chore: import upstream snapshot with attribution

apps/sim/app/api/tools/gmail/add-label/route.ts

@@ -0,0 +1,127 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailAddLabelContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { validateAlphanumericId } from '@/lib/core/security/input-validation'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailAddLabelAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail add label attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail add label request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailAddLabelContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Adding label(s) to Gmail email`, {
+      messageId: validatedData.messageId,
+      labelIds: validatedData.labelIds,
+    })
+
+    const labelIds = validatedData.labelIds
+      .split(',')
+      .map((id) => id.trim())
+      .filter((id) => id.length > 0)
+
+    for (const labelId of labelIds) {
+      const labelIdValidation = validateAlphanumericId(labelId, 'labelId', 255)
+      if (!labelIdValidation.isValid) {
+        logger.warn(`[${requestId}] Invalid label ID: ${labelIdValidation.error}`)
+        return NextResponse.json(
+          {
+            success: false,
+            error: labelIdValidation.error,
+          },
+          { status: 400 }
+        )
+      }
+    }
+
+    const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255)
+    if (!messageIdValidation.isValid) {
+      logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`)
+      return NextResponse.json(
+        { success: false, error: messageIdValidation.error },
+        { status: 400 }
+      )
+    }
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          addLabelIds: labelIds,
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Label(s) added successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: `Successfully added ${labelIds.length} label(s) to email`,
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error adding label to Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/archive/route.ts

@@ -0,0 +1,97 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailArchiveContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailArchiveAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail archive attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail archive request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailArchiveContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Archiving Gmail email`, {
+      messageId: validatedData.messageId,
+    })
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          removeLabelIds: ['INBOX'],
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email archived successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email archived successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error archiving Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/delete/route.ts

@@ -0,0 +1,94 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailDeleteContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailDeleteAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail delete attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail delete request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailDeleteContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Deleting Gmail email`, {
+      messageId: validatedData.messageId,
+    })
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/trash`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email deleted successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email moved to trash successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error deleting Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/draft/route.ts

