feat(api): integrate Keytrace claims into activity feed and external accounts (#130) (#141)

Register Keytrace (dev.keytrace.claim) in the ATproto app registry so
claims appear in the cross-app activity feed. Extend the external
accounts endpoint to fetch Keytrace claims from the user's PDS, merge
them with Sifa-declared accounts using URL normalization and
platform/username matching, and surface cryptographic verification
status. Claims are cached in Valkey with a 2-hour TTL, invalidated
on profile sync.

src/lib/atproto-app-registry.ts

···
     urlPattern: 'https://roomy.space',
     color: 'purple',
   },
+  {
+    id: 'keytrace',
+    name: 'Keytrace',
+    category: 'Links',
+    collectionPrefixes: ['dev.keytrace'],
+    scanCollections: ['dev.keytrace.claim'],
+    urlPattern: 'https://keytrace.dev/{handle}',
+    color: 'indigo',
+  },
 ];
 
 export const EXCLUDED_COLLECTIONS: string[] = [

src/lib/url-utils.ts

···
+export function normalizeUrl(url: string): string {
+  let normalized = url.toLowerCase();
+  normalized = normalized.replace(/^https?:\/\//, '');
+  normalized = normalized.replace(/^www\./, '');
+  normalized = normalized.replace(/\/+$/, '');
+  return normalized;
+}
+
+const PLATFORM_EXTRACTORS: Record<string, (url: URL) => string | null> = {
+  github: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    return parts[0] ?? null;
+  },
+  linkedin: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    if (parts[0] === 'in' && parts[1]) return parts[1];
+    return null;
+  },
+  twitter: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    return parts[0] ?? null;
+  },
+  instagram: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    return parts[0] ?? null;
+  },
+  youtube: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    if (parts[0] === 'channel' && parts[1]) return parts[1];
+    if (parts[0]?.startsWith('@')) return parts[0];
+    return null;
+  },
+  fediverse: (url) => {
+    const parts = url.pathname.split('/').filter(Boolean);
+    if (parts[0]?.startsWith('@')) return `${parts[0]}@${url.hostname}`;
+    return null;
+  },
+};
+
+export function extractPlatformUsername(platform: string, url: string): string | null {
+  const normalizedPlatform = platform.toLowerCase();
+  const extractor = PLATFORM_EXTRACTORS[normalizedPlatform];
+  if (!extractor) return null;
+
+  try {
+    let parsableUrl = url;
+    if (!/^https?:\/\//i.test(parsableUrl)) {
+      parsableUrl = `https://${parsableUrl}`;
+    }
+    return extractor(new URL(parsableUrl));
+  } catch {
+    return null;
+  }
+}

src/routes/external-accounts.ts

···
 import { discoverFeedUrl, fetchFeedItems } from '../services/feed-discovery.js';
 import { checkAndStoreVerification, isVerifiablePlatform } from '../services/verification.js';
 import { indexRecord, deleteRecord } from '../services/record-indexer.js';
+import { fetchKeytraceClaims, mergeExternalAccounts } from '../services/keytrace.js';
+import { resolvePdsHost } from '../lib/pds-provider.js';
 
 const FEED_CACHE_TTL = 1800; // 30 minutes
 
···
         return reply.status(404).send({ error: 'NotFound', message: 'Profile not found' });
       }
 
-      const accounts = await db
-        .select()
-        .from(externalAccounts)
-        .where(eq(externalAccounts.did, profile.did));
+      // Fetch Sifa accounts + verifications and Keytrace claims in parallel
+      const pdsHost = profile.pdsHost ?? (await resolvePdsHost(profile.did));
 
