Source: openagent-sdk/bridges/oidc/rust/src/mapping.rs. SHA-256: 4fc3d6174d7e45f26946109f84ae2814a0a343d7123f69e1638b58e8d8adb8c8.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

mapping::DerivedAgent

Result of deriving an agent DID from a human JWT.

#[derive(Debug)]
pub struct DerivedAgent {
/// The agent's DID (`did:oas:<ns>:agent:<name>`).

pub agent_did: String,
/// The agent's Ed25519 keypair.

pub agent_keypair: OasKeyPair,
/// The agent's signed OAS document.

pub agent_document: OasDocument,
/// Cryptographic lineage proof (the agent's document contains this).

pub lineage_proof: Option<serde_json::Value>,
/// The parent HMR DID.

pub parent_hmr_did: String,
/// The parent HMR's signed document.

pub parent_document: OasDocument,
/// The parent HMR's keypair (needed for further derivations).

pub parent_keypair: OasKeyPair
}

Source line: 22.

mapping::hmr_identifier_from_claims

Deterministic identifier for an HMR derived from an OIDC subject.

Uses the issuer + subject to produce a stable, collision-resistant identifier so the same human always maps to the same HMR DID.

pub fn hmr_identifier_from_claims(issuer: &str, hmr_value: &str) -> String;

Source line: 43.

mapping::derive_agent_from_claims

Derive an agent DID under a human's HMR from validated OIDC claims.

This is the core of Flow 1: Human JWT -> Agent DID.

1. Maps the JWT subject to an HMR DID (deterministic).
2. Derives a child agent DID under that HMR using HKDF-SHA256.
3. Returns the agent's identity (DID, keypair, lineage proof, parent HMR).

Arguments

• namespace - OAS namespace (e.g. "openagent").
• claims - Validated claims from the human's JWT.
• agent_name - Name for the derived agent (e.g. "my-bot").

Errors

Returns [OidcBridgeError::Mapping] if HMR minting or child derivation fails.

pub fn derive_agent_from_claims(
    namespace: &str,
    claims: &ValidatedClaims,
    agent_name: &str,
) -> Result<DerivedAgent>;

Source line: 110.

mapping::map_scopes

Map OIDC scopes/roles to Arsenal capability scopes using the provider's scope mapping configuration.

If the JWT contains scopes that are in the provider's scope_mapping, the corresponding Arsenal scopes are returned. Unmapped scopes are passed through as-is (useful when OIDC scopes already match Arsenal format).

pub fn map_scopes(
    oidc_scopes: &[String],
    scope_mapping: &HashMap<String, Vec<String>>,
) -> Vec<String>;

Source line: 165.

mapping::lineage_depth

Compute the lineage depth from an OAS document.

Derived from the OAS LineageSection::generation (number of derivation steps from the human root); documents without a lineage section report 0.

pub fn lineage_depth(doc: &OasDocument) -> u32;

Source line: 194.