@rehearsal-db/core 0.1.0-beta.11 → 0.1.0-beta.13

package/src/cli/runtime_commands.mjs

@@ -211,6 +211,82 @@ const projectCommandEnvironment = (additional = {}) => ({
   ...additional,
 });
 
+const RUNTIME_STARTUP_FAILURE_PATTERN =
+  /container\b.*\b(?:is not ready|starting|unhealthy)|health(?:check)?\b.*\b(?:failed|starting|unhealthy)|out of memory|\boom\b|no space left|resource temporarily unavailable/iu;
+
+export const classifyManagerFailure = ({
+  action,
+  output,
+  inferredCategory,
+}) => {
+  if (RUNTIME_STARTUP_FAILURE_PATTERN.test(output)) {
+    return "runtime_dependency_failure";
+  }
+  if (
+    action === "migrate" ||
+    (action === "run" &&
+      /migrateRuntime|candidate migration|migration up/iu.test(output))
+  ) {
+    return "migration_candidate_failure";
+  }
+  return inferredCategory;
+};
+
+export const parseDockerCapacity = (output) => {
+  const [cpuText, memoryText, runningText, totalText] = output
+    .trim()
+    .split(/\s+/u);
+  const values = [cpuText, memoryText, runningText, totalText].map(Number);
+  if (!values.every(Number.isFinite)) return null;
+  const [cpus, memoryBytes, runningContainers, containers] = values;
+  return { cpus, memoryBytes, runningContainers, containers };
+};
+
+export const parseColimaMemory = (output) => {
+  const line = output
+    .split("\n")
+    .map((entry) => entry.trim())
+    .find((entry) => entry.startsWith("Mem:"));
+  if (!line) return null;
+  const columns = line.split(/\s+/u);
+  const totalBytes = Number(columns[1]);
+  const availableBytes = Number(columns[6]);
+  if (![totalBytes, availableBytes].every(Number.isFinite)) return null;
+  return { totalBytes, availableBytes };
+};
+
+const diagnosticCommand = (command, args) =>
+  spawnSync(command, args, {
+    encoding: "utf8",
+    env: projectCommandEnvironment(),
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5_000,
+  });
+
+const inspectContainerCapacity = () => {
+  const docker = diagnosticCommand("docker", [
+    "info",
+    "--format",
+    "{{.NCPU}} {{.MemTotal}} {{.ContainersRunning}} {{.Containers}}",
+  ]);
+  const capacity =
+    docker.status === 0 ? parseDockerCapacity(docker.stdout) : null;
+  if (!capacity) return undefined;
+
+  const context = diagnosticCommand("docker", ["context", "show"]);
+  if (context.status !== 0 || context.stdout.trim() !== "colima") {
+    return { engine: "docker-compatible", ...capacity };
+  }
+  const memory = diagnosticCommand("colima", ["ssh", "--", "free", "-b"]);
+  return {
+    engine: "colima",
+    ...capacity,
+    ...(memory.status === 0
+      ? { runtimeMemory: parseColimaMemory(memory.stdout) ?? undefined }
+      : {}),
+  };
+};
+
 export const topologyCommandEnvironment = (topology) =>
   Object.fromEntries(
     topology.targets.map((target) => [
@@ -344,14 +420,15 @@ export const createRuntimeCommands = ({
       const inferred = normalizeRehearsalError(
         new Error(completeOutput || `Rehearsal ${action} failed.`),
       );
-      const category =
-        action === "migrate" ||
-        (action === "run" &&
-          /migrateRuntime|candidate migration|migration up/iu.test(
-            completeOutput,
-          ))
-          ? "migration_candidate_failure"
-          : inferred.category;
+      const category = classifyManagerFailure({
+        action,
+        output: completeOutput,
+        inferredCategory: inferred.category,
+      });
+      const startupFailure = category === "runtime_dependency_failure";
+      const engineCapacity = startupFailure
+        ? inspectContainerCapacity()
+        : undefined;
       const conciseOutput = completeOutput
         .replaceAll(String.fromCodePoint(27), "")
         .split("\n")
@@ -366,10 +443,16 @@ export const createRuntimeCommands = ({
         message: `The local Rehearsal ${action} operation did not complete.`,
         expected: "the isolated runtime operation to finish and verify",
         actual: conciseOutput || `exit ${result.status}`,
-        context: { action },
+        context: { action, ...(engineCapacity ? { engineCapacity } : {}) },
         refused: "The runtime was not reported as trusted.",
         suggestions: [
           "Review the concise failure above, then rerun rehearsal doctor before retrying.",
+          ...(startupFailure
+            ? [
+                "Stop unrelated local stacks or increase Docker/Colima capacity, then retry. Rehearsal will not change engine settings or bypass service health checks.",
+                "Run docker stats --no-stream to identify active containers using the shared engine.",
+              ]
+            : []),
           "Use --debug only when the safe diagnostic detail is needed.",
         ],
         cause: new Error(completeOutput || `exit ${result.status}`),