-      const verifications = await db
-        .select()
-        .from(externalAccountVerifications)
-        .where(eq(externalAccountVerifications.did, profile.did));
+      const [accounts, verifications, keytraceClaims] = await Promise.all([
+        db.select().from(externalAccounts).where(eq(externalAccounts.did, profile.did)),
+        db
+          .select()
+          .from(externalAccountVerifications)
+          .where(eq(externalAccountVerifications.did, profile.did)),
+        pdsHost ? fetchKeytraceClaims(profile.did, pdsHost, valkey) : Promise.resolve([]),
+      ]);
 
       const verificationMap = new Map(
         verifications.map((v) => [v.url, { verified: v.verified, verifiedVia: v.verifiedVia }]),
       );
 
-      const result = accounts.map((acc) => {
+      const sifaAccounts = accounts.map((acc) => {
         const verification = verificationMap.get(acc.url);
         const verifiable = isVerifiablePlatform(acc.platform);
 
···
           url: acc.url,
           label: acc.label,
           feedUrl: acc.feedUrl,
-          primary: acc.isPrimary,
+          isPrimary: acc.isPrimary,
           verifiable,
           verified: verification?.verified ?? false,
           verifiedVia: verification?.verifiedVia ?? null,
         };
       });
+
+      const merged = mergeExternalAccounts(sifaAccounts, keytraceClaims);
+
+      // Map isPrimary to primary for backwards compatibility with frontend
+      const result = merged.map(({ isPrimary, ...rest }) => ({
+        ...rest,
+        primary: isPrimary,
+      }));
 
       return reply.send({ accounts: result });
     },

src/routes/profile-write.ts

···
 import { Agent } from '@atproto/api';
 import { z } from 'zod';
 import type { Database } from '../db/index.js';
+import type { ValkeyClient } from '../cache/index.js';
 import { eq } from 'drizzle-orm';
 import {
   profiles as profilesTable,
···
 import { scanUserApps } from '../services/pds-scanner.js';
 import { upsertScanResults } from '../services/app-stats.js';
 import { resolvePdsHost } from '../lib/pds-provider.js';
+import { invalidateKeytraceCache } from '../services/keytrace.js';
 
 const overrideSchema = z.object({
   headline: z.string().max(300).nullish(),
···
   db: Database,
   oauthClient: NodeOAuthClient | null,
   storage: StorageService,
+  valkey: ValkeyClient | null,
 ) {
   const requireAuth = createAuthMiddleware(oauthClient, db);
 
···
       app.log.warn({ err, did }, 'Cross-app activity scan failed during profile sync');
       // Non-fatal — profile sync still succeeds even if activity scan fails
     }
+
+    // Invalidate Keytrace cache so next profile view fetches fresh claims
+    await invalidateKeytraceCache(did, valkey);
 
     return reply.send({ synced });
   });

src/server.ts

···
   registerOAuthMetadata(app, config);
   registerOAuthRoutes(app, db, oauthClient);
   registerProfileRoutes(app, db, valkey);
-  registerProfileWriteRoutes(app, db, oauthClient, storage);
+  registerProfileWriteRoutes(app, db, oauthClient, storage, valkey);
   registerImportRoutes(app, db, oauthClient);
   registerFollowRoutes(app, db, oauthClient);
   registerSearchRoutes(app, db);

