Track claims via linkedclaim records on keybase' atproto account

apps/keytrace.dev/server/api/claims/[rkey].patch.ts

···
 import { COLLECTION_NSID, createClaim, verifyClaim, ClaimStatus } from "@keytrace/runner";
 import { getSessionAgent } from "~/server/utils/session";
 import { createStatusAttestation } from "~/server/utils/attestation";
+import { putLinkedClaim } from "~/server/utils/linkedclaims";
 
 export default defineEventHandler(async (event) => {
   const { did, agent } = await getSessionAgent(event);
···
       rkey,
       record,
     });
+
+    // Update LinkedClaim record to reflect new status (best-effort)
+    try {
+      const confidence = record.status === "verified" ? 1.0 : 0.0;
+      await putLinkedClaim(agent, {
+        did,
+        rkey,
+        ketyraceAtUri: res.data.uri,
+        subjectUri: record.identity?.profileUrl ?? claimUri,
+        providerId: record.type,
+        subjectLabel: record.identity?.subject ?? record.type,
+        confidence,
+        statusAt,
+        createdAt: record.createdAt ?? now,
+      });
+    } catch (error) {
+      console.error("[claims] Failed to update LinkedClaim record:", error);
+    }
 
     return {
       uri: res.data.uri,

apps/keytrace.dev/server/api/claims/index.post.ts

···
 import { getSessionAgent } from "~/server/utils/session";
 import { createAttestation, createStatusAttestation } from "~/server/utils/attestation";
 import { addRecentClaim } from "~/server/utils/recent-claims";
+import { putLinkedClaim } from "~/server/utils/linkedclaims";
 
 export default defineEventHandler(async (event) => {
   const { did, agent } = await getSessionAgent(event);
···
     });
 
     console.log(`[claims] Success: uri=${result.data.uri} cid=${result.data.cid}`);
+
+    // Create LinkedClaim record (best-effort, don't fail the request)
+    try {
+      const rkey = result.data.uri.split("/").pop()!;
+      await putLinkedClaim(agent, {
+        did,
+        rkey,
+        keytraceAtUri: result.data.uri,
+        subjectUri: identity.profileUrl ?? body.claimUri,
+        providerId: provider.id,
+        subjectLabel: subject,
+        confidence: 1.0,
+        statusAt: now,
+        createdAt: now,
+      });
+    } catch (error) {
+      console.error("[claims] Failed to create LinkedClaim record:", error);
+    }
 
     // Add to recent claims feed (best-effort, don't fail the request)
     try {

apps/keytrace.dev/server/utils/linkedclaims.ts

···
+/**
+ * LinkedClaims integration utilities.
+ *
+ * Creates and updates com.linkedclaims.claim records alongside keytrace claims.
+ * The linkedclaim uses the same rkey as the corresponding keytrace claim so we
+ * can always derive its AT-URI without storing a back-reference.
+ *
+ * https://identity.foundation/labs-linkedclaims/
+ */
+
+const LINKED_CLAIMS_NSID = "com.linkedclaims.claim";
+
+// Map keytrace provider IDs to LinkedClaims howKnown values; defaults to WEB_DOCUMENT
+const HOW_KNOWN: Record<string, string> = {
+  pgp: "SIGNED_DOCUMENT",
+};
+
+interface PutLinkedClaimOptions {
+  did: string;
+  rkey: string;
+  /** AT-URI of the keytrace dev.keytrace.claim record */
+  keytraceAtUri: string;
+  /** External identity URI (e.g. the GitHub profile URL) */
+  subjectUri: string;
+  providerId: string;
+  /** Human-readable identity subject (e.g. "orta" or "@orta") */
+  subjectLabel: string;
+  confidence: number;
+  /** ISO datetime of when the claim was verified / failed / retracted */
+  statusAt: string;
+  createdAt: string;
+}
+
+export async function putLinkedClaim(agent: any, opts: PutLinkedClaimOptions) {
+  const { did, rkey, keytraceAtUri, subjectUri, providerId, subjectLabel, confidence, statusAt, createdAt } = opts;
+
+  const howKnown = HOW_KNOWN[providerId] ?? "WEB_DOCUMENT";
+
+  const record: Record<string, unknown> = {
+    $type: LINKED_CLAIMS_NSID,
+    subject: subjectUri,
+    claimType: "identity",
+    statement: `Verified ${providerId} identity: ${subjectLabel}`,
+    confidence,
+    source: {
+      uri: keytraceAtUri,
+      howKnown,
+      dateObserved: statusAt,
+    },
+    effectiveDate: statusAt,
+    createdAt,
+  };
+
+  await agent.com.atproto.repo.putRecord({
+    repo: did,
+    collection: LINKED_CLAIMS_NSID,
+    rkey,
+    record,
+  });
+}