tamper-signal 1.2.0

package/node/canonical.js

@@ -0,0 +1,271 @@
+// Canonicalization and semantic hashing: the Node port of
+// tamper_signal/canonical.py. Byte-identical output is the contract; the
+// golden vectors in test/vectors.json are generated by the Python side and
+// any divergence is a bug here. No dependencies.
+//
+// Exact decimal arithmetic uses BigInt: a parsed decimal is {v, exp} meaning
+// v * 10^exp with v a signed BigInt mantissa. Quantization to six places uses
+// round-half-even, matching Python's Decimal(_QUANT, ROUND_HALF_EVEN).
+//
+// Known divergences from Python, accepted as out of contract:
+// - Python's Decimal parses non-ASCII unicode digits; this port does not.
+// - Python's str.strip()/\s and JS trim()/\s disagree on U+FEFF.
+
+import { createHash } from "node:crypto";
+
+// ---------------------------------------------------------------------------
+// Evidence hash
+// ---------------------------------------------------------------------------
+export function evidenceHash(rawBytes) {
+  return createHash("sha256").update(rawBytes).digest("hex");
+}
+
+// ---------------------------------------------------------------------------
+// Exact decimals
+// ---------------------------------------------------------------------------
+const DECIMAL_RE = /^[+-]?(?:(\d+)(?:\.(\d*))?|\.(\d+))(?:[eE]([+-]?\d+))?$/;
+
+// Parse decimal text -> {v: BigInt, exp: number} or null when not a finite
+// plain number. Mirrors what survives Python's _coerce_decimal (Infinity and
+// NaN parse there but are filtered as non-finite; here they never parse).
+export function parseDecimal(text) {
+  const t = text.trim();
+  if (t === "") return null;
+  const m = DECIMAL_RE.exec(t);
+  if (!m) return null;
+  const neg = t[0] === "-";
+  const intPart = m[1] ?? "";
+  const fracPart = m[2] ?? m[3] ?? "";
+  const exp = (m[4] ? parseInt(m[4], 10) : 0) - fracPart.length;
+  const digits = (intPart + fracPart).replace(/^0+(?=\d)/, "") || "0";
+  let v = BigInt(digits);
+  if (neg) v = -v;
+  return { v, exp };
+}
+
+// Value * 10^6 as a BigInt, rounded half-even. The only rounding site.
+function quantizedUnits({ v, exp }) {
+  const neg = v < 0n;
+  let mant = neg ? -v : v;
+  const shift = exp + 6;
+  let units;
+  if (shift >= 0) {
+    units = mant * 10n ** BigInt(shift);
+  } else {
+    const divisor = 10n ** BigInt(-shift);
+    const q = mant / divisor;
+    const r = mant % divisor;
+    const twice = r * 2n;
+    if (twice > divisor) units = q + 1n;
+    else if (twice < divisor) units = q;
+    else units = q % 2n === 0n ? q : q + 1n; // tie: round to even
+  }
+  return neg ? -units : units;
+}
+
+// Plain decimal string of a {v, exp} decimal: quantize to six places, strip
+// trailing zeros, collapse all zero forms to "0", never scientific notation.
+export function decimalToPlainString(dec) {
+  let units = quantizedUnits(dec);
+  if (units === 0n) return "0";
+  const neg = units < 0n;
+  if (neg) units = -units;
+  const whole = units / 1000000n;
+  const frac = (units % 1000000n).toString().padStart(6, "0").replace(/0+$/, "");
+  return (neg ? "-" : "") + whole.toString() + (frac ? "." + frac : "");
+}
+
+// Exact sum of decimals (used by totals): align mantissas to the smallest
+// exponent. Returns {v, exp}.