src/services/keytrace.ts

···
+import { Agent } from '@atproto/api';
+import { z } from 'zod';
+import type { ValkeyClient } from '../cache/index.js';
+import { normalizeUrl, extractPlatformUsername } from '../lib/url-utils.js';
+import { logger as rootLogger } from '../logger.js';
+
+const logger = rootLogger.child({ module: 'keytrace' });
+
+const KEYTRACE_CACHE_TTL = 7200; // 2 hours
+const KEYTRACE_COLLECTION = 'dev.keytrace.claim';
+const PDS_TIMEOUT_MS = 3000;
+
+const keytraceClaimSchema = z.object({
+  url: z.string().min(1),
+  platform: z.string().min(1),
+  createdAt: z.string().optional(),
+});
+
+export interface KeytraceClaim {
+  rkey: string;
+  platform: string;
+  url: string;
+  claimedAt: string;
+}
+
+export interface SifaExternalAccount {
+  rkey: string;
+  platform: string;
+  url: string;
+  label: string | null;
+  feedUrl: string | null;
+  isPrimary: boolean;
+  verified: boolean;
+  verifiedVia: string | null;
+  verifiable: boolean;
+}
+
+export interface MergedExternalAccount {
+  rkey: string;
+  platform: string;
+  url: string;
+  label: string | null;
+  feedUrl: string | null;
+  isPrimary: boolean;
+  verifiable: boolean;
+  verified: boolean;
+  verifiedVia: string | null;
+  source: 'sifa' | 'keytrace';
+  keytraceVerified: boolean;
+  keytraceClaim?: {
+    rkey: string;
+    claimedAt: string;
+  };
+}
+
+function cacheKey(did: string): string {
+  return `keytrace:claims:${did}`;
+}
+
+export async function invalidateKeytraceCache(
+  did: string,
+  valkey: ValkeyClient | null,
+): Promise<void> {
+  if (!valkey) return;
+  try {
+    await valkey.del(cacheKey(did));
+  } catch (err) {
+    logger.warn({ err, did }, 'Failed to invalidate Keytrace cache');
+  }
+}
+
+export async function fetchKeytraceClaims(
+  did: string,
+  pdsHost: string,
+  valkey: ValkeyClient | null,
+): Promise<KeytraceClaim[]> {
+  // Check cache first
+  if (valkey) {
+    try {
+      const cached = await valkey.get(cacheKey(did));
+      if (cached) {
+        return JSON.parse(cached) as KeytraceClaim[];
+      }
+    } catch (err) {
+      logger.warn({ err, did }, 'Failed to read Keytrace cache');
+    }
+  }
+
+  // Fetch from PDS
+  try {
+    const agent = new Agent(`https://${pdsHost}`);
+    const res = await agent.com.atproto.repo.listRecords(
+      {
+        repo: did,
+        collection: KEYTRACE_COLLECTION,
+        limit: 100,
+      },
+      { signal: AbortSignal.timeout(PDS_TIMEOUT_MS) },
+    );
+
+    const claims: KeytraceClaim[] = [];
+    for (const record of res.data.records) {
+      const parsed = keytraceClaimSchema.safeParse(record.value);
+      if (!parsed.success) continue;
+
+      const rkey = record.uri.split('/').pop() ?? '';
+      claims.push({
+        rkey,
+        platform: parsed.data.platform,
+        url: parsed.data.url,
+        claimedAt: parsed.data.createdAt ?? new Date().toISOString(),
+      });
+    }
+
