Replace the rewind_output stub with a real, view-only implementation:
- src/rewind.rs: derive the v3 rewind nonce (keyed BLAKE2b over the
commitment) and rewind the Bulletproof via upstream grin_secp256k1zkp,
then parse the 20-byte proof message into the authoritative key_id +
value. Faithful minimal port of grin-ext's cross-validated crypto; no
private key is ever involved. v3-only (legacy needs the master secret,
same limit as grin-wallet's view-only scan); paths are advisory.
- src/grin.rs: wire rewind_output with hostile-input-safe hex decoding.
- Cargo.toml: depend on upstream grin_secp256k1zkp + blake2 (not the
vendored fork — the server target needs no wasm patch).
- Golden-vector tests generated by grin's OWN reference ProofBuilder
(depth-3 Grim + depth-4 Smirk [0,0,n,0]); proves byte-compatibility
with the published secp crate. Passed an adversarial money-safety
review (no false-positive/negative, panic-safe).
Make the scaffold standalone and publish-ready:
- Rewrite code + README references to the originating backend as a generic
"wallet backend" so the service reads as a reusable, run-anywhere LWS.
- Add the MIT LICENSE file (matches Cargo.toml) and a short provenance note.
- Add repository/readme/keywords/categories metadata to Cargo.toml.
A standalone, self-hostable Grin light-wallet-server mirroring the Monero LWS:
register a view/rewind credential, run a background chain scanner, rewind outputs
against registered keys, store per-account matches in a DB, and serve balance /
outputs / broadcast / height fast (vs the current on-demand stateless scan proxy).
This is the scaffold — README (architecture + HTTP surface + DB schema + how a
wallet backend proxies to it), Cargo skeleton, migrations sketch, and route/scanner
stubs. Public-clean: no operator-specific infra, hosts, or secrets.
jwinterm