@@ -0,0 +1,227 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailDraftContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { processFilesToUserFiles } from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
+import { assertToolFileAccess } from '@/app/api/files/authorization'
+import {
+  base64UrlEncode,
+  buildMimeMessage,
+  buildSimpleEmailMessage,
+  fetchThreadingHeaders,
+} from '@/tools/gmail/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailDraftAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success || !authResult.userId) {
+      logger.warn(`[${requestId}] Unauthorized Gmail draft attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    const userId = authResult.userId
+    logger.info(`[${requestId}] Authenticated Gmail draft request via ${authResult.authType}`, {
+      userId,
+    })
+
+    const parsed = await parseRequest(gmailDraftContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Creating Gmail draft`, {
+      to: validatedData.to,
+      subject: validatedData.subject || '',
+      hasAttachments: !!(validatedData.attachments && validatedData.attachments.length > 0),
+      attachmentCount: validatedData.attachments?.length || 0,
+    })
+
+    const threadingHeaders = validatedData.replyToMessageId
+      ? await fetchThreadingHeaders(validatedData.replyToMessageId, validatedData.accessToken)
+      : {}
+
+    const originalMessageId = threadingHeaders.messageId
+    const originalReferences = threadingHeaders.references
+    const originalSubject = threadingHeaders.subject
+
+    let rawMessage: string | undefined
+
+    if (validatedData.attachments && validatedData.attachments.length > 0) {
+      const rawAttachments = validatedData.attachments
+      logger.info(`[${requestId}] Processing ${rawAttachments.length} attachment(s)`)
+
+      const attachments = processFilesToUserFiles(rawAttachments, requestId, logger)
+
+      if (attachments.length === 0) {
+        logger.warn(`[${requestId}] No valid attachments found after processing`)
+      } else {
+        const totalSize = attachments.reduce((sum, file) => sum + file.size, 0)
+        const maxSize = 25 * 1024 * 1024 // 25MB
+
+        if (totalSize > maxSize) {
+          const sizeMB = (totalSize / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const accessResults = await Promise.all(
+          attachments.map((file) => assertToolFileAccess(file.key, userId, requestId, logger))
+        )
+        const denied = accessResults.find((r) => r !== null)
+        if (denied) return denied
+
+        let resolved: Array<{ buffer: Buffer; contentType: string }>
+        try {
+          resolved = await Promise.all(
+            attachments.map(async (file) => {
+              logger.info(
+                `[${requestId}] Downloading attachment: ${file.name} (${file.size} bytes)`
+              )
+              return await downloadServableFileFromStorage(file, requestId, logger)
+            })
+          )
+        } catch (error) {
+          const notReady = docNotReadyResponse(error)
+          if (notReady) return notReady
+          logger.error(`[${requestId}] Failed to download an attachment:`, error)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Failed to download attachment: ${getErrorMessage(error, 'Unknown error')}`,
+            },
+            { status: 500 }
+          )
+        }
+
+        const resolvedTotal = resolved.reduce((sum, r) => sum + r.buffer.length, 0)
+        if (resolvedTotal > maxSize) {
+          const sizeMB = (resolvedTotal / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const attachmentBuffers = attachments.map((file, i) => ({
+          filename: file.name,
+          mimeType: resolved[i].contentType || file.type || 'application/octet-stream',
+          content: resolved[i].buffer,
+        }))
+
+        const mimeMessage = buildMimeMessage({
+          to: validatedData.to,
+          cc: validatedData.cc ?? undefined,
+          bcc: validatedData.bcc ?? undefined,
+          subject: validatedData.subject || originalSubject || '',
+          body: validatedData.body,
+          contentType: validatedData.contentType || 'text',
+          inReplyTo: originalMessageId,
+          references: originalReferences,
+          attachments: attachmentBuffers,
+        })
+
+        logger.info(`[${requestId}] Built MIME message for draft (${mimeMessage.length} bytes)`)
+        rawMessage = base64UrlEncode(mimeMessage)
+      }
+    }
+
+    if (!rawMessage) {
+      rawMessage = buildSimpleEmailMessage({
+        to: validatedData.to,
+        cc: validatedData.cc,
+        bcc: validatedData.bcc,
+        subject: validatedData.subject || originalSubject,
+        body: validatedData.body,
+        contentType: validatedData.contentType || 'text',
+        inReplyTo: originalMessageId,
+        references: originalReferences,
+      })
+    }
+
+    const draftMessage: { raw: string; threadId?: string } = { raw: rawMessage }
+
+    if (validatedData.threadId) {
+      draftMessage.threadId = validatedData.threadId
+    }
+
+    const gmailResponse = await fetch(`${GMAIL_API_BASE}/drafts`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${validatedData.accessToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        message: draftMessage,
+      }),
+    })
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Draft created successfully`, { draftId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email drafted successfully',
+        metadata: {
+          id: data.id,
+          message: {
+            id: data.message?.id,
+            threadId: data.message?.threadId,
+            labelIds: data.message?.labelIds,
+          },
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error creating Gmail draft:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/edit-draft/route.ts