+export function sumDecimals(decimals) {
+  if (!decimals.length) return { v: 0n, exp: 0 };
+  const exp = Math.min(...decimals.map((d) => d.exp));
+  let v = 0n;
+  for (const d of decimals) v += d.v * 10n ** BigInt(d.exp - exp);
+  return { v, exp };
+}
+
+function coerceDecimal(value) {
+  if (typeof value === "boolean") return null;
+  if (typeof value === "bigint") return { v: value, exp: 0 };
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) return null;
+    return parseDecimal(String(value));
+  }
+  if (typeof value === "string") return parseDecimal(value);
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Header normalization
+// ---------------------------------------------------------------------------
+export function normalizeHeader(header) {
+  const text = header === null || header === undefined ? "" : String(header);
+  return text.normalize("NFC").trim().toLowerCase().replace(/\s+/g, "_");
+}
+
+export function normalizeHeaders(headers) {
+  const normalized = headers.map(normalizeHeader);
+  const counts = new Map();
+  for (const name of normalized) counts.set(name, (counts.get(name) ?? 0) + 1);
+  const dupes = [...counts.keys()].filter((n) => counts.get(n) > 1).sort();
+  if (dupes.length) {
+    throw new Error("Duplicate headers after normalization: " + dupes.join(", "));
+  }
+  return normalized;
+}
+
+// ---------------------------------------------------------------------------
+// Cell normalization
+// ---------------------------------------------------------------------------
+function normalizeString(text) {
+  return text.normalize("NFC").trim();
+}
+
+function formatUtcDate(value) {
+  const pad = (n, w = 2) => String(n).padStart(w, "0");
+  const date = `${pad(value.getUTCFullYear(), 4)}-${pad(value.getUTCMonth() + 1)}-${pad(value.getUTCDate())}`;
+  const midnight =
+    value.getUTCHours() === 0 &&
+    value.getUTCMinutes() === 0 &&
+    value.getUTCSeconds() === 0 &&
+    value.getUTCMilliseconds() === 0;
+  if (midnight) return date; // dates round-trip through xlsx as midnight datetimes
+  return `${date}T${pad(value.getUTCHours())}:${pad(value.getUTCMinutes())}:${pad(value.getUTCSeconds())}Z`;
+}
+
+export function normalizeCell(value) {
+  if (value === null || value === undefined) return null;
+  if (typeof value === "boolean") return value;
+  if (value instanceof Date) return formatUtcDate(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      // Match Python's str(float) forms: inf / -inf / nan.
+      if (Number.isNaN(value)) return "nan";
+      return value > 0 ? "inf" : "-inf";
+    }
+    return decimalToPlainString(parseDecimal(String(value)));
+  }
+  if (typeof value === "bigint") {
+    return decimalToPlainString({ v: value, exp: 0 });
+  }
+  if (typeof value === "string") {
+    // Numeric-looking text canonicalizes as the number it parses to (spec
+    // 1.1), so format round-trips that stringify numbers keep the hash.
+    const d = parseDecimal(value);
+    if (d !== null) return decimalToPlainString(d);
+    return normalizeString(value);
+  }
+  return normalizeString(String(value));
+}
+
+// ---------------------------------------------------------------------------
+// Records -> canonical bytes
+// ---------------------------------------------------------------------------
+// Code-point string comparison: Python compares str by code point, while JS
+// default sort compares UTF-16 code units. They differ above U+FFFF.
+export function codePointCompare(a, b) {
+  if (a === b) return 0;
+  const ai = a[Symbol.iterator]();
+  const bi = b[Symbol.iterator]();
+  for (;;) {
+    const an = ai.next();
+    const bn = bi.next();
+    if (an.done && bn.done) return 0;
+    if (an.done) return -1;
+    if (bn.done) return 1;
+    const ac = an.value.codePointAt(0);
+    const bc = bn.value.codePointAt(0);
+    if (ac !== bc) return ac < bc ? -1 : 1;
+  }
+}
+
+function sortToken(cell) {
+  if (cell === null) return "0:";
+  if (typeof cell === "boolean") return "1:" + (cell ? "true" : "false");
+  return "2:" + cell;
+}
+
+export function canonicalize(records) {
+  // Union of keys across records, first-seen order, then normalized.