package/src/cli/source_commands.mjs

@@ -13,7 +13,10 @@ import {
   pruneBaselineGenerations,
   verifyActiveBaseline,
 } from "../baseline/artifact.mjs";
-import { readPrivacyKey } from "../baseline/privacy_engine.mjs";
+import {
+  createPrivacyEngine,
+  readPrivacyKey,
+} from "../baseline/privacy_engine.mjs";
 import { loadRehearsalConfig } from "../project/configuration.mjs";
 import {
   createSourceAccessPlan,
@@ -21,6 +24,7 @@ import {
 } from "../source/access.mjs";
 import { streamApprovedSupabaseAssets } from "../source/asset_transfer.mjs";
 import { refreshPostgresqlBaseline } from "../source/baseline.mjs";
+import { resolvePrivacyMappedAssets } from "../source/privacy_paths.mjs";
 import {
   applyPostgresqlSourceAccess,
   planPostgresqlSourceAccessRetirement,
@@ -114,6 +118,15 @@ export const runSourceBaselineRefresh = async ({ planOptions }) => {
       join(loaded.projectRoot, sourcePolicy.reader.credentialFile),
     ),
   ]);
+  const privacyPolicy = JSON.parse(privacyPolicyBytes.toString("utf8"));
+  const assetPrivacyEngine = createPrivacyEngine({
+    policy: privacyPolicy,
+    key: privacyKey,
+  });
+  const assetDeclarations = resolvePrivacyMappedAssets({
+    sourcePolicy,
+    privacyPolicy,
+  });
   return refreshPostgresqlBaseline({
     connectionString,
     sourcePolicy,
@@ -133,10 +146,12 @@ export const runSourceBaselineRefresh = async ({ planOptions }) => {
           baseUrl:
             process.env[sourcePolicy.assetReader.baseUrlEnvironmentVariable],
           token: process.env[sourcePolicy.assetReader.tokenEnvironmentVariable],
-          declarations: sourcePolicy.assets,
+          declarations: assetDeclarations,
           maximumObjects: sourcePolicy.assetReader.maximumObjects,
           maximumObjectBytes: sourcePolicy.assetReader.maximumObjectBytes,
           maximumTotalBytes: sourcePolicy.assetReader.maximumTotalBytes,
+          pathMapper: ({ mapping, value }) =>
+            assetPrivacyEngine.remapPath({ mapping, value }),
         })
       : [],
   });
@@ -244,9 +259,15 @@ export const buildRefreshWorkflowPlan = async (planOptions) => {
 };
 
 export const createRefreshWorkflow =
-  ({ runRuntimeStack, prepareDependentTargets, topologyCommandEnvironment }) =>
+  ({
+    runRuntimeStack,
+    prepareDependentTargets,
+    topologyCommandEnvironment,
+    buildPlan = buildRefreshWorkflowPlan,
+    refreshBaseline = runSourceBaselineRefresh,
+  }) =>
   async ({ flags, planOptions }) => {
-    const context = await buildRefreshWorkflowPlan(planOptions);
+    const context = await buildPlan(planOptions);
     if (!flags.refreshConfirmation) {
       return { mode: "preview", plan: context.plan };
     }
@@ -259,7 +280,7 @@ export const createRefreshWorkflow =
     let runtime;
     let preparations = [];
     try {
-      refreshed = await runSourceBaselineRefresh({ planOptions });
+      refreshed = await refreshBaseline({ planOptions });
       const stack = await runRuntimeStack({
         command: "reset",
         flags,