+    // Cache the result
+    if (valkey) {
+      try {
+        await valkey.setex(cacheKey(did), KEYTRACE_CACHE_TTL, JSON.stringify(claims));
+      } catch (err) {
+        logger.warn({ err, did }, 'Failed to cache Keytrace claims');
+      }
+    }
+
+    return claims;
+  } catch (err) {
+    logger.warn({ err, did }, 'Failed to fetch Keytrace claims from PDS');
+    return [];
+  }
+}
+
+export function matchClaimsToAccounts(
+  claims: KeytraceClaim[],
+  accounts: SifaExternalAccount[],
+): { matched: Map<string, KeytraceClaim>; unmatched: KeytraceClaim[] } {
+  const matched = new Map<string, KeytraceClaim>();
+  const unmatched: KeytraceClaim[] = [];
+
+  for (const claim of claims) {
+    let found = false;
+    const claimNormalized = normalizeUrl(claim.url);
+
+    // Primary: normalized URL match
+    for (const account of accounts) {
+      if (matched.has(account.rkey)) continue;
+      if (normalizeUrl(account.url) === claimNormalized) {
+        matched.set(account.rkey, claim);
+        found = true;
+        break;
+      }
+    }
+
+    // Fallback: platform + username match
+    if (!found) {
+      const claimUsername = extractPlatformUsername(claim.platform, claim.url);
+      if (claimUsername) {
+        for (const account of accounts) {
+          if (matched.has(account.rkey)) continue;
+          if (account.platform.toLowerCase() !== claim.platform.toLowerCase()) continue;
+          const accountUsername = extractPlatformUsername(account.platform, account.url);
+          if (accountUsername && accountUsername.toLowerCase() === claimUsername.toLowerCase()) {
+            matched.set(account.rkey, claim);
+            found = true;
+            break;
+          }
+        }
+      }
+    }
+
+    if (!found) {
+      unmatched.push(claim);
+    }
+  }
+
+  return { matched, unmatched };
+}
+
+export function mergeExternalAccounts(
+  accounts: SifaExternalAccount[],
+  claims: KeytraceClaim[],
+): MergedExternalAccount[] {
+  const { matched, unmatched } = matchClaimsToAccounts(claims, accounts);
+
+  const merged: MergedExternalAccount[] = accounts.map((account) => {
+    const claim = matched.get(account.rkey);
+    return {
+      ...account,
+      source: 'sifa' as const,
+      keytraceVerified: !!claim,
+      ...(claim
+        ? {
+            keytraceClaim: {
+              rkey: claim.rkey,
+              claimedAt: claim.claimedAt,
+            },
+          }
+        : {}),
+    };
+  });
+
+  for (const claim of unmatched) {
+    merged.push({
+      rkey: claim.rkey,
+      platform: claim.platform,
+      url: claim.url,
+      label: null,
+      feedUrl: null,
+      isPrimary: false,
+      verifiable: false,
+      verified: false,
+      verifiedVia: null,
+      source: 'keytrace',
+      keytraceVerified: true,
+      keytraceClaim: {
+        rkey: claim.rkey,
+        claimedAt: claim.claimedAt,
+      },
+    });
+  }
+
+  return merged;
+}

