Ola, I didn't try it - just a few remarks:
I think it is necessary to add ad_script_abort after ns_returnnotfound, otherwise the code after it will be executed.
When you change it so that the folder_id instead of the package_id is passed than the pl/sql could be made part of the CR and thus available to other packages as well, instead of constraining it to file-storage.
And I think this functionality deserves it's own file and URL, e.g. beneath view/, instead of mixing it with download. It's no big deal linking to another URL for the different two cases, since one has to do different parameter exports anyway depending on wether the version_id is available or the path.
