api/package.php

<?php
require_once __DIR__ . '/config.php';
ensure_dirs();

$id = $_POST['id'] ?? $_GET['id'] ?? null;
if (!$id || !preg_match('/^[a-f0-9]{16}$/', $id)) {
    fail_json('Invalid id');
}

$appDir = GENERATED_DIR . "/$id";
if (!is_dir($appDir)) {
    fail_json('Generated app not found. Run generate first.', 404);
}

$zipPath = DMG_DIR . "/$id.videoapp.zip";
if (file_exists($zipPath)) unlink($zipPath);

$cmd = 'cd ' . shell_arg(GENERATED_DIR) . ' && zip -r ' . shell_arg($zipPath) . ' ' . shell_arg($id) . ' 2>&1';
$output = [];
$code = 0;
exec($cmd, $output, $code);

if ($code !== 0 || !file_exists($zipPath)) {
    fail_json('Packaging failed', 500, [
        'log' => implode("\n", $output)
    ]);
}

json_response([
    'ok' => true,
    'id' => $id,
    'package_url' => "/api/download.php?id=$id",
    'package_path' => $zipPath,
    'note' => 'HF Linux cannot build a signed macOS DMG. This packages the generated app folder. Final DMG signing must happen on macOS.'
]);