Origin check

// Needs a PNG decoder; everything else is the standard library.
import { createHash } from "node:crypto";
import { PNG } from "pngjs";
 
function canonicalJson(value) {
  if (value === null || value === undefined) return "null";
  if (typeof value === "number") {
    if (!Number.isFinite(value)) return "null";
    const r = Math.round(value * 1e6) / 1e6;
    return Object.is(r, -0) ? "0" : String(r);
  }
  if (typeof value === "boolean") return value ? "true" : "false";
  if (typeof value === "string") return JSON.stringify(value);
  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
  const entries = Object.entries(value)
    .filter(([, v]) => v !== undefined)
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
  return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
}
 
export function fingerprint(fileName, bytes) {
  const name = fileName.toLowerCase();
  const sha = createHash("sha256");
 
  if (name.endsWith(".png")) {
    const png = PNG.sync.read(bytes); // png.data is RGBA8, row-major
    const pixels = Buffer.from(png.data);
    for (let i = 0; i < pixels.length; i += 4) {
      if (pixels[i + 3] === 0) pixels.fill(0, i, i + 4);
    }
    sha.update("rpai/v1/png\n");
    sha.update(`${png.width}x${png.height}\n`);
    sha.update(pixels);
  } else if (name.endsWith(".json")) {
    sha.update("rpai/v1/json\n");
    sha.update(canonicalJson(JSON.parse(bytes.toString("utf8"))), "utf8");
  } else {
    sha.update("rpai/v1/bytes\n");
    sha.update(bytes);
  }
 
  return sha.digest("hex");
}

// Needs Gson. ImageIO and the rest are the JDK.
import com.google.gson.*;
import java.awt.image.BufferedImage;
import java.io.ByteArrayInputStream;
import java.math.BigDecimal;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.*;
import javax.imageio.ImageIO;
 
public final class Fingerprint {
  // disableHtmlEscaping is not optional: Gson escapes <, > and & by default,
  // and those escapes change the bytes being hashed.
  private static final Gson GSON = new GsonBuilder().disableHtmlEscaping().create();
 
  public static String of(String fileName, byte[] bytes) throws Exception {
    String name = fileName.toLowerCase(Locale.ROOT);
    MessageDigest sha = MessageDigest.getInstance("SHA-256");
 
    if (name.endsWith(".png")) {
      BufferedImage image = ImageIO.read(new ByteArrayInputStream(bytes));
      int w = image.getWidth(), h = image.getHeight();
      byte[] pixels = new byte[w * h * 4];
      int i = 0;
      for (int y = 0; y < h; y++) {
        for (int x = 0; x < w; x++) {
          int argb = image.getRGB(x, y); // non-premultiplied ARGB
          int a = (argb >>> 24) & 0xff;
          if (a == 0) { i += 4; continue; } // fully transparent, four zero bytes
          pixels[i++] = (byte) ((argb >> 16) & 0xff);
          pixels[i++] = (byte) ((argb >> 8) & 0xff);
          pixels[i++] = (byte) (argb & 0xff);
          pixels[i++] = (byte) a;
        }
      }
      sha.update("rpai/v1/png\n".getBytes(StandardCharsets.UTF_8));
      sha.update((w + "x" + h + "\n").getBytes(StandardCharsets.UTF_8));
      sha.update(pixels);
    } else if (name.endsWith(".json")) {
      JsonElement parsed = JsonParser.parseString(new String(bytes, StandardCharsets.UTF_8));
      sha.update("rpai/v1/json\n".getBytes(StandardCharsets.UTF_8));
      sha.update(canonical(parsed).getBytes(StandardCharsets.UTF_8));
    } else {
      sha.update("rpai/v1/bytes\n".getBytes(StandardCharsets.UTF_8));
      sha.update(bytes);
    }
 
    return HexFormat.of().formatHex(sha.digest());
  }
 
  private static String canonical(JsonElement value) {
    if (value == null || value.isJsonNull()) return "null";
 
    if (value.isJsonPrimitive()) {
      JsonPrimitive p = value.getAsJsonPrimitive();
      if (p.isBoolean()) return p.getAsBoolean() ? "true" : "false";
      if (p.isNumber()) {
        double d = p.getAsDouble();
        if (!Double.isFinite(d)) return "null";
        double r = Math.floor(d * 1e6 + 0.5) / 1e6; // six decimal places, ties up
        if (r == 0) return "0"; // never "-0"
        return BigDecimal.valueOf(r).stripTrailingZeros().toPlainString();
      }
      return GSON.toJson(p.getAsString());
    }
 
    if (value.isJsonArray()) {
      StringJoiner out = new StringJoiner(",", "[", "]");
      for (JsonElement item : value.getAsJsonArray()) out.add(canonical(item));
      return out.toString();
    }
 
    List<String> keys = new ArrayList<>(value.getAsJsonObject().keySet());
    Collections.sort(keys); // code-unit order
    StringJoiner out = new StringJoiner(",", "{", "}");
    for (String key : keys) {
      out.add(GSON.toJson(key) + ":" + canonical(value.getAsJsonObject().get(key)));
    }
    return out.toString();
  }
}

# Needs Pillow; everything else is the standard library.
import hashlib
import io
import json
import math
 
from PIL import Image
 
 
def canonical_json(value):
    if value is None:
        return "null"
    if isinstance(value, bool):  # before int: bool is an int in Python
        return "true" if value else "false"
    if isinstance(value, (int, float)):
        if isinstance(value, float) and not math.isfinite(value):
            return "null"
        r = math.floor(value * 1e6 + 0.5) / 1e6  # six decimal places, ties up
        return str(int(r)) if r == int(r) else repr(r)
    if isinstance(value, str):
        return json.dumps(value, ensure_ascii=False)
    if isinstance(value, list):
        return "[" + ",".join(canonical_json(v) for v in value) + "]"
    return (
        "{"
        + ",".join(
            f"{json.dumps(k, ensure_ascii=False)}:{canonical_json(v)}"
            for k, v in sorted(value.items())
        )
        + "}"
    )
 
 
def fingerprint(file_name, data):
    name = file_name.lower()
 
    if name.endswith(".png"):
        image = Image.open(io.BytesIO(data)).convert("RGBA")
        pixels = bytearray(image.tobytes())
        for i in range(3, len(pixels), 4):
            if pixels[i] == 0:  # fully transparent, four zero bytes
                pixels[i - 3 : i + 1] = b"\x00\x00\x00\x00"
        body = f"{image.width}x{image.height}\n".encode() + bytes(pixels)
        return hashlib.sha256(b"rpai/v1/png\n" + body).hexdigest()
 
    if name.endswith(".json"):
        body = canonical_json(json.loads(data.decode("utf-8"))).encode()
        return hashlib.sha256(b"rpai/v1/json\n" + body).hexdigest()
 
    return hashlib.sha256(b"rpai/v1/bytes\n" + data).hexdigest()