package/src/identity/provider_configuration.mjs

@@ -0,0 +1,177 @@
+/** Render reviewed local OAuth declarations into the disposable Supabase runtime. */
+
+const escapePattern = (value) =>
+  value.replaceAll(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+
+const LEGACY_PROVIDER_KEYS = new Set([
+  "client_id",
+  "email_optional",
+  "enabled",
+  "redirect_uri",
+  "secret",
+  "skip_nonce_check",
+]);
+const SAFE_BOOLEAN_PROVIDER_KEYS = new Set([
+  "email_optional",
+  "skip_nonce_check",
+]);
+
+const readTomlSections = (source) => {
+  const lines = source.split("\n");
+  const sections = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const match = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(lines[index]);
+    if (!match) continue;
+    if (sections.length) sections.at(-1).end = index;
+    sections.push({ name: match[1], start: index, end: lines.length });
+  }
+  return { lines, sections };
+};
+
+const validateLegacyProviderSection = ({ lines, section, provider }) => {
+  const seen = new Set();
+  for (const line of lines.slice(section.start + 1, section.end)) {
+    if (!line.trim() || /^\s*#/u.test(line)) continue;
+    const assignment = /^\s*([A-Za-z0-9_]+)\s*=/u.exec(line);
+    if (!assignment || !LEGACY_PROVIDER_KEYS.has(assignment[1])) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name} section contains an unsupported setting. Rehearsal left the tracked template unchanged.`,
+      );
+    }
+    const key = assignment[1];
+    if (seen.has(key)) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name} section contains duplicate ${key} settings.`,
+      );
+    }
+    seen.add(key);
+    if (
+      SAFE_BOOLEAN_PROVIDER_KEYS.has(key) &&
+      !new RegExp(
+        `^\\s*${escapePattern(key)}\\s*=\\s*${
+          key === "skip_nonce_check"
+            ? (provider.skipNonceCheck ?? false)
+            : (provider.emailOptional ?? false)
+        }\\s*(?:#.*)?$`,
+        "u",
+      ).test(line)
+    ) {
+      throw new Error(
+        `The local Supabase template auth.external.${provider.name}.${key} setting must match its explicit declarative authentication option before Rehearsal can replace the legacy provider in its disposable runtime copy.`,
+      );
+    }
+  }
+};
+
+export const inspectSupabaseAuthenticationProviderTransition = ({
+  source,
+  authentication,
+}) => {
+  if (!authentication) return Object.freeze({ replacedProviders: [] });
+  const { lines, sections } = readTomlSections(source);
+  const replacementSections = [];
+  for (const provider of authentication.providers) {
+    const sectionName = `auth.external.${provider.name}`;
+    const nested = sections.filter((section) =>
+      section.name.startsWith(`${sectionName}.`),
+    );
+    if (nested.length) {
+      throw new Error(
+        `The local Supabase template contains unsupported nested ${sectionName} configuration. Rehearsal left the tracked template unchanged.`,
+      );
+    }
+    const matching = sections.filter((section) => section.name === sectionName);
+    if (matching.length > 1) {
+      throw new Error(
+        `The local Supabase template declares ${sectionName} more than once.`,
+      );
+    }
+    if (matching.length === 1) {
+      validateLegacyProviderSection({
+        lines,
+        section: matching[0],
+        provider,
+      });
+      replacementSections.push({ ...matching[0], provider: provider.name });
+    }
+  }
+  return Object.freeze({
+    replacedProviders: Object.freeze(
+      replacementSections.map(({ provider }) => provider),
+    ),
+    replacementSections: Object.freeze(replacementSections),
+  });
+};
+
+export const renderSupabaseAuthenticationProviders = ({
+  authentication,
+  apiPort,
+}) => {
+  if (!authentication) return "";
+  return authentication.providers
+    .map(
+      (
+        provider,
+      ) => `# Generated by Rehearsal from config.supabase.authentication.
+[auth.external.${provider.name}]
+enabled = true
+client_id = "env(${provider.clientIdEnvironmentVariable})"
+secret = "env(${provider.clientSecretEnvironmentVariable})"
+redirect_uri = "http://127.0.0.1:${apiPort}/auth/v1/callback"
+${provider.skipNonceCheck ? "skip_nonce_check = true\n" : ""}${provider.emailOptional ? "email_optional = true\n" : ""}
+`,
+    )
+    .join("\n");
+};
+
+const enableLocalSignup = (source) => {
+  const lines = source.split("\n");
+  let inAuth = false;
+  let authSections = 0;
+  let signupSettings = 0;
+  const updated = lines.map((line) => {
+    const section = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/u.exec(line);
+    if (section) {
+      inAuth = section[1] === "auth";
+      if (inAuth) authSections += 1;
+      return line;
+    }
+    if (!inAuth || !/^\s*enable_signup\s*=/u.test(line)) return line;
+    signupSettings += 1;
+    const comment = line.match(/\s+#.*$/u)?.[0] ?? "";
+    return `enable_signup = true${comment}`;
+  });
+  if (authSections !== 1 || signupSettings !== 1) {
+    throw new Error(
+      "The local Supabase template must declare exactly one [auth] section with one enable_signup setting before Rehearsal can configure OAuth.",
+    );
+  }
+  return updated.join("\n");
+};
+
+export const applySupabaseAuthenticationProviders = ({
+  source,
+  authentication,
+  apiPort,
+}) => {
+  if (!authentication) return source;
+  const transition = inspectSupabaseAuthenticationProviderTransition({
+    source,
+    authentication,
+  });
+  const { lines } = readTomlSections(source);
+  const replacedIndexes = new Set(
+    transition.replacementSections.flatMap((section) =>
+      Array.from(
+        { length: section.end - section.start },
+        (_, offset) => section.start + offset,
+      ),
+    ),
+  );
+  const transitionedSource = lines
+    .filter((_, index) => !replacedIndexes.has(index))
+    .join("\n");
+  const runtimeSource = enableLocalSignup(transitionedSource);
+  const separator = runtimeSource.endsWith("\n") ? "\n" : "\n\n";
+  return `${runtimeSource}${separator}${renderSupabaseAuthenticationProviders({ authentication, apiPort })}`;
+};

