feat(feeds): OFAC SDN sanctioned crypto-address feed

[rinjanianalytics]

What

Adds the OFAC SDN sanctioned cryptocurrency address feed — the #1 free, authoritative on-chain source we agreed to build. Every digital-currency address on the US Treasury OFAC SDN list is ground-truth "this wallet belongs to a sanctioned entity." It's the attribution signal we'd otherwise pay Arkham for (~$1K/yr post-trial) — but free and structured.

Why a custom connector

The crypto addresses live only in sdn.xml (the CSV export drops the <idList> digital-currency entries), and the declarative feed-engine is JSON/CSV/text-only. So this is a hand-written connector parsing XML via fast-xml-parser, matching the existing apps/worker/src/feeds/* pattern.

Dual sink (one pass)

Sink	Shape	Purpose
iocs	type=crypto-address, tags [ofac, sanctioned, ofac-sdn, <chain>, ofac:<program>], confidence 100	Surfaces in the Feeds Landscape shift tag band + Indicators + graph
wallets	entityType=sanctioned, confidence 100, attributionSource=ofac	The free on-chain attribution layer (Arkham stand-in)

iocs.type is a plain text column, so crypto-address needs no migration. Both upserts are idempotent (iocs.value / wallets.ref_id).

Wiring

• apps/worker/src/feeds/ofac.ts — connector (syncOFAC / runOFACSync)
• additionalFeeds.ts → feedRegistry.ts (ofac key)
• scheduler.ts JOB_REGISTRY — daily 03:00 UTC (OFAC only republishes on designation actions; daily is ample)
• OFAC_SDN_XML_URL env override for testing

Verification

• tsc --noEmit clean on worker, api, and gateway (strict CI gate)
• Extraction smoke-tested against a realistic multi-entry SDN sample: multi-program entity yields all its addresses, no-crypto entries are skipped, non-crypto IDs (email) excluded, XBT→btc chain mapping correct

Notes

• First run can be triggered ad-hoc via Admin → Schedules → ofacSync → Run now, or it picks up at the next 03:00 UTC tick.
• AI Incident Database (feat: OAuth + LLM enrichment + bootlock + filter/indexing fixes #2) + community scam-address feeds (Backend production hardening — slices 1-6, OSV migration, Nexus removal #3) remain as the next free sources; telco stays on the ingest-PDF report path (no free telco feed exists).

🤖 Generated with Claude Code