@@ -0,0 +1,220 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailEditDraftContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { processFilesToUserFiles } from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
+import { assertToolFileAccess } from '@/app/api/files/authorization'
+import {
+  base64UrlEncode,
+  buildMimeMessage,
+  buildSimpleEmailMessage,
+  fetchThreadingHeaders,
+  GMAIL_API_BASE,
+} from '@/tools/gmail/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailEditDraftAPI')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success || !authResult.userId) {
+      logger.warn(`[${requestId}] Unauthorized Gmail edit draft attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    const userId = authResult.userId
+    logger.info(
+      `[${requestId}] Authenticated Gmail edit draft request via ${authResult.authType}`,
+      { userId }
+    )
+
+    const parsed = await parseRequest(gmailEditDraftContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Updating Gmail draft`, {
+      draftId: validatedData.draftId,
+      to: validatedData.to,
+      hasAttachments: !!(validatedData.attachments && validatedData.attachments.length > 0),
+      attachmentCount: validatedData.attachments?.length || 0,
+    })
+
+    const threadingHeaders = validatedData.replyToMessageId
+      ? await fetchThreadingHeaders(validatedData.replyToMessageId, validatedData.accessToken)
+      : {}
+
+    const originalMessageId = threadingHeaders.messageId
+    const originalReferences = threadingHeaders.references
+    const originalSubject = threadingHeaders.subject
+
+    let rawMessage: string | undefined
+
+    if (validatedData.attachments && validatedData.attachments.length > 0) {
+      const rawAttachments = validatedData.attachments
+      const attachments = processFilesToUserFiles(rawAttachments, requestId, logger)
+
+      if (attachments.length > 0) {
+        const totalSize = attachments.reduce((sum, file) => sum + file.size, 0)
+        const maxSize = 25 * 1024 * 1024
+
+        if (totalSize > maxSize) {
+          const sizeMB = (totalSize / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const accessResults = await Promise.all(
+          attachments.map((file) => assertToolFileAccess(file.key, userId, requestId, logger))
+        )
+        const denied = accessResults.find((r) => r !== null)
+        if (denied) return denied
+
+        let resolved: Array<{ buffer: Buffer; contentType: string }>
+        try {
+          resolved = await Promise.all(
+            attachments.map(async (file) => {
+              logger.info(
+                `[${requestId}] Downloading attachment: ${file.name} (${file.size} bytes)`
+              )
+              return await downloadServableFileFromStorage(file, requestId, logger)
+            })
+          )
+        } catch (error) {
+          const notReady = docNotReadyResponse(error)
+          if (notReady) return notReady
+          logger.error(`[${requestId}] Failed to download an attachment:`, error)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Failed to download attachment: ${getErrorMessage(error, 'Unknown error')}`,
+            },
+            { status: 500 }
+          )
+        }
+
+        const resolvedTotal = resolved.reduce((sum, r) => sum + r.buffer.length, 0)
+        if (resolvedTotal > maxSize) {
+          const sizeMB = (resolvedTotal / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const attachmentBuffers = attachments.map((file, i) => ({
+          filename: file.name,
+          mimeType: resolved[i].contentType || file.type || 'application/octet-stream',
+          content: resolved[i].buffer,
+        }))
+
+        const mimeMessage = buildMimeMessage({
+          to: validatedData.to,
+          cc: validatedData.cc ?? undefined,
+          bcc: validatedData.bcc ?? undefined,
+          subject: validatedData.subject || originalSubject || '',
+          body: validatedData.body,
+          contentType: validatedData.contentType || 'text',
+          inReplyTo: originalMessageId,
+          references: originalReferences,
+          attachments: attachmentBuffers,
+        })
+
+        rawMessage = base64UrlEncode(mimeMessage)
+      }
+    }
+
+    if (!rawMessage) {
+      rawMessage = buildSimpleEmailMessage({
+        to: validatedData.to,
+        cc: validatedData.cc,
+        bcc: validatedData.bcc,
+        subject: validatedData.subject || originalSubject,
+        body: validatedData.body,
+        contentType: validatedData.contentType || 'text',
+        inReplyTo: originalMessageId,
+        references: originalReferences,
+      })
+    }
+
+    const draftMessage: { raw: string; threadId?: string } = { raw: rawMessage }
+    if (validatedData.threadId) {
+      draftMessage.threadId = validatedData.threadId
+    }
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/drafts/${encodeURIComponent(validatedData.draftId)}`,
+      {
+        method: 'PUT',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          id: validatedData.draftId,
+          message: draftMessage,
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Draft updated successfully`, { draftId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        draftId: data.id ?? null,
+        messageId: data.message?.id ?? null,
+        threadId: data.message?.threadId ?? null,
+        labelIds: data.message?.labelIds ?? null,
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error updating Gmail draft:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/label/route.ts