+  const rawHeaders = [];
+  const seen = new Set();
+  for (const record of records) {
+    for (const key of Object.keys(record)) {
+      const marker = normalizeHeader(key);
+      if (!seen.has(marker)) {
+        seen.add(marker);
+        rawHeaders.push(key);
+      }
+    }
+  }
+  const headers = normalizeHeaders(rawHeaders);
+
+  const order = [...headers.keys()].sort((i, j) => codePointCompare(headers[i], headers[j]));
+  const sortedHeaders = order.map((i) => headers[i]);
+
+  const rows = records.map((record) => {
+    const normalizedRecord = {};
+    for (const [k, v] of Object.entries(record)) normalizedRecord[normalizeHeader(k)] = v;
+    return order.map((i) => normalizeCell(normalizedRecord[headers[i]] ?? null));
+  });
+
+  rows.sort((ra, rb) => {
+    for (let i = 0; i < ra.length; i++) {
+      const c = codePointCompare(sortToken(ra[i]), sortToken(rb[i]));
+      if (c !== 0) return c;
+    }
+    return 0;
+  });
+
+  return canonicalJsonBytes({ headers: sortedHeaders, rows });
+}
+
+export function semanticHash(records) {
+  return createHash("sha256").update(canonicalize(records)).digest("hex");
+}
+
+// ---------------------------------------------------------------------------
+// Minimal RFC 8785 JCS serializer (receipt bodies and the data document)
+// ---------------------------------------------------------------------------
+export function canonicalJsonBytes(value) {
+  const out = [];
+  jcsWrite(value, out);
+  return Buffer.from(out.join(""), "utf-8");
+}
+
+function jcsWrite(value, out) {
+  if (value === null) {
+    out.push("null");
+  } else if (value === true || value === false) {
+    out.push(value ? "true" : "false");
+  } else if (typeof value === "number") {
+    // Receipt bodies carry integer leaves only (row counts, byte sizes);
+    // data leaves were pre-stringified during cell normalization.
+    if (!Number.isSafeInteger(value)) throw new TypeError("JCS: non-integer number leaf");
+    out.push(String(value));
+  } else if (typeof value === "string") {
+    out.push(JSON.stringify(value)); // minimal escaping, matches the Python serializer
+  } else if (Array.isArray(value)) {
+    out.push("[");
+    value.forEach((item, i) => {
+      if (i) out.push(",");
+      jcsWrite(item, out);
+    });
+    out.push("]");
+  } else if (typeof value === "object") {
+    out.push("{");
+    const keys = Object.keys(value).sort(codePointCompare);
+    keys.forEach((key, i) => {
+      if (i) out.push(",");
+      out.push(JSON.stringify(key));
+      out.push(":");
+      jcsWrite(value[key], out);
+    });
+    out.push("}");
+  } else {
+    throw new TypeError(`JCS cannot serialize value of type ${typeof value}`);
+  }
+}
+
+export { coerceDecimal };

package/node/cli.js

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+// The JavaScript CLI for Tamper Signal. Mirrors the Python `receipts` CLI
+// (which owns the short name); this binary installs as `tamper-signal`.
+//
+//   tamper-signal keygen --out keys/
+//   tamper-signal ingest export.csv --origin "..." --key keys/signing.key --out receipts/
+//   tamper-signal verify receipts/chain.json [--pub keys/signing.pub] [--data current.csv] [--warn-drift]
+//
+// Exit codes are the traffic light: 0 green, 1 red, 2 yellow.
