",
-          projectId,
-          strategyId: "magic-link",
-          audience: "atlas",
-          email: "invited@acme.com",
-          tokenHash: "link-hash",
-          createdAt: at("2026-05-14T10:01:00.000Z"),
-          expiresAt: at("2026-05-14T10:16:00.000Z"),
-        })
-
-        const result = await storage.completeMagicLinkSignIn({
-          projectId,
-          magicLinkId: "ml_1",
-          tokenHash: "link-hash",
-          completedAt: at("2026-05-14T10:03:00.000Z"),
-          newUserId: "usr_invited",
-          requireNoActiveUsersForUserCreation: true,
-          session: sessionInput("ses_invited"),
-        })
-
-        expect(result.user).toMatchObject({
-          id: "usr_invited",
-          email: "invited@acme.com",
-        })
-        expect(result.invitation).toMatchObject({
-          id: "inv_1",
-          status: "accepted",
-        })
-      })
-    })
-
     test("consumes valid magic links when an existing user is suspended", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { status: "suspended" })
@@ -1780,7 +1810,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           completedAt: at("2026-05-14T10:02:00.000Z"),
           subject: "00u1",
           email: "renamed@acme.com",
-          emailVerified: true,
           claims: { email: "renamed@acme.com" },
           newUserId: "usr_unused",
           session: sessionInput("ses_oidc"),
@@ -1798,65 +1827,35 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("auto-links OIDC by verified email only when explicitly allowed", async () => {
+    test("links a new OIDC identity to the existing user with its email", async () => {
       await withStorage(async (storage) => {
         await createUser(storage, { id: "usr_existing", email: "ava@acme.com" })
         await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_blocked",
+          id: "oidc_1",
           projectId,
           strategyId: "okta",
           audience: "atlas",
-          stateHash: "blocked-state",
+          stateHash: "state-hash",
           nonceHash: "nonce-hash",
           codeVerifier: "verifier",
           createdAt: at("2026-05-14T10:00:00.000Z"),
           expiresAt: at("2026-05-14T10:10:00.000Z"),
         })
 
-        await expectAuthError(
-          storage.completeOidcSignIn({
-            projectId,
-            oidcAuthorizationAttemptId: "oidc_blocked",
-            stateHash: "blocked-state",
-            completedAt: at("2026-05-14T10:01:00.000Z"),
-            subject: "00u1",
-            email: "ava@acme.com",
-            emailVerified: false,
-            autoLinkByVerifiedEmail: true,
-            newUserId: "usr_unused",
-            session: sessionInput("ses_blocked"),
-          }),
-          "email_link_not_allowed"
-        )
-
-        await storage.oidcAuthorizationAttempts.create({
-          id: "oidc_allowed",
-          projectId,
-          strategyId: "okta",
-          audience: "atlas",
-          stateHash: "allowed-state",
-          nonceHash: "nonce-hash",
-          codeVerifier: "verifier",
-          createdAt: at("2026-05-14T10:02:00.000Z"),
-          expiresAt: at("2026-05-14T10:12:00.000Z"),
-        })
         const result = await storage.completeOidcSignIn({
           projectId,
-          oidcAuthorizationAttemptId: "oidc_allowed",
-          stateHash: "allowed-state",
-          completedAt: at("2026-05-14T10:03:00.000Z"),
+          oidcAuthorizationAttemptId: "oidc_1",
+          stateHash: "state-hash",
+          completedAt: at("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "ava@acme.com",
-          emailVerified: true,
-          autoLinkByVerifiedEmail: true,
           newUserId: "usr_unused",
-          session: sessionInput("ses_allowed"),
+          session: sessionInput("ses_oidc"),
         })
 
         expect(result.user.id).toBe("usr_existing")
-        expect(result.identity).toMatchObject({
-          userId: "usr_existing",
-        })
+        expect(result.identity).toMatchObject({ subject: "00u1", userId: "usr_existing" })
+        await expect(storage.users.getById({ projectId, id: "usr_unused" })).resolves.toBeNull()
       })
     })
 
