fix(sailpoint): align account contract fixtures

Author: waleedlatif1

apps/sim/blocks/blocks/sailpoint.ts

@@ -1030,7 +1030,7 @@ export const SailPointBlock: BlockConfig = {
       wandConfig: {
         enabled: true,
         prompt:
-          'Generate the requestedForWithRequestedItems JSON array for SailPoint. Each entry requires identityId and requestedItems and may set identityType HUMAN or MACHINE. Machine requests must use MACHINE for every entry and support ENTITLEMENT items only. For Request Access, machine grants or modifications require the exact accountSelection returned by Get Account Selections; omit accountSelection when running Get Account Selections itself. Machine revokes use nativeIdentity without accountSelection. Human revoke requests must use the flat payload instead. Items may include comment, startDate, removeDate, accountSelection, nativeIdentity, formInstanceId, and clientMetadata where supported. Return ONLY the JSON array - no explanations, no extra text.',
+          "Generate the requestedForWithRequestedItems JSON array for SailPoint. Each entry requires identityId and requestedItems and may set identityType HUMAN or MACHINE. Machine requests must use MACHINE for every entry and support ENTITLEMENT items only. For Request Access, machine grants or modifications require the exact accountSelection returned by Get Account Selections; omit accountSelection when running Get Account Selections itself. Machine revokes omit accountSelection and normally include nativeIdentity; nativeIdentity may be omitted only when SailPoint can auto-resolve the machine's sole account on the entitlement source. Human revoke requests must use the flat payload instead. Items may include comment, startDate, removeDate, accountSelection, nativeIdentity, formInstanceId, and clientMetadata where supported. Return ONLY the JSON array - no explanations, no extra text.",
         placeholder: 'Describe recipients, items, and account selections...',
       },
     },

apps/sim/lib/internal/sailpoint/execute-tool.test.ts

@@ -349,7 +349,7 @@ describe('SailPoint internal tool handler', () => {
   it('sends the experimental header for account-selection discovery', async () => {
     mockFetch
       .mockResolvedValueOnce(tokenResponse())
-      .mockResolvedValueOnce(Response.json({ accountsSelections: [] }))
+      .mockResolvedValueOnce(Response.json({ identities: [] }))
     const response = await request('sailpoint_get_account_selections', {
       requestedFor: ['identity'],
       requestedItems: [{ type: 'ROLE', id: 'role' }],
@@ -361,12 +361,12 @@ describe('SailPoint internal tool handler', () => {
   })
 
   it.each([
-    ['sailpoint_get_account_selections', 'accountSelections', { accountsSelections: [] }],
+    ['sailpoint_get_account_selections', 'accountSelections', { identities: [] }],
     ['sailpoint_get_access_request_config', 'accessRequestConfig', { accessRequest: {} }],
     [
       'sailpoint_get_entitlement_request_config',
       'entitlementRequestConfig',
-      { grantRequestConfig: {} },
+      { accessRequestConfig: {} },
     ],
   ])('maps %s to its resource-named output', async (operation, outputKey, providerBody) => {
     clearSailPointTokenStateForTests()

apps/sim/tools/sailpoint/definitions.test.ts

@@ -95,6 +95,28 @@ describe('SailPoint exact input contracts', () => {
     ).toThrow('REVOKE_ACCESS allows at most one entitlement item')
   })
 
+  it('allows SailPoint to auto-resolve a machine revoke account when nativeIdentity is omitted', () => {
+    expect(
+      sailpointRequestAccessTool.operation.input({
+        ...credentials,
+        requestType: 'REVOKE_ACCESS',
+        requestedForWithRequestedItems: [
+          {
+            identityId: 'machine',
+            identityType: 'MACHINE',
+            requestedItems: [{ type: 'ENTITLEMENT', id: 'entitlement', comment: 'remove' }],
+          },
+        ],
+      })
+    ).toMatchObject({
+      requestedForWithRequestedItems: [
+        {
+          requestedItems: [{ type: 'ENTITLEMENT', id: 'entitlement', comment: 'remove' }],
+        },
+      ],
+    })
+  })
+
   it('supports account-selection discovery without a preselected account', () => {
     expect(
       sailpointGetAccountSelectionsTool.operation.input({