tests/lib/atproto-app-registry.test.ts

···
       expect(result?.id).toBe('roomy');
     });
 
+    it('maps dev.keytrace.claim to keytrace via scanCollections', () => {
+      const result = getAppForCollection('dev.keytrace.claim');
+      expect(result).toBeDefined();
+      expect(result?.id).toBe('keytrace');
+      expect(result?.matchedPrefix).toBe('dev.keytrace');
+    });
+
     it('returns undefined for unknown collections', () => {
       const result = getAppForCollection('com.unknown.something');
       expect(result).toBeUndefined();

tests/lib/url-utils.test.ts

···
+import { describe, expect, it } from 'vitest';
+import { normalizeUrl, extractPlatformUsername } from '../../src/lib/url-utils.js';
+
+describe('url-utils', () => {
+  describe('normalizeUrl', () => {
+    it('strips https protocol', () => {
+      expect(normalizeUrl('https://github.com/gxjansen')).toBe('github.com/gxjansen');
+    });
+
+    it('strips http protocol', () => {
+      expect(normalizeUrl('http://github.com/gxjansen')).toBe('github.com/gxjansen');
+    });
+
+    it('strips trailing slash', () => {
+      expect(normalizeUrl('https://github.com/gxjansen/')).toBe('github.com/gxjansen');
+    });
+
+    it('strips www prefix', () => {
+      expect(normalizeUrl('https://www.linkedin.com/in/gxjansen')).toBe('linkedin.com/in/gxjansen');
+    });
+
+    it('lowercases the URL', () => {
+      expect(normalizeUrl('https://GitHub.COM/GxJansen')).toBe('github.com/gxjansen');
+    });
+
+    it('handles multiple normalizations together', () => {
+      expect(normalizeUrl('HTTP://WWW.GitHub.Com/GxJansen/')).toBe('github.com/gxjansen');
+    });
+
+    it('handles URLs without protocol', () => {
+      expect(normalizeUrl('github.com/gxjansen')).toBe('github.com/gxjansen');
+    });
+
+    it('handles empty string', () => {
+      expect(normalizeUrl('')).toBe('');
+    });
+
+    it('strips multiple trailing slashes', () => {
+      expect(normalizeUrl('https://example.com///')).toBe('example.com');
+    });
+  });
+
+  describe('extractPlatformUsername', () => {
+    it('extracts GitHub username', () => {
+      expect(extractPlatformUsername('github', 'https://github.com/gxjansen')).toBe('gxjansen');
+    });
+
+    it('extracts GitHub username with trailing slash', () => {
+      expect(extractPlatformUsername('github', 'https://github.com/gxjansen/')).toBe('gxjansen');
+    });
+
+    it('extracts LinkedIn username', () => {
+      expect(extractPlatformUsername('linkedin', 'https://www.linkedin.com/in/gxjansen')).toBe(
+        'gxjansen',
+      );
+    });
+
+    it('extracts LinkedIn username with trailing slash', () => {
+      expect(extractPlatformUsername('linkedin', 'https://linkedin.com/in/gxjansen/')).toBe(
+        'gxjansen',
+      );
+    });
+
+    it('extracts Twitter/X username from twitter.com', () => {
+      expect(extractPlatformUsername('twitter', 'https://twitter.com/guido')).toBe('guido');
+    });
+
+    it('extracts Twitter/X username from x.com', () => {
+      expect(extractPlatformUsername('twitter', 'https://x.com/guido')).toBe('guido');
+    });
+
+    it('extracts Instagram username', () => {
+      expect(extractPlatformUsername('instagram', 'https://instagram.com/guido')).toBe('guido');
+    });
+
+    it('extracts YouTube channel ID', () => {
+      expect(extractPlatformUsername('youtube', 'https://youtube.com/channel/UC1234abc')).toBe(
+        'UC1234abc',
+      );
+    });
+
+    it('extracts YouTube custom handle', () => {
+      expect(extractPlatformUsername('youtube', 'https://youtube.com/@guido')).toBe('@guido');
+    });
+
+    it('extracts Fediverse username from URL', () => {
+      expect(extractPlatformUsername('fediverse', 'https://mastodon.social/@guido')).toBe(
+        '@[e-mail]',
+      );
+    });
+
+    it('returns null for unknown platform', () => {
+      expect(extractPlatformUsername('other', 'https://example.com/user')).toBeNull();
+    });
+
+    it('returns null for malformed URL', () => {
+      expect(extractPlatformUsername('github', 'not-a-url')).toBeNull();
+    });
+
+    it('returns null for GitHub URL without username path', () => {
+      expect(extractPlatformUsername('github', 'https://github.com')).toBeNull();
+    });
+
+    it('is case-insensitive for platform matching', () => {
+      expect(extractPlatformUsername('GitHub', 'https://github.com/gxjansen')).toBe('gxjansen');
+    });
+  });
+});