@@ -1890,7 +1889,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           subject: "00u1",
           email: "ava@acme.com",
           displayName: "Ava Chen",
-          emailVerified: true,
           newUserId: "usr_oidc",
           session: sessionInput("ses_oidc"),
         })
@@ -1937,7 +1935,6 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
             completedAt: at("2026-05-14T10:01:00.000Z"),
             subject: "00u1",
             email: "ava@acme.com",
-            emailVerified: true,
             newUserId: "usr_oidc",
             session: sessionInput("ses_oidc"),
           }),
@@ -1949,7 +1946,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
-    test("allows first OIDC bootstrap user creation with manual groups", async () => {
+    test("allows OIDC bootstrap user creation with manual groups", async () => {
       await withStorage(async (storage) => {
         await storage.oidcAuthorizationAttempts.create({
           id: "oidc_bootstrap",
@@ -1970,9 +1967,7 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
           completedAt: at("2026-05-14T10:01:00.000Z"),
           subject: "00u1",
           email: "founder@acme.com",
-          emailVerified: true,
           allowUserCreationWithoutInvitation: true,
-          requireNoActiveUsersForUserCreation: true,
           manualGroupIds: ["security-admins"],
           newUserId: "usr_founder",
           session: sessionInput("ses_oidc_bootstrap"),
@@ -1988,6 +1983,72 @@ export function runAuthStorageContractSuite<TStorage extends AuthStorage>(
       })
     })
 
+    test("syncs directory memberships to exactly the groups the provider grants", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        for (const [groupId, source] of [
+          ["security-admins", "manual"],
+          ["commercial", "invitation"],
+          ["legacy-team", "directory"],
+        ] as const) {
+          await storage.groupMemberships.upsert({ projectId, userId: "usr_1", groupId, source })
+        }
+
+        await completeOidcSignInForAva(storage, ["security-admins", "field-ops"])
+
+        // legacy-team is no longer granted; security-admins keeps its manual source.
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([
+          { groupId: "commercial", source: "invitation" },
+          { groupId: "field-ops", source: "directory" },
+          { groupId: "security-admins", source: "manual" },
+        ])
+      })
+    })
+
+    test("removes every directory membership when the provider grants no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "security-admins",
+          source: "manual",
+        })
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory",
+        })
+
+        await completeOidcSignInForAva(storage, [])
+
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }])
+      })
+    })
+
+    test("leaves directory memberships alone when sign-in syncs no groups", async () => {
+      await withStorage(async (storage) => {
+        await createUser(storage)
+        await storage.groupMemberships.upsert({
+          projectId,
+          userId: "usr_1",
+          groupId: "field-ops",
+          source: "directory",
+        })
+
+        await completeOidcSignInForAva(storage, undefined)
+
+        await expect(
+          storage.groupMemberships.listForUser({ projectId, userId: "usr_1" })
+        ).resolves.toMatchObject([{ groupId: "field-ops", source: "directory" }])
+      })
+    })
+
     test("suspends users and revokes active sessions immediately", async () => {
       await withStorage(async (storage) => {
         await createUser(storage)

package/src/testing/execution-storage-contract.ts

@@ -402,8 +402,7 @@ async function seedAuth(auth: AuthStorage): Promise<void> {
     projectId,
     name: "Service token",
     kind: "serviceAccount",
-    subjectType: "serviceAccount",
-    subjectId: "service-one",
+    subject: { type: "serviceAccount", id: "service-one" },
     tokenHash: "service-token-hash",
     createdAt,
     expiresAt,

package/src/testing/execution.ts

@@ -2,7 +2,6 @@ import type { AuthorizationContext } from "../authorization"
 import { createTestingScope } from "../execution/scopes"
 import type { ExecutionScope } from "../execution/types"
 import { bindModelExecutionAttempt } from "../models/execution/binding"
-import type { OntologySource } from "../ontology"
 import { SixbHost, type SixbHostOptions } from "../runtime/host"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 
@@ -26,12 +25,10 @@ export interface TestExecutionHost {
   withScope(scope: ExecutionScope): object
 }
 
-export function createTestSixb<
-  TOntologySources extends readonly OntologySource[] = readonly OntologySource[],
->(
-  hostOrOptions: TestExecutionHost | SixbHostOptions<TOntologySources>,
+export function createTestSixb(
+  hostOrOptions: TestExecutionHost | SixbHostOptions,
   options: TestExecutionOptions = {}
-): Sixb<TOntologySources> {
+): Sixb {
   const host: TestExecutionHost =
     "withScope" in hostOrOptions ? hostOrOptions : new SixbHost(hostOrOptions)
   const sixb = host.withScope(
@@ -43,7 +40,7 @@ export function createTestSixb<
       ...(options.correlationId === undefined ? {} : { correlationId: options.correlationId }),
     })
   )
-  if (!isBoundSixb<TOntologySources>(sixb)) {
+  if (!isBoundSixb(sixb)) {
     throw new Error("[Sixb] Test host did not return an execution-bound Sixb SDK.")
   }
   bindModelExecutionAttempt(sixb.models, {