+
+import { readFileSync } from "node:fs";
+import { basename, dirname } from "node:path";
+import { parseArgs } from "node:util";
+import process from "node:process";
+
+import { evidenceHash, semanticHash } from "./canonical.js";
+import { generateKeys, loadPrivateKey, loadPublicKeyHex, publicHexFromPrivate } from "./keys.js";
+import { loadRecords } from "./load.js";
+import {
+  SOURCE_RECEIPT_NAME,
+  buildSourceManifest,
+  readChain,
+  readReceipt,
+  verifyChain,
+  writeChain,
+  writeReceipt,
+} from "./receipts.js";
+import { controlTotals } from "./totals.js";
+
+const USAGE = `usage: tamper-signal <command>
+
+commands:
+  keygen --out keys/                         generate an Ed25519 signing keypair
+  ingest <file> --origin "..." [--key keys/signing.key] [--out receipts/]
+                                             create a signed source manifest
+                                             (.csv, .tsv, .json, .ndjson)
+  verify <chain.json> [--pub key.pub] [--data <file>] [--warn-drift]
+                                             verify a chain (exit 0 green, 1 red, 2 yellow)
+`;
+
+function cmdKeygen(args) {
+  const { values } = parseArgs({ args, options: { out: { type: "string", default: "keys/" } } });
+  const { privatePath, publicPath } = generateKeys(values.out);
+  console.log(`Public key written to ${publicPath}`);
+  console.error(`Private key written to ${privatePath}. Do not commit it.`);
+  return 0;
+}
+
+function cmdIngest(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      origin: { type: "string", default: "" },
+      key: { type: "string", default: "keys/signing.key" },
+      out: { type: "string", default: "receipts/" },
+    },
+  });
+  const file = positionals[0];
+  if (!file) {
+    console.error("ingest: missing source file");
+    return 1;
+  }
+  const raw = readFileSync(file);
+  const records = loadRecords(file);
+  const privateKey = loadPrivateKey(values.key);
+  const manifest = buildSourceManifest({
+    filename: basename(file),
+    evidenceHash: evidenceHash(raw),
+    byteSize: raw.length,
+    declaredOrigin: values.origin,
+    semanticHash: semanticHash(records),
+    records,
+    privateKey,
+  });
+  writeReceipt(values.out, SOURCE_RECEIPT_NAME, manifest);
+  writeChain(values.out, [SOURCE_RECEIPT_NAME], publicHexFromPrivate(privateKey));
+  const totals = manifest.control_totals;
+  console.log(`Ingested ${basename(file)}`);
+  console.log(`  evidence_hash ${manifest.source.evidence_hash}`);
+  console.log(`  semantic_hash ${manifest.semantic_hash}`);
+  console.log(`  rows ${totals.row_count}, columns ${totals.column_count}`);
+  console.log(`  source manifest -> ${values.out.replace(/\/?$/, "/")}${SOURCE_RECEIPT_NAME}`);
+  return 0;
+}
+
+function cmdVerify(args) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      pub: { type: "string" },
+      data: { type: "string" },
+      "warn-drift": { type: "boolean", default: false },
+    },
+  });
+  const chainPath = positionals[0];
+  if (!chainPath) {
+    console.error("verify: missing path to chain.json");
+    return 1;
+  }
+  const chain = readChain(chainPath);
+  const chainDir = dirname(chainPath);
+  let receipts;
+  try {
+    receipts = (chain.receipts ?? []).map((name) => readReceipt(chainDir, name));
+  } catch (err) {
+    console.error(`Cannot load chain: ${err.message}`);
+    return 1;
+  }
+
+  const chainKey = chain.public_key;
+  const publicHex = values.pub ? loadPublicKeyHex(values.pub) : chainKey;
+  if (!publicHex) {
+    console.error("No public key: pass --pub or embed one in chain.json");
+    return 1;
+  }
+
+  let dataHash = null;
+  let dataTotals = null;
+  if (values.data) {
+    const records = loadRecords(values.data);
+    dataHash = semanticHash(records);
+    dataTotals = controlTotals(records);
+  }
+
+  const result = verifyChain(receipts, publicHex, dataHash, dataTotals, {
+    chainPublicHex: chainKey,
+    receiptNames: chain.receipts ?? [],
+    warnDrift: values["warn-drift"],
+  });
+  for (const line of result.lines) console.log(line);
+  return { green: 0, red: 1, yellow: 2 }[result.verdict];
+}
+
+const [, , command, ...rest] = process.argv;
+const commands = { keygen: cmdKeygen, ingest: cmdIngest, verify: cmdVerify };
+if (!command || !(command in commands)) {
+  console.error(USAGE);
+  process.exit(command ? 1 : 0);
+}
+process.exit(commands[command](rest));

package/node/index.js

@@ -0,0 +1,48 @@
+// Tamper Signal for JavaScript pipelines: signed receipts at every stage,
+// with verifiable continuity. Chains written here verify with the Python CLI
+// and the in-browser signal, and vice versa; the canonicalization is
+// byte-identical (see test/vectors.json).
+//
+// This proves continuity, not correctness. It can't tell you the data is
+// right, but it can prove nobody changed it.