package/src/project/configuration.d.mts

@@ -8,6 +8,17 @@ export interface RehearsalConfig {
     migrationDirectory: string;
     rehearsalConfig: string;
     runtimeWorkdir: string;
+    authentication?: {
+      enableLocalSignup: true;
+      environmentFile: string;
+      providers: Array<{
+        name: "google" | "github";
+        clientIdEnvironmentVariable: string;
+        clientSecretEnvironmentVariable: string;
+        skipNonceCheck?: boolean;
+        emailOptional?: boolean;
+      }>;
+    };
     serviceEnvironmentFile?: string;
     serviceEnvironmentVariables?: string[];
   };

package/src/project/configuration.mjs

@@ -61,6 +61,7 @@ const POSTGRES_IMAGE_PATTERN = /^postgres:\d+(?:\.\d+)?-alpine$/u;
 const SAFE_COMMAND_PATTERN = /^[^\n\r\0]+$/u;
 const ENVIRONMENT_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
 const ENVIRONMENT_REFERENCE_PATTERN = /^[a-z0-9][a-z0-9-]*:[A-Z][A-Z0-9_]*$/u;
+const SUPPORTED_SUPABASE_OAUTH_PROVIDERS = new Set(["github", "google"]);
 
 const isPlainObject = (value) =>
   value !== null &&
@@ -251,6 +252,7 @@ const normalizeConfig = (input) => {
         "migrationDirectory",
         "rehearsalConfig",
         "runtimeWorkdir",
+        "authentication",
         "serviceEnvironmentFile",
         "serviceEnvironmentVariables",
       ],
@@ -437,8 +439,123 @@ const normalizeConfig = (input) => {
   if (!Array.isArray(commands)) {
     throw new Error("config.verification.commands must be an array.");
   }
-  const serviceEnvironmentVariables =
-    supabase?.serviceEnvironmentVariables ?? [];
+  const authentication =
+    supabase?.authentication === undefined
+      ? null
+      : assertPlainObject(
+          supabase.authentication,
+          "config.supabase.authentication",
+        );
+  let normalizedAuthentication = null;
+  if (authentication) {
+    assertKnownKeys(
+      authentication,
+      ["enableLocalSignup", "environmentFile", "providers"],
+      "config.supabase.authentication",
+    );
+    if (authentication.enableLocalSignup !== true) {
+      throw new Error(
+        "config.supabase.authentication.enableLocalSignup must be true to create the disposable local identity used by an OAuth sign-in.",
+      );
+    }
+    if (
+      supabase.serviceEnvironmentFile !== undefined ||
+      supabase.serviceEnvironmentVariables !== undefined
+    ) {
+      throw new Error(
+        "config.supabase.authentication cannot be combined with the legacy serviceEnvironmentFile or serviceEnvironmentVariables fields.",
+      );
+    }
+    if (safety.authenticationProviders !== undefined) {
+      throw new Error(
+        "config.safety.authenticationProviders is derived from config.supabase.authentication and must be omitted.",
+      );
+    }
+    if (
+      !Array.isArray(authentication.providers) ||
+      authentication.providers.length === 0
+    ) {
+      throw new Error(
+        "config.supabase.authentication.providers must be a non-empty array.",
+      );
+    }
+    const providers = authentication.providers.map((entry, index) => {
+      const path = `config.supabase.authentication.providers[${index}]`;
+      const value = assertPlainObject(entry, path);
+      assertKnownKeys(
+        value,
+        [
+          "name",
+          "clientIdEnvironmentVariable",
+          "clientSecretEnvironmentVariable",
+          "skipNonceCheck",
+          "emailOptional",
+        ],
+        path,
+      );
+      const name = assertNonEmptyString(value.name, `${path}.name`);
+      if (!SUPPORTED_SUPABASE_OAUTH_PROVIDERS.has(name)) {
+        throw new Error(
+          `${path}.name must be one of: ${[...SUPPORTED_SUPABASE_OAUTH_PROVIDERS].join(", ")}.`,
+        );
+      }
+      const environmentVariable = (key) => {
+        const variable = assertNonEmptyString(value[key], `${path}.${key}`);
+        if (!ENVIRONMENT_KEY_PATTERN.test(variable)) {
+          throw new Error(
+            `${path}.${key} must be a safe environment variable name.`,
+          );
+        }
+        return variable;
+      };
+      const optionalBoolean = (key) => {
+        if (value[key] === undefined) return false;
+        if (typeof value[key] !== "boolean") {
