Add coin_ids to send_xch, send_cat, cancel_offer and cancel_offers

[awizardxch]

Closes #780 (priorities 1 and 2: the cancel and send endpoints).

Builds on #894. cancel_offers here relies on #894 building the whole batch as one spend, so the first commit in this branch is #894's. Once #894 merges, only the second commit remains.

What

An optional coin_ids: Option<Vec<String>> on SendXch, SendCat, CancelOffer and CancelOffers, wired the same way MakeOffer.coin_ids is. Chosen coins are spent first, and coin selection only adds what they don't cover. When the field is left out, behavior is unchanged.

• send_xch: XCH coins for the amount and the fee.
• send_cat: coins of that CAT for the amount, and XCH coins for the fee.
• cancel_offer / cancel_offers: XCH coins for the fee, spent beside the offers' own coins (all in one spend, see cancel_offers: build the batch as one spend so no fee coin is picked twice #894).

A market maker can now give every concurrent cancel or send its own fee coin. Without that, the selector picks the same fee coin for two transactions, or uses a large trading coin for a tiny fee and breaks a prepared coin layout. Those are the two failures in #780.

Security: chosen coins must be selectable

prepare_spends_for_selection looks a chosen coin up in wallet_coins. That table also holds coins that are spent, in the mempool, or locked in an open offer. Taking caller ids as-is would let a send spend the coin behind one of the wallet's own open offers, which silently cancels that offer, or pull an NFT or DID coin into a fee.

So each requested id has to pass a check at the RPC boundary, selectable_coin_ids in crates/sage/src/utils/coin_selection.rs:

• it must be in the same set automatic selection draws from (selectable_xch_coins / selectable_cat_coins): the wallet's own coins that are confirmed, unspent, not in the mempool and not locked in an offer;
• it must be a kind the transaction spends: XCH, or coins of the CAT being sent. NFT, DID and option coins, and other CATs, are never accepted.

Anything else is refused with a new CoinNotSelectable error (an API error, HTTP 400) instead of being spent. Duplicate ids are de-duplicated.

The check reuses existing queries, so no new sqlx query or .sqlx entry is needed. The app bridge's send_xch keeps automatic selection (coin_ids: None), so in-wallet apps don't get coin choice.

Wallet API

Wallet::send_xch_with_coins and Wallet::send_cat_with_coins take the chosen coins. send_xch and send_cat call them with none, so existing callers are untouched. Wallet::cancel_offers gains a fee_coin_ids argument.

Tests

sage-rpc test_send_xch_with_coin_ids runs through the real router:

• a chosen coin is spent (400 to self, 600 change);
• an unknown coin id and an already-spent coin are refused with CoinNotSelectable;
• a coin locked in an open offer (made via make_offer with auto_import) is refused, and the free coin still sends.

With the selectability check disabled, this test fails.

Also run: cargo test -p sage-wallet 50 passed, cargo test -p sage-rpc test_send_xch 2 passed, cargo clippy --workspace --all-targets and cargo fmt --check clean. src/bindings.ts is updated by hand in the generator's format (coin_ids?: string[] | null).

Not in this PR: #780's priority 3 (fee coin choice for split/combine).

🤖 Generated with Claude Code