agent: resource-side 202 poll ignores maxPollDuration and emits no events

[dickhardt]

Summary

When a resource answers the agent-token request with 202 + AAuth-Requirement: requirement=interaction + Location (a resource-level deferral, not a person-server one), handleResourceInteraction in agent/src/aauth-fetch.ts calls pollDeferred without maxPollDuration, onEvent, or sentTracker:

const result = await pollDeferred({
  signedFetch,
  locationUrl,
  interactionUrl,
  interactionCode,
  onInteraction,
  onClarification,
})

The person-server path (exchangeToken / createPersonTokenCache) passes all three. Only resources that defer directly are affected.

Observed with @aauth/agent 3.0.0 via @aauth/fetch 3.0.0

Resource: https://api.outgoing.world/partner/v1/homescreen. Once the agent's free trial is used up it returns:

HTTP/2 202
AAuth-Requirement: requirement=interaction; url="https://www.outgoing.world/agents/upgrade"; code="52V1-N8B1"
Location: https://api.outgoing.world/partner/v1/aauth/interaction?state=...

The poll URL returns 202 {"status":"pending"} immediately and ignores Prefer: wait.

1. npx @aauth/fetch --poll-timeout 20 https://api.outgoing.world/partner/v1/homescreen prints the approval URL and QR, then keeps polling past 75 s. It only stops at DEFAULT_MAX_POLL_DURATION (900 s). The flag is silently ignored.
2. npx @aauth/fetch --explain --explain-log explain.jsonl ... logs just two events (agent_token_request start/done). No interaction_required and no consent_poll events, so the trace stops dead at the 202 even though the agent is polling.

Expected

• --poll-timeout (i.e. maxPollDuration) bounds the resource-side poll the same way it bounds the person-server poll.
• interaction_required and consent_poll events are emitted for the resource-side poll, with request_headers/request_body from sentTracker.

Fix

Thread onEvent, maxPollDuration, and sentTracker from the createAAuthFetch options through handleResourceInteraction into pollDeferred. Current code on main at a0902b9.