@@ -0,0 +1,100 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailLabelSelectorContract } from '@/lib/api/contracts/selectors/google'
+import { parseRequest } from '@/lib/api/server'
+import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import { validateAlphanumericId } from '@/lib/core/security/input-validation'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getScopesForService } from '@/lib/oauth/utils'
+import { refreshAccessTokenIfNeeded, ServiceAccountTokenError } from '@/app/api/auth/oauth/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailLabelAPI')
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const parsed = await parseRequest(gmailLabelSelectorContract, request, {})
+    if (!parsed.success) return parsed.response
+    const { credentialId, labelId } = parsed.data.query
+    const impersonateEmail = parsed.data.query.impersonateEmail || undefined
+
+    const labelIdValidation = validateAlphanumericId(labelId, 'labelId', 255)
+    if (!labelIdValidation.isValid) {
+      logger.warn(`[${requestId}] Invalid label ID: ${labelIdValidation.error}`)
+      return NextResponse.json({ error: labelIdValidation.error }, { status: 400 })
+    }
+
+    const credAccess = await authorizeCredentialUse(request, {
+      credentialId,
+      requireWorkflowIdForInternal: false,
+    })
+    if (!credAccess.ok || !credAccess.credentialOwnerUserId) {
+      logger.warn(`[${requestId}] Credential access denied`, { error: credAccess.error })
+      return NextResponse.json({ error: credAccess.error || 'Unauthorized' }, { status: 401 })
+    }
+
+    const accessToken = await refreshAccessTokenIfNeeded(
+      credentialId,
+      credAccess.credentialOwnerUserId,
+      requestId,
+      getScopesForService('gmail'),
+      impersonateEmail
+    )
+
+    if (!accessToken) {
+      return NextResponse.json({ error: 'Failed to obtain valid access token' }, { status: 401 })
+    }
+
+    logger.info(`[${requestId}] Fetching label ${labelId} from Gmail API`)
+    const response = await fetch(
+      `https://gmail.googleapis.com/gmail/v1/users/me/labels/${labelId}`,
+      {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+        },
+      }
+    )
+
+    logger.info(`[${requestId}] Gmail API response status: ${response.status}`)
+
+    if (!response.ok) {
+      const errorText = await response.text()
+      logger.error(`[${requestId}] Gmail API error response: ${errorText}`)
+
+      try {
+        const error = JSON.parse(errorText)
+        return NextResponse.json({ error }, { status: response.status })
+      } catch (_e) {
+        return NextResponse.json({ error: errorText }, { status: response.status })
+      }
+    }
+
+    const label = await response.json()
+
+    let formattedName = label.name
+
+    if (label.type === 'system') {
+      formattedName = label.name.charAt(0).toUpperCase() + label.name.slice(1).toLowerCase()
+    }
+
+    const formattedLabel = {
+      id: label.id,
+      name: formattedName,
+      type: label.type,
+      messagesTotal: label.messagesTotal || 0,
+      messagesUnread: label.messagesUnread || 0,
+    }
+
+    return NextResponse.json({ label: formattedLabel }, { status: 200 })
+  } catch (error) {
+    if (error instanceof ServiceAccountTokenError) {
+      return NextResponse.json({ error: error.message }, { status: 400 })
+    }
+    logger.error(`[${requestId}] Error fetching Gmail label:`, error)
+    return NextResponse.json({ error: 'Failed to fetch Gmail label' }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/gmail/labels/route.ts

@@ -0,0 +1,127 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailLabelsSelectorContract } from '@/lib/api/contracts/selectors/google'
+import { parseRequest } from '@/lib/api/server'
+import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import { validateAlphanumericId } from '@/lib/core/security/input-validation'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getScopesForService } from '@/lib/oauth/utils'
+import {
+  getServiceAccountToken,
+  refreshAccessTokenIfNeeded,
+  ServiceAccountTokenError,
+} from '@/app/api/auth/oauth/utils'
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailLabelsAPI')
+
+interface GmailLabel {
+  id: string
+  name: string
+  type: 'system' | 'user'
+  messagesTotal?: number
+  messagesUnread?: number
+}
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const parsed = await parseRequest(gmailLabelsSelectorContract, request, {})
+    if (!parsed.success) return parsed.response
+    const { credentialId, query } = parsed.data.query
+    const impersonateEmail = parsed.data.query.impersonateEmail || undefined
+
+    const credentialIdValidation = validateAlphanumericId(credentialId, 'credentialId', 255)
+    if (!credentialIdValidation.isValid) {
+      logger.warn(`[${requestId}] Invalid credential ID: ${credentialIdValidation.error}`)
+      return NextResponse.json({ error: credentialIdValidation.error }, { status: 400 })
+    }
+
+    const authz = await authorizeCredentialUse(request, {
+      credentialId,
+      requireWorkflowIdForInternal: false,
+    })
+    if (!authz.ok || !authz.credentialOwnerUserId || !authz.resolvedCredentialId) {
+      return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
+    }
+
+    let accessToken: string | null = null
+
+    if (authz.credentialType === 'service_account') {
+      accessToken = await getServiceAccountToken(
+        authz.resolvedCredentialId,
+        getScopesForService('gmail'),
+        impersonateEmail
+      )
+    } else {
+      accessToken = await refreshAccessTokenIfNeeded(
+        credentialId,
+        authz.credentialOwnerUserId,
+        requestId,
+        getScopesForService('gmail')
+      )
+    }
+
+    if (!accessToken) {
+      return NextResponse.json({ error: 'Failed to obtain valid access token' }, { status: 401 })
+    }
+
+    const response = await fetch('https://gmail.googleapis.com/gmail/v1/users/me/labels', {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    })
+
+    logger.info(`[${requestId}] Gmail API response status: ${response.status}`)
+
+    if (!response.ok) {
+      const errorText = await response.text()
+      logger.error(`[${requestId}] Gmail API error response: ${errorText}`)
+
+      try {
+        const error = JSON.parse(errorText)
+        return NextResponse.json({ error }, { status: response.status })
+      } catch (_e) {
+        return NextResponse.json({ error: errorText }, { status: response.status })
+      }
+    }
+
+    const data = await response.json()
+    if (!Array.isArray(data.labels)) {
+      logger.error(`[${requestId}] Unexpected labels response structure:`, data)
+      return NextResponse.json({ error: 'Invalid labels response' }, { status: 500 })
+    }
+
+    const labels = data.labels.map((label: GmailLabel) => {
+      let formattedName = label.name
+
+      if (label.type === 'system') {
+        formattedName = label.name.charAt(0).toUpperCase() + label.name.slice(1).toLowerCase()
+      }
+
+      return {
+        id: label.id,
+        name: formattedName,
+        type: label.type,
+        messagesTotal: label.messagesTotal || 0,
+        messagesUnread: label.messagesUnread || 0,
+      }
+    })
+
+    const filteredLabels = query
+      ? labels.filter((label: GmailLabel) =>
+          label.name.toLowerCase().includes((query as string).toLowerCase())
+        )
+      : labels
+
+    return NextResponse.json({ labels: filteredLabels }, { status: 200 })
+  } catch (error) {
+    if (error instanceof ServiceAccountTokenError) {
+      return NextResponse.json({ error: error.message }, { status: 400 })
+    }
+    logger.error(`[${requestId}] Error fetching Gmail labels:`, error)
+    return NextResponse.json({ error: 'Failed to fetch Gmail labels' }, { status: 500 })
+  }
+})