+
+export {
+  canonicalize,
+  canonicalJsonBytes,
+  evidenceHash,
+  normalizeHeader,
+  normalizeHeaders,
+  semanticHash,
+} from "./canonical.js";
+export {
+  generateKeys,
+  keyFingerprint,
+  loadPrivateKey,
+  loadPublicKeyHex,
+  publicHexFromPrivate,
+  sign,
+  verify,
+} from "./keys.js";
+export { loadCsv, loadJsonRecords, loadNdjson, loadRecords, parseCsv } from "./load.js";
+export {
+  CHAIN_FILENAME,
+  SOURCE_RECEIPT_NAME,
+  SPEC_VERSION,
+  buildSourceManifest,
+  buildTransformReceipt,
+  codeHashOf,
+  inputHashOf,
+  loadReceipts,
+  outputHashOf,
+  readChain,
+  readChainFiles,
+  readReceipt,
+  stageNameOf,
+  totalsOf,
+  verifyChain,
+  verifySignature,
+  writeChain,
+  writeReceipt,
+} from "./receipts.js";
+export { controlTotals, totalsDelta } from "./totals.js";
+export { ChainTailMismatch, receiptStep } from "./wrapper.js";

package/node/keys.js

@@ -0,0 +1,74 @@
+// Ed25519 keys: the Node port of tamper_signal/keys.py. Same on-disk formats
+// (PKCS8 PEM private key, raw 32-byte hex public key) so the two CLIs are
+// interchangeable on one project.
+
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export const PRIVATE_KEY_NAME = "signing.key";
+export const PUBLIC_KEY_NAME = "signing.pub";
+
+// SPKI DER for Ed25519 is a fixed 12-byte header followed by the raw key.
+const SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+export function keyFingerprint(publicKeyBytes) {
+  return createHash("sha256").update(publicKeyBytes).digest("hex").slice(0, 16);
+}
+
+function rawFromPublicKey(publicKey) {
+  const der = publicKey.export({ type: "spki", format: "der" });
+  return der.subarray(der.length - 32);
+}
+
+export function publicKeyFromHex(publicHex) {
+  const raw = Buffer.from(publicHex, "hex");
+  if (raw.length !== 32) throw new Error("Ed25519 public key must be 32 bytes");
+  return createPublicKey({
+    key: Buffer.concat([SPKI_PREFIX, raw]),
+    format: "der",
+    type: "spki",
+  });
+}
+
+export function generateKeys(outDir) {
+  mkdirSync(outDir, { recursive: true });
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const privatePath = join(outDir, PRIVATE_KEY_NAME);
+  const publicPath = join(outDir, PUBLIC_KEY_NAME);
+  writeFileSync(privatePath, privateKey.export({ type: "pkcs8", format: "pem" }));
+  try {
+    chmodSync(privatePath, 0o600);
+  } catch {
+    // best effort, matching the Python side
+  }
+  writeFileSync(publicPath, rawFromPublicKey(publicKey).toString("hex") + "\n");
+  return { privatePath, publicPath };
+}
+
+export function loadPrivateKey(path) {
+  return createPrivateKey(readFileSync(path));
+}
+
+export function loadPublicKeyHex(path) {
+  return readFileSync(path, "utf-8").trim();
+}
+
+export function publicHexFromPrivate(privateKey) {
+  return rawFromPublicKey(createPublicKey(privateKey)).toString("hex");
+}
+
+export function sign(privateKey, message) {
+  return cryptoSign(null, message, privateKey).toString("hex");
+}
+
+// Returns false (never throws) for bad signatures OR malformed inputs:
+// receipt JSON is attacker-controlled in the tamper-evident model.
+export function verify(publicHex, message, signatureHex) {
+  try {
+    if (typeof signatureHex !== "string" || !/^[0-9a-fA-F]+$/.test(signatureHex)) return false;
+    return cryptoVerify(null, message, publicKeyFromHex(publicHex), Buffer.from(signatureHex, "hex"));
+  } catch {
+    return false;
+  }
+}

package/node/load.js

@@ -0,0 +1,125 @@
+// Data file loading for the Node side: CSV, TSV, JSON (array of objects),
+// and NDJSON. No xlsx in JavaScript; point the Python CLI at spreadsheets.