+          throw new Error(`${path}.${key} must be a boolean.`);
+        }
+        return value[key];
+      };
+      return Object.freeze({
+        name,
+        clientIdEnvironmentVariable: environmentVariable(
+          "clientIdEnvironmentVariable",
+        ),
+        clientSecretEnvironmentVariable: environmentVariable(
+          "clientSecretEnvironmentVariable",
+        ),
+        skipNonceCheck: optionalBoolean("skipNonceCheck"),
+        emailOptional: optionalBoolean("emailOptional"),
+      });
+    });
+    if (new Set(providers.map(({ name }) => name)).size !== providers.length) {
+      throw new Error(
+        "config.supabase.authentication.providers must not contain duplicate providers.",
+      );
+    }
+    const credentialVariables = providers.flatMap((provider) => [
+      provider.clientIdEnvironmentVariable,
+      provider.clientSecretEnvironmentVariable,
+    ]);
+    if (new Set(credentialVariables).size !== credentialVariables.length) {
+      throw new Error(
+        "config.supabase.authentication provider environment variables must be unique.",
+      );
+    }
+    normalizedAuthentication = Object.freeze({
+      enableLocalSignup: true,
+      environmentFile: assertRelativePath(
+        authentication.environmentFile,
+        "config.supabase.authentication.environmentFile",
+      ),
+      providers: Object.freeze(providers),
+    });
+  }
+  const serviceEnvironmentVariables = normalizedAuthentication
+    ? normalizedAuthentication.providers.flatMap((provider) => [
+        provider.clientIdEnvironmentVariable,
+        provider.clientSecretEnvironmentVariable,
+      ])
+    : (supabase?.serviceEnvironmentVariables ?? []);
   if (!Array.isArray(serviceEnvironmentVariables)) {
     throw new Error(
       "config.supabase.serviceEnvironmentVariables must be an array.",
@@ -460,19 +577,23 @@ const normalizeConfig = (input) => {
     );
   }
   if (
-    Boolean(supabase?.serviceEnvironmentFile) !==
-    Boolean(normalizedServiceEnvironmentVariables.length)
+    Boolean(
+      normalizedAuthentication?.environmentFile ??
+      supabase?.serviceEnvironmentFile,
+    ) !== Boolean(normalizedServiceEnvironmentVariables.length)
   ) {
     throw new Error(
       "config.supabase.serviceEnvironmentFile and serviceEnvironmentVariables must be configured together.",
     );
   }
-  const authenticationProviders = safety.authenticationProviders
-    ? assertStringArray(
-        safety.authenticationProviders,
-        "config.safety.authenticationProviders",
-      )
-    : [];
+  const authenticationProviders = normalizedAuthentication
+    ? normalizedAuthentication.providers.map(({ name }) => name)
+    : safety.authenticationProviders
+      ? assertStringArray(
+          safety.authenticationProviders,
+          "config.safety.authenticationProviders",
+        )
+      : [];
   if (runtimeTarget === "postgresql" && authenticationProviders.length > 0) {
     throw new Error(
       "config.safety.authenticationProviders is available only for the Supabase target.",
@@ -500,12 +621,15 @@ const normalizeConfig = (input) => {
             supabase.runtimeWorkdir,
             "config.supabase.runtimeWorkdir",
           ),
-          serviceEnvironmentFile: supabase.serviceEnvironmentFile
-            ? assertRelativePath(
-                supabase.serviceEnvironmentFile,
-                "config.supabase.serviceEnvironmentFile",
-              )
-            : null,
+          authentication: normalizedAuthentication,
+          serviceEnvironmentFile: normalizedAuthentication
+            ? normalizedAuthentication.environmentFile
+            : supabase.serviceEnvironmentFile
+              ? assertRelativePath(
+                  supabase.serviceEnvironmentFile,
+                  "config.supabase.serviceEnvironmentFile",
+                )
+              : null,
           serviceEnvironmentVariables: Object.freeze(
             normalizedServiceEnvironmentVariables,
           ),
@@ -1005,9 +1129,21 @@ export default defineRehearsalConfig({
 		rehearsalConfig: "infrastructure/rehearsal/supabase/config.toml",
 		runtimeWorkdir: ".rehearsal/runtime",
 
