feat(wasm-utxo): enable Rust lints and fix clippy warnings

Add Rust linting configuration to check for unexpected cfg conditions
from dependencies. Fix multiple clippy warnings including:

- Replace map().unwrap_or(false) with simpler expressions
- Use *cached instead of clone() for XpubTriple
- Use x_only_public_key() instead of to_inner()
- Simplify control flow with div_ceil() and find()
- Avoid unnecessary cloning with tap_script_sigs.insert(*key, *sig)
- Add #[allow(clippy::too_many_arguments)] where appropriate

Issue: BTC-2650

Co-authored-by: llm-git <llm-git@ttll.de>

Author: OttoAllmendinger

packages/wasm-utxo/Cargo.toml

@@ -13,6 +13,13 @@ crate-type = ["cdylib", "rlib"]
 [lints.clippy]
 all = "warn"
 
+[lints.rust]
+# These cfg conditions come from the zebra-chain dependency
+unexpected_cfgs = { level = "warn", check-cfg = [
+    'cfg(zcash_unstable, values("zfuture"))',
+    'cfg(feature, values("zebra-test"))',
+] }
+
 [dependencies]
 wasm-bindgen = "0.2"
 js-sys = "0.3"

packages/wasm-utxo/src/bip322/bitgo_psbt.rs

@@ -182,8 +182,7 @@ pub fn add_bip322_input(
                 // Key path spending (MuSig2 with user/bitgo)
                 let internal_key = script.spend_info.internal_key();
                 inner_psbt.inputs[input_index].tap_internal_key = Some(internal_key);
-                inner_psbt.inputs[input_index].tap_merkle_root =
-                    script.spend_info.merkle_root().map(Into::into);
+                inner_psbt.inputs[input_index].tap_merkle_root = script.spend_info.merkle_root();
                 inner_psbt.inputs[input_index].tap_key_origins = create_tap_bip32_derivation(
                     wallet_keys,
                     chain,
@@ -209,6 +208,7 @@ pub fn add_bip322_input(
 /// * `wallet_keys` - The wallet's root keys
 /// * `network` - The network
 /// * `tag` - Optional custom tag for message hashing
+#[allow(clippy::too_many_arguments)]
 pub fn verify_bip322_tx_input(
     tx: &Transaction,
     input_index: usize,

packages/wasm-utxo/src/fixed_script_wallet/bitgo_psbt/mod.rs

@@ -1986,7 +1986,7 @@ impl BitGoPsbt {
 
         // Copy tap_script_sigs (Taproot script path signatures)
         for (key, sig) in &cloned_input.tap_script_sigs {
-            target_input.tap_script_sigs.insert(key.clone(), *sig);
+            target_input.tap_script_sigs.insert(*key, *sig);
         }
 
         // Copy tap_key_sig (Taproot key path signature)
@@ -2106,7 +2106,7 @@ impl BitGoPsbt {
                             .psbt()
                             .inputs
                             .get(**input_index)
-                            .map(|input| p2tr_musig2_input::Musig2Input::is_musig2_input(input))
+                            .map(p2tr_musig2_input::Musig2Input::is_musig2_input)
                             .unwrap_or(false);
 
                         // Don't report "key not found" errors - those are normal for inputs
@@ -2205,7 +2205,7 @@ impl BitGoPsbt {
 
         // Copy tap_script_sigs (Taproot script path signatures)
         for (key, sig) in &cloned_input.tap_script_sigs {
-            target_input.tap_script_sigs.insert(key.clone(), *sig);
+            target_input.tap_script_sigs.insert(*key, *sig);
         }
 
         // Copy tap_key_sig (Taproot key path signature)
@@ -2485,6 +2485,7 @@ impl BitGoPsbt {
     /// # Returns
     /// - `Ok(EcdsaSignature)` containing the signature and sighash type
     /// - `Err(String)` if sighash computation fails
+    #[allow(clippy::too_many_arguments)]
     fn sign_p2sh_p2pk_input_zcash<C: secp256k1::Signing>(
         psbt: &Psbt,
         input_index: usize,
@@ -2621,7 +2622,7 @@ impl BitGoPsbt {
                     input_index,
                     redeem_script,
                     value,
-                    ecdsa_sig.sighash_type as u32,
+                    ecdsa_sig.sighash_type,
                     branch_id,
                     version_group_id,
                     expiry_height,
@@ -2645,7 +2646,7 @@ impl BitGoPsbt {
                     input_index,
                     redeem_script,
                     value,
-                    ecdsa_sig.sighash_type as u32,
+                    ecdsa_sig.sighash_type,
                     Some(fork_id),
                 )
                 .map_err(|e| format!("Failed to compute FORKID sighash: {}", e))?;
@@ -3816,7 +3817,7 @@ mod tests {
         let psbt = bitgo_psbt.psbt();
         let has_matching_input = psbt.inputs.iter().any(|input| {
             // Check if this input matches the script type we're testing
-            if let Some(ref witness_script) = input.witness_script {
+            if let Some(ref _witness_script) = input.witness_script {
                 // p2wsh or p2shP2wsh
                 if input.redeem_script.is_some() {
                     matches!(script_type, fixtures::ScriptType::P2shP2wsh)

packages/wasm-utxo/src/fixed_script_wallet/bitgo_psbt/p2tr_musig2_input_utxolib.rs