+// Empty CSV cells load as null so the same data hashes identically to its
+// xlsx form, mirroring tamper_signal/canonical.py's loaders.
+
+import { readFileSync } from "node:fs";
+import { extname } from "node:path";
+
+import { normalizeHeaders } from "./canonical.js";
+
+function stripBom(text) {
+  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+
+// Minimal RFC 4180 CSV parser: quoted fields, escaped quotes, embedded
+// newlines and delimiters. Returns an array of string-array rows.
+export function parseCsv(text, delimiter = ",") {
+  const rows = [];
+  let row = [];
+  let field = "";
+  let inQuotes = false;
+  let i = 0;
+  const push = () => {
+    row.push(field);
+    field = "";
+  };
+  const endRow = () => {
+    push();
+    rows.push(row);
+    row = [];
+  };
+  while (i < text.length) {
+    const ch = text[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (text[i + 1] === '"') {
+          field += '"';
+          i += 2;
+          continue;
+        }
+        inQuotes = false;
+        i += 1;
+        continue;
+      }
+      field += ch;
+      i += 1;
+      continue;
+    }
+    if (ch === '"' && field === "") {
+      inQuotes = true;
+      i += 1;
+    } else if (ch === delimiter) {
+      push();
+      i += 1;
+    } else if (ch === "\r") {
+      i += text[i + 1] === "\n" ? 2 : 1;
+      endRow();
+    } else if (ch === "\n") {
+      i += 1;
+      endRow();
+    } else {
+      field += ch;
+      i += 1;
+    }
+  }
+  if (field !== "" || row.length) endRow();
+  return rows;
+}
+
+export function loadCsv(path, { delimiter = "," } = {}) {
+  const rows = parseCsv(stripBom(readFileSync(path, "utf-8")), delimiter);
+  if (!rows.length) return [];
+  const headers = normalizeHeaders(rows[0]);
+  const records = [];
+  for (const raw of rows.slice(1)) {
+    if (!raw.length || raw.every((cell) => cell === "")) continue;
+    const record = {};
+    headers.forEach((header, i) => {
+      const cell = raw[i] ?? "";
+      record[header] = cell === "" ? null : cell;
+    });
+    records.push(record);
+  }
+  return records;
+}
+
+export function loadJsonRecords(path) {
+  const data = JSON.parse(stripBom(readFileSync(path, "utf-8")));
+  if (!Array.isArray(data) || !data.every((item) => item !== null && typeof item === "object" && !Array.isArray(item))) {
+    throw new Error(`${path}: expected a JSON array of objects (for line-delimited JSON use .ndjson/.jsonl)`);
+  }
+  return data;
+}
+
+export function loadNdjson(path) {
+  const records = [];
+  stripBom(readFileSync(path, "utf-8"))
+    .split("\n")
+    .forEach((line, index) => {
+      const text = line.trim();
+      if (!text) return;
+      const item = JSON.parse(text);
+      if (item === null || typeof item !== "object" || Array.isArray(item)) {
+        throw new Error(`${path}:${index + 1}: expected a JSON object per line`);
+      }
+      records.push(item);
+    });
+  return records;
+}
+
+export function loadRecords(path) {
+  const ext = extname(path).toLowerCase();
+  if (ext === ".csv") return loadCsv(path);
+  if (ext === ".tsv") return loadCsv(path, { delimiter: "\t" });
+  if (ext === ".json") return loadJsonRecords(path);
+  if (ext === ".ndjson" || ext === ".jsonl") return loadNdjson(path);
+  if (ext === ".xlsx" || ext === ".xlsm") {
+    throw new Error(
+      `${path}: xlsx is not supported by the JavaScript package; ingest spreadsheets ` +
+        "with the Python CLI (pip install tamper-signal), or export to CSV first. " +
+        "The semantic hash is identical across formats."
+    );
+  }
+  throw new Error(`Unsupported data file ${path}: expected .csv, .tsv, .json, .ndjson, or .jsonl`);
+}