Module enrollment 

Browserless OIDC enrollment: obtain an access token to present as auth_token in the RPC handshake.

Three standard flows against the issuer configured in [oidc.<alias>]:

• the Device Authorization Grant (RFC 8628) for interactive humans on a browserless host — start, show the user code and verification URI, poll until the IdP grants the token;
• the Authorization Code grant with PKCE (RFC 7636, S256 only) for hosts with a browser, paired with the RFC 8252 loopback listener; and
• client_credentials for headless service principals (requires the entry’s client_secret).

Enrollment is CLIENT-side machinery: it talks to the IdP, never to the daemon, and nothing here stores the resulting token — the caller presents it in initialize (or exports it as ZEROCLAW_AUTH_TOKEN).

Structs

DeviceGrantStart

EnrolledToken

Serialize exists for the gateway enrollment API, whose whole purpose is returning the token to the enrolling client; Debug stays redacted.

Enrollment

LoopbackListener

The one-shot loopback callback listener (RFC 8252): binds an ephemeral 127.0.0.1 port, answers exactly one matching callback, and shuts down. Requests that do not carry this flow’s state get a fixed page and the wait continues; nothing from any request is echoed back. Connections are served one at a time, so each gets a short read deadline: a local process that connects and stays silent is dropped and the next connection is taken, instead of parking the browser’s callback behind it until the whole flow times out.

PkceFlow

An in-flight Authorization Code + PKCE attempt (RFC 7636, S256 only). The verifier and nonce stay in process memory for the lifetime of one attempt and leave it only inside the code exchange.

Enums

DevicePollOutcome