Preserve an explicitly absent OAuth resource across all grants

[RhysSullivan]

Fixes #1789

Microsoft Entra v2 rejects an authorization request that carries both a v2 `scope` (such as `https://api.fabric.microsoft.com/.default\`) and the RFC 8707 `resource` parameter, failing with `AADSTS9010010` before the consent screen. Executor made that unavoidable for MCP servers behind Entra: registering an OAuth app for an MCP integration always derived the MCP endpoint as the resource, the form had no field for it, and every request then carried the parameter.

The fix

Absence of a resource is now a first-class, persistable state, honored everywhere:

• The register/edit OAuth app form shows the resource indicator. It is still prefilled for MCP servers, but it can be cleared, and a cleared value persists as "no resource". No endpoint is re-derived over an intentional absence.
• A resource-less app omits `resource` on all four grants alike — authorize, code exchange, refresh, and client-credentials. Symmetry matters: sending it on authorize but not on the token request (or the reverse) would bind the tokens to different audiences.
• MCP scope discovery no longer depends on the app's resource: the scope policy now carries the integration's own discovery URL (the MCP endpoint), so clearing the resource does not break connecting.
• Token refresh for a first-party OAuth app previously dropped the app's configured resource, refreshing to a different audience than the original grant. It now sends the same resource the authorization request sent.

Apps that keep their resource — the default for every discovered MCP server — behave exactly as before: the parameter is sent on every grant, as the MCP authorization spec requires.

What this replaces

An earlier revision gated the parameter on a `resource_indicators_supported` field in discovered authorization-server metadata. That field is not IANA-registered (RFC 8707 defined no discovery flag), so treating its absence as "unsupported" would silently stop sending `resource` to spec-compliant servers, and the production request paths never received the metadata anyway. That plumbing is removed entirely.

Tests

• Full-path coverage: an app registered with `resource: null` runs authorize → code exchange → refresh and the authorization server sees no `resource` anywhere; client-credentials likewise. The mirror case (resource configured → sent on every grant) is asserted across the existing flow tests plus a new client-credentials case.
• MCP scope discovery with a resource-less app now succeeds from the integration's discovery URL, and the authorize URL carries no `resource`.
• Full `@executor-js/sdk` suite (757 tests) and `@executor-js/react` suite (379 tests) pass, plus repo typecheck, lint, and format.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	132b3ff	Aug 28 2026, 07:17 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	132b3ff	Commit Preview URL Branch Preview URL	Aug 28 2026, 07:16 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1822

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1822

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1822

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1822

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1822

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1822

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1822

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1822

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1822

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1822

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1822

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1822

executor

npm i https://pkg.pr.new/executor@1822

commit: 132b3ff