fix(atlassian): validate Jira, Confluence, JSM, Bitbucket, Trello against vendor docs - #9950

Summary

• JSM Assets search returned no objects for every valid AQL query. /object/aql sent paging in the body and read the legacy objectEntries/totalFilterCount shape. It now sends startAt/maxResults/includeAttributes as query params with {qlQuery} as the body, and reads values/total/isLast, per the Assets OpenAPI spec.
  • objectTypeId/objectSchemaId are now applied: they are ANDed into the AQL (numeric only) and keep any trailing order by. Before, they were sent in the body and silently ignored.
  • New startAt, maxResults and isLast outputs.
• JSM List Object Types: an empty /objectschema/{id}/objecttypes response now falls back to the documented /objecttypes/flat, with excludeAbstract applied client-side. Non-empty responses are untouched and make no extra request.
• JSM requests:
  • Get Requests accepts the documented ORGANIZATION/ALL_ORGANIZATIONS ownership values (they were rejected before), plus new approvalStatus and organizationId.
  • Get and Create Request return webUrl and requestFieldValues.renderedValue.
  • Get Request returns expanded participants/slas.
  • Request type and comment visibility filters are reachable from the block.
• Jira:
  • Search and Read now return the fields they already request: custom fields, parent, fixVersions, subtasks, issue links, time tracking, creator, watchers, ADF description and names. Search gains expand.
  • Write and Update accept typed customFields; Update gains parent; Transition gains screen fields.
  • includeAttachments is reachable from the block.
  • Path IDs go through safeUrlPathSegment, including the delete tools.
• Confluence:
  • Fields that were always empty or null are now populated: List Comments authorId/createdAt (read from version), Atlas Doc Format comment bodies, Search spaceKey/space.id (via expand=content.space), and space description (via description-format=plain).
  • New: CQL and cursor paging on search, inline comments with replies, page owner/parent/labels, attachment createdAt/fileId, and space owner/webUrl.
• Bitbucket:
  • List Commits gains include/exclude/path.
  • Trigger Pipeline can target tags. Its restricted ref target is unchanged: no selector, variables or runner.
  • PR endpoints return the allowed and default merge strategies.
  • Webhook provider log messages are static.
• Trello:
  • Search failed whenever a board matched (board_fields lacked the required url).
  • Get Card always returned dueComplete: null (it now sends fields=all).
  • Card outputs gain start, pos, shortUrl, badges, idMembers and friends.
  • Create and Update gain start; Update gains pos, idBoard, idLabels and idMembers.
  • Search gains paging; List Cards gains since/before.
  • All path IDs go through safeUrlPathSegment.
• Backwards compatibility:
  • No param, subBlock id, operation value, tool id or output was removed, renamed or retyped, and no default changed.
  • New block fields are scoped to their own operations in tools.config.params, so stale values can't leak between operations.
  • The only output values that change are ones that were previously empty, null or erroring.

Follow-ups (not in this PR)

• Bitbucket trigger_pipeline declares scope pipeline, but the docs say pipeline:write. Left alone because credential resolution reads it.
• Trello list-card limit/checklists/attachments/members are documented only in the nested-resources guide, not the OpenAPI spec, so they were left out.
• Confluence trigger confluenceEmail/confluenceApiToken/includeFileContent are never read.

Type of Change

• Bug fix
• New feature (additive params and outputs)

Testing

• New regression tests, each red on the pre-fix code:
  • JSM: AQL request and response shape, scope injection guard, order by preservation, object-types /flat fallback, ORGANIZATION ownership.
  • Confluence: comment author/created time, search space key.
• vitest over tools/{jira,jsm,bitbucket,trello,confluence}, lib/internal/{jira,jsm,confluence,bitbucket}, the Jira/Bitbucket webhook providers, triggers and the block tests: 310 passed.
• check-block-registry.ts origin/staging, check:tool-metadata, check:docs, check:integration-catalog and biome pass.
• An independent review of the full diff checked it against the Atlassian and Trello OpenAPI specs.
• Type-check and check:audits run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)