feat(google-gmail): add TRIGGER binding for email received events

[guitavano]

Summary

• Add gmail.message.received trigger using createTriggers from @decocms/runtime/triggers (same pattern as GitHub and Slack MCPs)
• Add webhook handler at POST /webhooks/gmail for Google Pub/Sub push notifications
• Wire onChange to fetch user profile, map email → connectionId, and call users.watch() for push notification registration
• Bump @decocms/runtime to 1.5.0, add @decocms/bindings ^1.4.0

How it works

User connects Gmail → onChange → fetch profile → map email → users.watch()
                                                                  ↓
New email arrives → Gmail → Pub/Sub topic → push subscription → POST /webhooks/gmail
                                                                  ↓
                                              decode → lookup connectionId → triggers.notify()

Infra requirements

• A Google Cloud Pub/Sub topic with gmail-api-push@system.gserviceaccount.com as Publisher
• A push subscription pointing to https://<server>/webhooks/gmail
• GMAIL_PUBSUB_TOPIC env var (e.g. projects/my-project/topics/gmail-push)

Test plan

• bun run check passes (type-check)
• Deploy and connect a Gmail account via OAuth
• Verify onChange logs email mapping and watch registration
• Send an email to the connected account and verify triggers.notify() fires
• Enable trigger via Mesh UI and verify end-to-end automation

🤖 Generated with Claude Code

---

Summary by cubic

Adds a gmail.message.received trigger and a Pub/Sub webhook so automations fire when new Gmail messages arrive. Registers Gmail push notifications on connect and routes events to the correct connection.

• New Features

  • Add gmail.message.received via createTriggers from @decocms/runtime/triggers; expose TRIGGER_LIST/TRIGGER_CONFIGURE with triggers.tools().
  • Add POST /webhooks/gmail to ingest Google Pub/Sub push and call triggers.notify().
  • On OAuth change, fetch users.profile, map email → connectionId, and call users.watch() (INBOX).
  • Add in-memory email→connection map; use StudioKV when MESH_URL/MESH_API_KEY are set.
  • Extend Gmail endpoints for WATCH, STOP, HISTORY, and PROFILE.
  • Bump @decocms/runtime to 1.5.0; add @decocms/bindings ^1.4.0.

• Migration

  • Create a Pub/Sub topic with gmail-api-push@system.gserviceaccount.com as Publisher.
  • Add a push subscription to https://<server>/webhooks/gmail.
  • Set GMAIL_PUBSUB_TOPIC to the topic path (e.g. projects/<project>/topics/<topic>).

^{Written for commit 00bf3a5. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 8 files

_{You’re at about 93% of the monthly review limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="google-gmail/server/lib/email-connection-map.ts">

<violation number="1" location="google-gmail/server/lib/email-connection-map.ts:7">
P1: Using an in-memory map for `email -> connectionId` breaks trigger delivery after restarts or in multi-instance deployments; store this mapping in shared persistent storage instead of process memory.</violation>
</file>

<file name="google-gmail/server/webhook.ts">

<violation number="1" location="google-gmail/server/webhook.ts:25">
P1: Webhook endpoint lacks authentication/verification, allowing forged notification events.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Using an in-memory map for email -> connectionId breaks trigger delivery after restarts or in multi-instance deployments; store this mapping in shared persistent storage instead of process memory.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At google-gmail/server/lib/email-connection-map.ts, line 7:

<comment>Using an in-memory map for `email -> connectionId` breaks trigger delivery after restarts or in multi-instance deployments; store this mapping in shared persistent storage instead of process memory.</comment>

<file context>
@@ -0,0 +1,23 @@
+ * Populated during onChange when we fetch the user's Gmail profile.
+ */
+
+const emailMap = new Map<string, string>();
+
+export function setEmailMapping(email: string, connectionId: string): void {
</file context>

[cubic-dev-ai]

P1: Webhook endpoint lacks authentication/verification, allowing forged notification events.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At google-gmail/server/webhook.ts, line 25:

<comment>Webhook endpoint lacks authentication/verification, allowing forged notification events.</comment>

<file context>
@@ -0,0 +1,72 @@
+  historyId: string;
+}
+
+export async function handleGmailWebhook(req: Request): Promise<Response> {
+  let body: PubSubPushMessage;
+  try {
</file context>