apps/sim/app/api/tools/gmail/mark-read/route.ts

@@ -0,0 +1,97 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailMarkReadContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailMarkReadAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail mark read attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail mark read request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailMarkReadContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Marking Gmail email as read`, {
+      messageId: validatedData.messageId,
+    })
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          removeLabelIds: ['UNREAD'],
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email marked as read successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email marked as read successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error marking Gmail email as read:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/mark-unread/route.ts

@@ -0,0 +1,100 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailMarkUnreadContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailMarkUnreadAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail mark unread attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(
+      `[${requestId}] Authenticated Gmail mark unread request via ${authResult.authType}`,
+      {
+        userId: authResult.userId,
+      }
+    )
+
+    const parsed = await parseRequest(gmailMarkUnreadContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Marking Gmail email as unread`, {
+      messageId: validatedData.messageId,
+    })
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          addLabelIds: ['UNREAD'],
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email marked as unread successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email marked as unread successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error marking Gmail email as unread:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/move/route.ts

@@ -0,0 +1,119 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailMoveContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailMoveAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail move attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail move request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailMoveContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Moving Gmail email`, {
+      messageId: validatedData.messageId,
+      addLabelIds: validatedData.addLabelIds,
+      removeLabelIds: validatedData.removeLabelIds,
+    })
+
+    const addLabelIds = validatedData.addLabelIds
+      .split(',')
+      .map((id) => id.trim())
+      .filter((id) => id.length > 0)
+
+    const removeLabelIds = validatedData.removeLabelIds
+      ? validatedData.removeLabelIds
+          .split(',')
+          .map((id) => id.trim())
+          .filter((id) => id.length > 0)
+      : []
+
+    const modifyBody: { addLabelIds?: string[]; removeLabelIds?: string[] } = {}
+
+    if (addLabelIds.length > 0) {
+      modifyBody.addLabelIds = addLabelIds
+    }
+
+    if (removeLabelIds.length > 0) {
+      modifyBody.removeLabelIds = removeLabelIds
+    }
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(modifyBody),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email moved successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email moved successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error moving Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/remove-label/route.ts