-		// Optional local-only identity-provider credentials. Enable both keys together.
-		// serviceEnvironmentFile: ".env.rehearsal-service.local",
-		// serviceEnvironmentVariables: ["LOCAL_IDP_CLIENT_ID", "LOCAL_IDP_SECRET"],
+		// Optional local OAuth connection. Secrets stay in the ignored owner-only file.
+		// Register http://127.0.0.1:${ports.api}/auth/v1/callback with the provider.
+		// authentication: {
+		// 	enableLocalSignup: true,
+		// 	environmentFile: ".env.rehearsal-service.local",
+		// 	providers: [
+		// 		{
+		// 			name: "google",
+		// 			clientIdEnvironmentVariable: "REHEARSAL_GOOGLE_CLIENT_ID",
+		// 			clientSecretEnvironmentVariable: "REHEARSAL_GOOGLE_CLIENT_SECRET",
+		// 			skipNonceCheck: false,
+		// 			emailOptional: false,
+		// 		},
+		// 	],
+		// },
 	},
 
 	// Immutable local baseline files. Rehearsal never reads production on your behalf.

package/src/project/setup.mjs

@@ -23,6 +23,11 @@ import {
   renderDetectedPostgresqlConfig,
 } from "./configuration.mjs";
 import { resolveRuntimeTarget } from "../targets/target.mjs";
+export {
+  assertSupportedRehearsalNodeRuntime,
+  inspectRehearsalNodeRuntime,
+} from "../shared/node_runtime.mjs";
+import { assertSupportedRehearsalNodeRuntime } from "../shared/node_runtime.mjs";
 
 const CONFIG_PATH = "rehearsal.config.mjs";
 const LOCAL_SUPABASE_CONFIG_PATH =
@@ -82,29 +87,6 @@ export const isRehearsalPortAvailable = async (port) => {
   return canBindToPort(port);
 };
 
-export const inspectRehearsalNodeRuntime = (
-  version = process.versions.node,
-) => {
-  const major = Number.parseInt(String(version).split(".")[0], 10);
-  return {
-    version: String(version),
-    major,
-    supported: major === 24,
-  };
-};
-
-export const assertSupportedRehearsalNodeRuntime = (
-  version = process.versions.node,
-) => {
-  const runtime = inspectRehearsalNodeRuntime(version);
-  if (!runtime.supported) {
-    throw new Error(
-      `Rehearsal setup requires Node.js 24; this shell is using Node.js ${runtime.version}. Switch to Node.js 24, then rerun setup. With nvm: nvm install 24 && nvm use 24.`,
-    );
-  }
-  return runtime;
-};
-
 export const findAvailableRehearsalPorts = async ({
   isAvailable = isRehearsalPortAvailable,
 } = {}) => {