feat(google-official): wrap BigQuery / GKE / Maps so they actually work in mesh

[JonasJesus42]

Summary

The three google-*-official MCPs (google-bigquery-official, google-gke-official, google-maps-official) were registered as bare URLs pointing at Google's MCP endpoints (bigquery.googleapis.com/mcp, container.googleapis.com/mcp, mapstools.googleapis.com/mcp). They didn't work in mesh because Google doesn't support Dynamic Client Registration — same gap that motivated #418 google-workspace.

This PR makes them work using the same wrapper pattern.

What changed

Shared module @decocms/mcps-shared/google-mcp — extracted from google-workspace/server/lib/:

• proxy.ts — generic JSON-RPC fetcher with 401/403 re-auth hints
• json-schema-to-zod.ts — minimal converter for Google's schemas
• wrap-tool.ts — turns a snapshot entry into a createPrivateTool factory; wrapBackendSnapshot dedupes upstream duplicates
• generate-snapshot.ts — reusable codegen that fetches tools/list + RFC 9728 PRM and writes per-backend JSON + TOOLS.md

Refactor google-workspace to consume the shared module. No behavior change — only the snapshots gain a url field and TOOLS.md wording is slightly more generic.

Three new wrapper MCPs, each one ~30 lines of glue + a snapshot:

MCP	Tools	Scope
google-bigquery-official	6	https://www.googleapis.com/auth/bigquery
google-gke-official	23	https://www.googleapis.com/auth/container
google-maps-official	3	https://www.googleapis.com/auth/maps-platform.mapstools

Each one:

• Has its own app.json (connection URL points at the new worker), package.json, tsconfig.json, shared/deco.gen.ts, server/main.ts, server/scripts/generate-tools.ts, snapshot in server/tools/generated/, and TOOLS.md.
• Reuses createGoogleOAuth from @decocms/mcps-shared/google-oauth and proxies via @decocms/mcps-shared/google-mcp.
• Flips mesh_unlisted: true → false so the registry surfaces them again.

deploy.json — three new kubernetes-bun entries.

Deployment requirements

Each wrapper needs the same secrets the other Google MCPs use:

• GOOGLE_CLIENT_ID
• GOOGLE_CLIENT_SECRET

And the redirect URI of https://sites-google-{name}-official.decocache.com/... added to the OAuth client in Google Cloud Console.

Test plan

• bun scripts/check.ts google-bigquery-official google-gke-official google-maps-official google-workspace — all 4 pass
• bun run generate-tools re-runs cleanly in each MCP, produces deterministic snapshots
• bun run build succeeds for each MCP
• After deploy + secrets: install one of the three from the registry, authenticate, run tools/list and a sample tool call (e.g. list_dataset_ids for BigQuery)

Adding more google-*-official MCPs later

The pattern is now formalized. To add (say) google-cloudrun-official:

1. New folder, copy the shape from any of the three (~10 files, ~300 LOC total — most of it boilerplate).
2. Set BACKEND_URL to the upstream MCP endpoint.
3. bun run generate-tools.
4. Add to deploy.json and root package.json workspaces.
5. PR.

🤖 Generated with Claude Code

---

Summary by cubic

Wrap Google’s official BigQuery, GKE, and Maps MCP servers behind an OAuth + JSON-RPC proxy so they work in mesh. Extract shared wrapper logic into @decocms/mcps-shared/google-mcp and refactor google-workspace to use it.

• New Features

  • Add google-bigquery-official (6 tools), google-gke-official (23 tools), and google-maps-official (3 tools); point app.json URLs to https://sites-google-{name}-official.decocache.com/mcp and set mesh_unlisted: false.
  • Introduce @decocms/mcps-shared/google-mcp with proxy, json-schema-to-zod, tool wrapping, and snapshot generator; add per-wrapper generate-tools scripts and TOOLS.md.
  • Update deploy.json with three kubernetes-bun entries and add the new packages to root package.json workspaces.
  • Refactor google-workspace to the shared helpers; no behavior change, snapshots now include a url field.

• Migration

  • Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET for each wrapper.
  • Add OAuth redirect URIs for each site: https://sites-google-{name}-official.decocache.com/... in Google Cloud Console.
  • After deploy, install from the registry, authenticate, then call tools/list or any sample tool.

^{Written for commit 22f9e58. Summary will update on new commits.}