tests/services/keytrace.test.ts

···
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import {
+  fetchKeytraceClaims,
+  matchClaimsToAccounts,
+  mergeExternalAccounts,
+  type KeytraceClaim,
+  type SifaExternalAccount,
+} from '../../src/services/keytrace.js';
+
+const { mockListRecords } = vi.hoisted(() => {
+  const mockListRecords = vi.fn();
+  return { mockListRecords };
+});
+
+vi.mock('@atproto/api', () => ({
+  Agent: class MockAgent {
+    com = {
+      atproto: {
+        repo: {
+          listRecords: mockListRecords,
+        },
+      },
+    };
+  },
+}));
+
+function makeClaim(overrides: Partial<KeytraceClaim> = {}): KeytraceClaim {
+  return {
+    rkey: 'claim1',
+    platform: 'github',
+    url: 'https://github.com/gxjansen',
+    claimedAt: '2026-03-15T00:00:00Z',
+    ...overrides,
+  };
+}
+
+function makeSifaAccount(overrides: Partial<SifaExternalAccount> = {}): SifaExternalAccount {
+  return {
+    rkey: 'acc1',
+    platform: 'github',
+    url: 'https://github.com/gxjansen',
+    label: null,
+    feedUrl: null,
+    isPrimary: false,
+    verified: false,
+    verifiedVia: null,
+    verifiable: true,
+    ...overrides,
+  };
+}
+
+describe('keytrace', () => {
+  describe('fetchKeytraceClaims', () => {
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    it('returns cached claims when available', async () => {
+      const mockValkey = {
+        get: vi.fn().mockResolvedValue(JSON.stringify([makeClaim()])),
+        setex: vi.fn(),
+      };
+
+      const claims = await fetchKeytraceClaims(
+        'did:plc:test',
+        'pds.example.com',
+        mockValkey as never,
+      );
+      expect(claims).toHaveLength(1);
+      expect(claims[0]?.platform).toBe('github');
+      expect(mockValkey.get).toHaveBeenCalledWith('keytrace:claims:did:plc:test');
+    });
+
+    it('returns empty array when PDS fetch fails', async () => {
+      mockListRecords.mockRejectedValueOnce(new Error('PDS down'));
+
+      const mockValkey = {
+        get: vi.fn().mockResolvedValue(null),
+        setex: vi.fn(),
+      };
+
+      const claims = await fetchKeytraceClaims(
+        'did:plc:test',
+        'pds.example.com',
+        mockValkey as never,
+      );
+      expect(claims).toEqual([]);
+    });
+
+    it('returns empty array when valkey is null', async () => {
+      mockListRecords.mockResolvedValueOnce({
+        data: {
+          records: [
+            {
+              uri: 'at://did:plc:test/dev.keytrace.claim/abc123',
+              value: {
+                url: 'https://github.com/gxjansen',
+                platform: 'github',
+                createdAt: '2026-03-15T00:00:00Z',
+              },
+            },
+          ],
+        },
+      });
+
+      const claims = await fetchKeytraceClaims('did:plc:test', 'pds.example.com', null);
+      expect(claims).toHaveLength(1);
+      expect(claims[0]?.platform).toBe('github');
+    });
+
+    it('caches fetched claims in valkey with 2h TTL', async () => {
+      mockListRecords.mockResolvedValueOnce({
+        data: {
+          records: [
+            {
+              uri: 'at://did:plc:test/dev.keytrace.claim/abc123',
+              value: {
+                url: 'https://github.com/gxjansen',
+                platform: 'github',
+                createdAt: '2026-03-15T00:00:00Z',
+              },
+            },
+          ],
+        },
+      });
+
+      const mockValkey = {
+        get: vi.fn().mockResolvedValue(null),
+        setex: vi.fn(),
+      };
+
+      await fetchKeytraceClaims('did:plc:test', 'pds.example.com', mockValkey as never);
+      expect(mockValkey.setex).toHaveBeenCalledWith(
+        'keytrace:claims:did:plc:test',
+        7200,
+        expect.any(String),
+      );
+    });
+
+    it('skips malformed records', async () => {
+      mockListRecords.mockResolvedValueOnce({
+        data: {
+          records: [
+            {
+              uri: 'at://did:plc:test/dev.keytrace.claim/good',
+              value: {
+                url: 'https://github.com/gxjansen',
+                platform: 'github',
+                createdAt: '2026-03-15T00:00:00Z',
+              },
+            },
+            {
+              uri: 'at://did:plc:test/dev.keytrace.claim/bad',
+              value: {