@@ -0,0 +1,130 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailRemoveLabelContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { validateAlphanumericId } from '@/lib/core/security/input-validation'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailRemoveLabelAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail remove label attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(
+      `[${requestId}] Authenticated Gmail remove label request via ${authResult.authType}`,
+      {
+        userId: authResult.userId,
+      }
+    )
+
+    const parsed = await parseRequest(gmailRemoveLabelContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Removing label(s) from Gmail email`, {
+      messageId: validatedData.messageId,
+      labelIds: validatedData.labelIds,
+    })
+
+    const labelIds = validatedData.labelIds
+      .split(',')
+      .map((id) => id.trim())
+      .filter((id) => id.length > 0)
+
+    for (const labelId of labelIds) {
+      const labelIdValidation = validateAlphanumericId(labelId, 'labelId', 255)
+      if (!labelIdValidation.isValid) {
+        logger.warn(`[${requestId}] Invalid label ID: ${labelIdValidation.error}`)
+        return NextResponse.json(
+          {
+            success: false,
+            error: labelIdValidation.error,
+          },
+          { status: 400 }
+        )
+      }
+    }
+
+    const messageIdValidation = validateAlphanumericId(validatedData.messageId, 'messageId', 255)
+    if (!messageIdValidation.isValid) {
+      logger.warn(`[${requestId}] Invalid message ID: ${messageIdValidation.error}`)
+      return NextResponse.json(
+        { success: false, error: messageIdValidation.error },
+        { status: 400 }
+      )
+    }
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          removeLabelIds: labelIds,
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Label(s) removed successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: `Successfully removed ${labelIds.length} label(s) from email`,
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error removing label from Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/send/route.ts

@@ -0,0 +1,222 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailSendContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { processFilesToUserFiles } from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
+import { assertToolFileAccess } from '@/app/api/files/authorization'
+import {
+  base64UrlEncode,
+  buildMimeMessage,
+  buildSimpleEmailMessage,
+  fetchThreadingHeaders,
+} from '@/tools/gmail/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailSendAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success || !authResult.userId) {
+      logger.warn(`[${requestId}] Unauthorized Gmail send attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    const userId = authResult.userId
+    logger.info(`[${requestId}] Authenticated Gmail send request via ${authResult.authType}`, {
+      userId,
+    })
+
+    const parsed = await parseRequest(gmailSendContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Sending Gmail email`, {
+      to: validatedData.to,
+      subject: validatedData.subject || '',
+      hasAttachments: !!(validatedData.attachments && validatedData.attachments.length > 0),
+      attachmentCount: validatedData.attachments?.length || 0,
+    })
+
+    const threadingHeaders = validatedData.replyToMessageId
+      ? await fetchThreadingHeaders(validatedData.replyToMessageId, validatedData.accessToken)
+      : {}
+
+    const originalMessageId = threadingHeaders.messageId
+    const originalReferences = threadingHeaders.references
+    const originalSubject = threadingHeaders.subject
+
+    let rawMessage: string | undefined
+
+    if (validatedData.attachments && validatedData.attachments.length > 0) {
+      const rawAttachments = validatedData.attachments
+      logger.info(`[${requestId}] Processing ${rawAttachments.length} attachment(s)`)
+
+      const attachments = processFilesToUserFiles(rawAttachments, requestId, logger)
+
+      if (attachments.length === 0) {
+        logger.warn(`[${requestId}] No valid attachments found after processing`)
+      } else {
+        const totalSize = attachments.reduce((sum, file) => sum + file.size, 0)
+        const maxSize = 25 * 1024 * 1024 // 25MB
+
+        if (totalSize > maxSize) {
+          const sizeMB = (totalSize / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const accessResults = await Promise.all(
+          attachments.map((file) => assertToolFileAccess(file.key, userId, requestId, logger))
+        )
+        const denied = accessResults.find((r) => r !== null)
+        if (denied) return denied
+
+        let resolved: Array<{ buffer: Buffer; contentType: string }>
+        try {
+          resolved = await Promise.all(
+            attachments.map(async (file) => {
+              logger.info(
+                `[${requestId}] Downloading attachment: ${file.name} (${file.size} bytes)`
+              )
+              return await downloadServableFileFromStorage(file, requestId, logger)
+            })
+          )
+        } catch (error) {
+          const notReady = docNotReadyResponse(error)
+          if (notReady) return notReady
+          logger.error(`[${requestId}] Failed to download an attachment:`, error)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Failed to download attachment: ${getErrorMessage(error, 'Unknown error')}`,
+            },
+            { status: 500 }
+          )
+        }
+
+        const resolvedTotal = resolved.reduce((sum, r) => sum + r.buffer.length, 0)
+        if (resolvedTotal > maxSize) {
+          const sizeMB = (resolvedTotal / (1024 * 1024)).toFixed(2)
+          return NextResponse.json(
+            {
+              success: false,
+              error: `Total attachment size (${sizeMB}MB) exceeds Gmail's limit of 25MB`,
+            },
+            { status: 400 }
+          )
+        }
+
+        const attachmentBuffers = attachments.map((file, i) => ({
+          filename: file.name,
+          mimeType: resolved[i].contentType || file.type || 'application/octet-stream',
+          content: resolved[i].buffer,
+        }))
+
+        const mimeMessage = buildMimeMessage({
+          to: validatedData.to,
+          cc: validatedData.cc ?? undefined,
+          bcc: validatedData.bcc ?? undefined,
+          subject: validatedData.subject || originalSubject || '',
+          body: validatedData.body,
+          contentType: validatedData.contentType || 'text',
+          inReplyTo: originalMessageId,
+          references: originalReferences,
+          attachments: attachmentBuffers,
+        })
+
+        logger.info(`[${requestId}] Built MIME message (${mimeMessage.length} bytes)`)
+        rawMessage = base64UrlEncode(mimeMessage)
+      }
+    }
+
+    if (!rawMessage) {
+      rawMessage = buildSimpleEmailMessage({
+        to: validatedData.to,
+        cc: validatedData.cc,
+        bcc: validatedData.bcc,
+        subject: validatedData.subject || originalSubject,
+        body: validatedData.body,
+        contentType: validatedData.contentType || 'text',
+        inReplyTo: originalMessageId,
+        references: originalReferences,
+      })
+    }
+
+    const requestBody: { raw: string; threadId?: string } = { raw: rawMessage }
+
+    if (validatedData.threadId) {
+      requestBody.threadId = validatedData.threadId
+    }
+
+    const gmailResponse = await fetch(`${GMAIL_API_BASE}/messages/send`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${validatedData.accessToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(requestBody),
+    })
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email sent successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email sent successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error sending Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})

