[IAmJSD]

Part 4 of 7 in the bank stack, on #26.

What this adds

Each crypto "card" is a fresh wallet funded from the server's treasury with exactly the card's limit, so the limit holds on chain. Killing the card sweeps what's left back to the treasury. A wallet's key is derived from the treasury key and the card's id, so none is stored, and a restarted container can be given its key again.

• Bitcoin (@nibblet/bank-bitcoin):
  • Native segwit, signed with @scure/btc-signer; reads and broadcasts through an Esplora API (mempool.space by default).
  • BITCOIN_TREASURY_KEY and an explicit BITCOIN_NETWORK, with no default, so a test key never lands on mainnet. Optional BITCOIN_ESPLORA_URL and BITCOIN_FEE_RATE.
  • Minimum card is 5,000 sats.
• Ethereum (@nibblet/bank-ethereum):
  • Plain transfers through viem to ETHEREUM_RPC_URL. Optional ETHEREUM_CHAIN_ID, checked before anything is sent, and ETHEREUM_ASSET for another EVM chain's coin.
  • Gas comes out of the card's balance.
• Settling: a wallet whose funding isn't visible yet reports settled: false instead of sweeping nothing and writing the money off. The server keeps it closing and tries again.
• Shared logic added to the plugin base: a one-at-a-time queue for treasury sends (no two cards picking the same coins or nonce), and how a wallet's spending is counted.

#31 (part 6) moves these settings into a form in Settings → Bank; the environment stays as a fallback.

Limits worth knowing

• A nibblet holds its wallet's key, so a crypto card's whole limit should be treated as given away. If the nibblet copies the key, it can race the sweep.
• Chains with an L1 data fee (Base, Optimism) aren't supported yet. The sweep pays exactly 21,000 gas, so it would fail there.

Screenshots

From #28's UI, in the mock server (?mock=1): the Bitcoin bank with its treasury balance, and two wallet cards. The second has been killed and is waiting for its funding to show before it sweeps.

Review fixes

• Only a 4xx from Esplora counts as a refused broadcast. A 5xx can come after the transaction was relayed, so it's now an unclear failure: the card stays pending and is looked for, instead of being forgotten with a funded wallet.

Checks

pnpm format:check, pnpm -r typecheck and pnpm test pass on this branch on its own. Bitcoin tests sign and apply real transactions against an in-memory Esplora; an Ethereum test checks a real viem-signed transfer.

---

Generated by Claude Code