Hongguo signing adapter for Yingxia (2026-10-12)

app-source.js and sm3.js are adapted from jackotom/hongguo-drama,
commit 2d2314213c2457c63f84055518d38a27210c7ad1, src/native/.
https://github.com/jackotom/hongguo-drama
License: GPL-3.0; full text retained in LICENSE.

Changes: ES modules; a local QuickJS binary/crypto adapter; native cryptographic
randomness and hashes; synchronous bounded HTTP without Node or Electron;
exports for protocol regression tests. Ephemeral device IDs remain ephemeral.
No fixed user cookies, captured device identities or signing services are used.

Updated 2026-10-25 from the same repository at commit
195f276baf497e6ba969adece90b25e84198d3ac (v3.3): a new synthetic identity per
signed request, backup media links, and the status of the second API answer.

Updated 2026-10-27 from the same repository at commit
a547a97dea3cba9d78b77125023f9aff20509a61 (v4.1): playback-device.js registers
one anonymous device per session (no account, cookie or captured identity) and
asks for playback with it; the first answer's inline video list. Its ttEncrypt
and registration fields come from tsukiyo-zero/hongguoTV commit
388931852ddc614db8b00775a3dc54c5ede6307f,
kotlin-tv/core/src/main/kotlin/com/hongguotv/core/DeviceRegister.kt, adapted
from charlie901208/HGTV (feat/phone-login). License: GPL-3.0-only.

Xifan.js and Hema.js (in sites/, beside Hongguo.js) follow the endpoints, page data
and response fields of src/native/xifan.js and src/native/hema.js in the same
repository at commit f210689c4adbf0986e3412cdb12a1c710c5dd611 (v4.1), rewritten for
the TVBox spider interface on QuickJS. Upstream credits Hululu007/drpy-node
(295f2b7047e14122d542a7736cb931e81abcf85c) as its reference for Xifan's API paths
and response structure. Both list only the episodes their services give away.

Upstream attribution follows:

App playback source and signature attribution

The necessary signature, Spade URL and content-key routines in app-source.js
are adapted from N3urda/hongguoTV server/vendor/hongguo.cjs, commit
 eea73e6a45569a2cbbb9440f7cd5290c459b0b70.
https://github.com/N3urda/hongguoTV

That file is an unmodified copy (renamed) of spider/js/红果果[短].js from
woshishiq1/drpys, commit 22261adfa31435e3b3ef5a730b8a2a75bcaf1715.
https://github.com/woshishiq1/drpys
Upstream license: GPL-3.0; complete text: LICENSE.drpys.txt.

Modifications made 2026-10-07: limited playback adapter, local ephemeral
visitor identifiers, removal of fixed visitor fingerprints, strict response
and destination validation, supported-codec selection and no secret logging.
SM3 is implemented locally for Electron runtimes without native SM3 support.
The existing application remains GPL-3.0.