apps/sim/app/api/tools/gmail/unarchive/route.ts

@@ -0,0 +1,97 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { gmailUnarchiveContract } from '@/lib/api/contracts/tools/google'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('GmailUnarchiveAPI')
+
+const GMAIL_API_BASE = 'https://gmail.googleapis.com/gmail/v1/users/me'
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success) {
+      logger.warn(`[${requestId}] Unauthorized Gmail unarchive attempt: ${authResult.error}`)
+      return NextResponse.json(
+        {
+          success: false,
+          error: authResult.error || 'Authentication required',
+        },
+        { status: 401 }
+      )
+    }
+
+    logger.info(`[${requestId}] Authenticated Gmail unarchive request via ${authResult.authType}`, {
+      userId: authResult.userId,
+    })
+
+    const parsed = await parseRequest(gmailUnarchiveContract, request, {})
+    if (!parsed.success) return parsed.response
+    const validatedData = parsed.data.body
+
+    logger.info(`[${requestId}] Unarchiving Gmail email`, {
+      messageId: validatedData.messageId,
+    })
+
+    const gmailResponse = await fetch(
+      `${GMAIL_API_BASE}/messages/${validatedData.messageId}/modify`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${validatedData.accessToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          addLabelIds: ['INBOX'],
+        }),
+      }
+    )
+
+    if (!gmailResponse.ok) {
+      const errorText = await gmailResponse.text()
+      logger.error(`[${requestId}] Gmail API error:`, errorText)
+      return NextResponse.json(
+        {
+          success: false,
+          error: `Gmail API error: ${gmailResponse.statusText}`,
+        },
+        { status: gmailResponse.status }
+      )
+    }
+
+    const data = await gmailResponse.json()
+
+    logger.info(`[${requestId}] Email unarchived successfully`, { messageId: data.id })
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        content: 'Email moved back to inbox successfully',
+        metadata: {
+          id: data.id,
+          threadId: data.threadId,
+          labelIds: data.labelIds,
+        },
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Error unarchiving Gmail email:`, error)
+
+    return NextResponse.json(
+      {
+        success: false,
+        error: getErrorMessage(error, 'Internal server error'),
+      },
+      { status: 500 }
+    )
+  }
+})