fix(rest): register static data-action routes before greedy :object/:id

The REST router (RouteManager → IHttpServer/Express adapter) matches
first-registered-wins with no specificity sorting. registerDataActionEndpoints
(which holds GET /data/:object/export) ran AFTER registerCrudEndpoints (which
holds the greedy GET /data/:object/:id), so a request to
`GET /data/<object>/export` was captured by `:object/:id` — "export" treated as
a record id — returning 404 RECORD_NOT_FOUND instead of streaming the export.

Reorder so the static-literal action routes register before the greedy
:object/:id matcher, mirroring the existing /meta/:type/:name/references-before
-/meta/:type/:name convention. The reorder is safe in both directions:
registerDataActionEndpoints has no greedy 2-segment :object/:id routes, and the
only per-method collision in the data namespace is GET export vs GET :id.

Add a regression test asserting the export route's registration index precedes
the get-by-id route's.

Author: baozhoutao

packages/rest/src/rest-server.ts

@@ -1552,10 +1552,22 @@ export class RestServer {
             this.registerReportsEndpoints(bp);
             this.registerApprovalsEndpoints(bp);
             this.registerAnalyticsEndpoints(bp);
+            // Data-action routes (e.g. GET /data/:object/export, POST
+            // /data/:object/import) use static-literal action segments that
+            // MUST be registered BEFORE the greedy GET /data/:object/:id
+            // matcher in registerCrudEndpoints — the router is first-match-wins
+            // with no specificity sorting (see route-manager.ts), so otherwise
+            // a request to `.../export` is captured by `:id` and "export" is
+            // treated as a record id (404 RECORD_NOT_FOUND). This mirrors the
+            // /meta/:type/:name/references-before-/meta/:type/:name convention.
+            // Safe in the other direction too: registerDataActionEndpoints has
+            // no greedy 2-segment `:object/:id` routes (only literal actions and
+            // deeper `:id/clone`, `:id/shares` paths), so it cannot shadow any
+            // CRUD literal.
+            this.registerDataActionEndpoints(bp);
             if (this.config.api.enableCrud) {
                 this.registerCrudEndpoints(bp);
             }
-            this.registerDataActionEndpoints(bp);
             if (this.config.api.enableBatch) {
                 this.registerBatchEndpoints(bp);
             }

packages/rest/src/rest.test.ts

@@ -904,6 +904,29 @@ describe('RestServer', () => {
       // 1 header + 50 000 rows.
       expect(lines.length).toBe(50_001);
     });
+
+    // Regression: the router is first-match-wins with no specificity sorting,
+    // so the static-literal `GET /data/:object/export` route MUST be registered
+    // BEFORE the greedy `GET /data/:object/:id` matcher. Otherwise a request to
+    // `/data/<object>/export` is captured by `:id` ("export" treated as a record
+    // id) and 404s with RECORD_NOT_FOUND instead of streaming the export.
+    it('registers GET /export ahead of the greedy GET /:object/:id matcher', () => {
+      const rest = new RestServer(server as any, protocol as any);
+      rest.registerRoutes();
+      const routes = rest.getRoutes();
+
+      const exportIdx = routes.findIndex(
+        (r: any) => r.method === 'GET' && r.path === '/api/v1/data/:object/export',
+      );
+      const getByIdIdx = routes.findIndex(
+        (r: any) => r.method === 'GET' && r.path === '/api/v1/data/:object/:id',
+      );
+
+      expect(exportIdx).toBeGreaterThanOrEqual(0);
+      expect(getByIdIdx).toBeGreaterThanOrEqual(0);
+      // First match wins → the more-specific export route must come first.
+      expect(exportIdx).toBeLessThan(getByIdIdx);
+    });
   });
 
   // -----------------------------------------------------------------------