api/download.php

<?php
require_once __DIR__ . '/config.php';

$id = $_GET['id'] ?? null;
if (!$id || !preg_match('/^[a-f0-9]{16}$/', $id)) {
    fail_json('Invalid id');
}

$zipPath = DMG_DIR . "/$id.videoapp.zip";
if (!file_exists($zipPath)) {
    fail_json('Package not found', 404);
}

header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . $id . '.videoapp.zip"');
header('Content-Length: ' . filesize($zipPath));
readfile($zipPath);
exit;