+                // missing url and platform
+                createdAt: '2026-03-15T00:00:00Z',
+              },
+            },
+          ],
+        },
+      });
+
+      const claims = await fetchKeytraceClaims('did:plc:test', 'pds.example.com', null);
+      expect(claims).toHaveLength(1);
+    });
+  });
+
+  describe('matchClaimsToAccounts', () => {
+    it('matches by exact normalized URL', () => {
+      const claims = [makeClaim({ url: 'https://github.com/gxjansen/' })];
+      const accounts = [makeSifaAccount({ url: 'https://github.com/gxjansen' })];
+
+      const result = matchClaimsToAccounts(claims, accounts);
+      expect(result.matched.size).toBe(1);
+      expect(result.matched.get('acc1')?.rkey).toBe('claim1');
+      expect(result.unmatched).toHaveLength(0);
+    });
+
+    it('matches by platform + username fallback', () => {
+      const claims = [makeClaim({ url: 'https://github.com/gxjansen' })];
+      const accounts = [
+        makeSifaAccount({ url: 'https://www.github.com/gxjansen/repos', rkey: 'acc1' }),
+      ];
+
+      const result = matchClaimsToAccounts(claims, accounts);
+      expect(result.matched.size).toBe(1);
+    });
+
+    it('returns unmatched claims when no Sifa account matches', () => {
+      const claims = [makeClaim({ platform: 'twitter', url: 'https://x.com/guido' })];
+      const accounts = [makeSifaAccount({ platform: 'github', url: 'https://github.com/other' })];
+
+      const result = matchClaimsToAccounts(claims, accounts);
+      expect(result.matched.size).toBe(0);
+      expect(result.unmatched).toHaveLength(1);
+    });
+
+    it('handles empty claims array', () => {
+      const result = matchClaimsToAccounts([], [makeSifaAccount()]);
+      expect(result.matched.size).toBe(0);
+      expect(result.unmatched).toHaveLength(0);
+    });
+
+    it('handles empty accounts array', () => {
+      const claims = [makeClaim()];
+      const result = matchClaimsToAccounts(claims, []);
+      expect(result.matched.size).toBe(0);
+      expect(result.unmatched).toHaveLength(1);
+    });
+  });
+
+  describe('mergeExternalAccounts', () => {
+    it('marks matched Sifa accounts as keytrace-verified', () => {
+      const accounts = [makeSifaAccount()];
+      const claims = [makeClaim()];
+
+      const result = mergeExternalAccounts(accounts, claims);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.source).toBe('sifa');
+      expect(result[0]?.keytraceVerified).toBe(true);
+      expect(result[0]?.keytraceClaim).toBeDefined();
+      expect(result[0]?.keytraceClaim?.rkey).toBe('claim1');
+    });
+
+    it('leaves unmatched Sifa accounts unchanged', () => {
+      const accounts = [
+        makeSifaAccount({ platform: 'linkedin', url: 'https://linkedin.com/in/gxjansen' }),
+      ];
+      const claims = [makeClaim({ platform: 'github', url: 'https://github.com/gxjansen' })];
+
+      const result = mergeExternalAccounts(accounts, claims);
+      const sifaEntry = result.find((r) => r.source === 'sifa');
+      const keytraceEntry = result.find((r) => r.source === 'keytrace');
+
+      expect(sifaEntry?.keytraceVerified).toBe(false);
+      expect(keytraceEntry?.keytraceVerified).toBe(true);
+    });
+
+    it('appends unmatched Keytrace claims as keytrace-source entries', () => {
+      const accounts: SifaExternalAccount[] = [];
+      const claims = [makeClaim()];
+
+      const result = mergeExternalAccounts(accounts, claims);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.source).toBe('keytrace');
+      expect(result[0]?.keytraceVerified).toBe(true);
+      expect(result[0]?.platform).toBe('github');
+      expect(result[0]?.isPrimary).toBe(false);
+      expect(result[0]?.verified).toBe(false);
+      expect(result[0]?.verifiedVia).toBeNull();
+    });
+
+    it('returns only Sifa accounts when claims is empty', () => {
+      const accounts = [makeSifaAccount()];
+
+      const result = mergeExternalAccounts(accounts, []);
+      expect(result).toHaveLength(1);
+      expect(result[0]?.source).toBe('sifa');
+      expect(result[0]?.keytraceVerified).toBe(false);
+    });
+
+    it('returns empty array when both are empty', () => {
+      const result = mergeExternalAccounts([], []);
+      expect(result).toEqual([]);
+    });
+  });
+});