fix(api): cap import names inside the bound and align the three import paths

- `truncate` appends its suffix after slicing, so capping at the contract
  limit produced 203/2003-character values — past the very bound the cap
  exists to enforce, and into the headroom reserved for dedup suffixes.
  Reserve the ellipsis inside the limit.
- Match `extractWorkflowName`'s candidate order (state.metadata.name before
  workflow.name) and trim, so the v1 API and the in-app importer resolve the
  same name for the same payload. Previously a hand-authored payload carrying
  both could yield two different names.
- Run the admin importer through prepareWorkflowStateForPersistence too. It
  was writing raw parsed state, so a dangling edge tripped the workflow_edges
  foreign key and a block missing its backfilled columns could land
  unopenable — the same class this PR just closed on the v1 path.

Author: waleedlatif1

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -24,6 +24,7 @@ import { adminV1ImportWorkflowContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
+import { prepareWorkflowStateForPersistence } from '@/lib/workflows/persistence/prepare-state'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
 import { normalizeImportedVariables } from '@/lib/workflows/variables/parse'
@@ -106,7 +107,21 @@ export const POST = withRouteHandler(
         variables: {},
       })
 
-      const saveResult = await saveWorkflowToNormalizedTables(workflowId, workflowData)
+      /**
+       * Same normalization the editor and the v1 import API run, via the one
+       * shared implementation — without it this route wrote raw parsed state,
+       * so a dangling edge tripped the `workflow_edges` foreign key and a block
+       * missing its backfilled columns could land unopenable.
+       */
+      const { state: preparedState, warnings } = prepareWorkflowStateForPersistence(workflowData)
+      if (warnings.length > 0) {
+        logger.warn('Admin API: normalized imported workflow with warnings', { warnings })
+      }
+
+      const saveResult = await saveWorkflowToNormalizedTables(workflowId, {
+        ...workflowData,
+        ...preparedState,
+      })
 
       if (!saveResult.success) {
         await db.delete(workflow).where(eq(workflow.id, workflowId))

apps/sim/app/api/v1/workflows/import/route.test.ts

@@ -406,6 +406,37 @@ describe('POST /api/v1/workflows/import', () => {
     expect(whereSpy).toHaveBeenCalled()
   })
 
+  it('caps a payload-derived name at the declared bound, ellipsis included', async () => {
+    await POST(
+      makeRequest(
+        validBody({
+          workflow: { ...EXPORT_ENVELOPE, workflow: { name: 'N'.repeat(500) } },
+        })
+      )
+    )
+
+    const { name } = mockPerformCreateWorkflow.mock.calls[0][0]
+    expect(name.length).toBeLessThanOrEqual(200)
+    expect(name.endsWith('...')).toBe(true)
+  })
+
+  it('prefers state.metadata.name, matching the in-app importer', async () => {
+    await POST(
+      makeRequest(
+        validBody({
+          workflow: {
+            workflow: { name: 'FromWorkflow' },
+            state: { ...EXPORT_ENVELOPE.state, metadata: { name: 'FromStateMetadata' } },
+          },
+        })
+      )
+    )
+
+    expect(mockPerformCreateWorkflow).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'FromStateMetadata' })
+    )
+  })
+
   it('unwraps an export response envelope so its metadata still resolves', async () => {
     await POST(makeRequest(validBody({ workflow: { data: EXPORT_ENVELOPE, limits: {} } })))
 

apps/sim/app/api/v1/workflows/import/route.ts

@@ -49,6 +49,18 @@ const MAX_IMPORT_BODY_BYTES = 10 * 1024 * 1024
 
 const DEFAULT_IMPORTED_WORKFLOW_NAME = 'Imported Workflow'
 
+const TRUNCATION_SUFFIX = '...'
+
+/**
+ * Caps a payload-derived string at `maxLength` *including* the ellipsis.
+ * `truncate` appends its suffix after slicing, so passing the limit straight
+ * through would yield `maxLength + 3` characters and overshoot the very bound
+ * this is enforcing.
+ */
+function capLength(value: string, maxLength: number): string {
+  return truncate(value, maxLength - TRUNCATION_SUFFIX.length, TRUNCATION_SUFFIX)
+}
+
 /**
  * Reads a dot-delimited path off a parsed payload and returns it only when it
  * is a non-empty string, so blank metadata falls through to the next candidate.
@@ -59,7 +71,7 @@ function readString(source: unknown, path: string): string | undefined {
     if (!current || typeof current !== 'object') return undefined
     current = (current as Record<string, unknown>)[segment]
   }
-  return typeof current === 'string' && current.trim() ? current : undefined
+  return typeof current === 'string' && current.trim() ? current.trim() : undefined
 }
 
 /**
@@ -83,10 +95,15 @@ function unwrapResponseEnvelope(payload: unknown): unknown {
  * the importer takes: the export envelope (`workflow.*`, `state.metadata.*`)
  * and a bare state (`metadata.*`).
  *
- * Payload-derived values are truncated to the same bounds the contract applies
- * to the explicit overrides — otherwise the declared `maxLength` would not be
- * the effective one, and a caller could store an unbounded name simply by
- * embedding it in the payload instead of passing it as a field.
+ * Candidate order deliberately matches `extractWorkflowName` — the resolver the
+ * in-app importer has always used — so the same payload yields the same name on
+ * both surfaces. The in-app version additionally falls back to the uploaded
+ * filename, which has no analogue here; that is the only intended difference.
+ *
+ * Payload-derived values are capped at the same bounds the contract applies to
+ * the explicit overrides, otherwise the declared `maxLength` would not be the
+ * effective one — a caller could store an unbounded name simply by embedding it
+ * in the payload instead of passing it as a field.
  */
 function resolveImportedMetadata(
   rawPayload: unknown,
@@ -97,19 +114,19 @@ function resolveImportedMetadata(
 
   const name =
     overrideName ||
-    truncate(
-      readString(payload, 'workflow.name') ||
-        readString(payload, 'state.metadata.name') ||
+    capLength(
+      readString(payload, 'state.metadata.name') ||
+        readString(payload, 'workflow.name') ||
         readString(payload, 'metadata.name') ||
         DEFAULT_IMPORTED_WORKFLOW_NAME,
       V1_IMPORT_NAME_MAX_LENGTH
     )
 
   const description =
     overrideDescription ??
-    truncate(
-      readString(payload, 'workflow.description') ??
-        readString(payload, 'state.metadata.description') ??
+    capLength(
+      readString(payload, 'state.metadata.description') ??
+        readString(payload, 'workflow.description') ??
         readString(payload, 'metadata.description') ??
         '',
       V1_IMPORT_DESCRIPTION_MAX_LENGTH