@@ -393,7 +393,7 @@ fn create_musig2_deterministic_nonce(
     let secp = secp256k1::Secp256k1::new();
     let (tweaked_key, _parity): (crate::bitcoin::key::TweakedPublicKey, Parity) =
         internal_pub_key.tap_tweak(&secp, Some(*tap_tree_root));
-    let tap_output_key = tweaked_key.to_inner().serialize();
+    let tap_output_key = tweaked_key.to_x_only_public_key().serialize();
 
     // Serialize aggregate other nonce
     let agg_other_nonce_bytes = agg_other_nonce.serialize();

packages/wasm-utxo/src/fixed_script_wallet/wallet_keys.rs

@@ -102,7 +102,7 @@ impl RootWalletKeys {
         {
             let cache = self.derivation_cache.borrow();
             if let Some(cached) = cache.get(&cache_key) {
-                return Ok(cached.clone());
+                return Ok(*cached);
             }
         }
 
@@ -128,7 +128,7 @@ impl RootWalletKeys {
             if cache.len() >= DERIVATION_CACHE_MAX_SIZE {
                 cache.clear();
             }
-            cache.insert(cache_key, derived.clone());
+            cache.insert(cache_key, derived);
         }
 
         Ok(derived)

packages/wasm-utxo/src/inscriptions/envelope.rs

@@ -82,7 +82,6 @@ pub fn build_inscription_script(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use miniscript::bitcoin::hashes::Hash;
     use miniscript::bitcoin::secp256k1::{Secp256k1, SecretKey};
     use miniscript::bitcoin::XOnlyPublicKey;
 

packages/wasm-utxo/src/inscriptions/reveal.rs

@@ -97,7 +97,7 @@ pub fn create_inscription_reveal_data(
         output_script: output_script.to_bytes(),
         reveal_transaction_vsize: reveal_vsize,
         tap_leaf_script: TapLeafScript {
-            leaf_version: LeafVersion::TapScript.to_consensus() as u8,
+            leaf_version: LeafVersion::TapScript.to_consensus(),
             script: script.to_bytes(),
             control_block: control_block.serialize(),
         },
@@ -238,7 +238,7 @@ fn estimate_reveal_vsize(script: &ScriptBuf, control_block: &ControlBlock) -> us
     let total_weight = base_weight + segwit_overhead + witness_weight;
 
     // Virtual size = ceil(weight / 4)
-    (total_weight + 3) / 4
+    total_weight.div_ceil(4)
 }
 
 #[cfg(test)]

packages/wasm-utxo/src/wasm/bip322.rs

@@ -46,6 +46,7 @@ impl Bip322Namespace {
     /// # Returns
     /// The index of the added input
     #[wasm_bindgen]
+    #[allow(clippy::too_many_arguments)]
     pub fn add_bip322_input(
         psbt: &mut super::fixed_script_wallet::BitGoPsbt,
         message: &str,
@@ -97,6 +98,7 @@ impl Bip322Namespace {
     /// # Throws
     /// Throws an error if verification fails
     #[wasm_bindgen]
+    #[allow(clippy::too_many_arguments)]
     pub fn verify_bip322_tx_input(
         tx: &super::transaction::WasmTransaction,
         input_index: u32,

packages/wasm-utxo/src/zcash/mod.rs

@@ -123,12 +123,11 @@ impl NetworkUpgrade {
 /// Returns `None` if the height is before Overwinter activation.
 pub fn network_upgrade_at_height(height: u32, is_mainnet: bool) -> Option<NetworkUpgrade> {
     // Iterate in reverse chronological order
-    for &upgrade in NetworkUpgrade::ALL.iter().rev() {
-        if height >= upgrade.activation_height(is_mainnet) {
-            return Some(upgrade);
-        }
-    }
-    None
+    NetworkUpgrade::ALL
+        .iter()
+        .rev()
+        .find(|&&upgrade| height >= upgrade.activation_height(is_mainnet))
+        .copied()
 }
 
 /// Get the consensus branch ID for a given block height
@@ -197,9 +196,9 @@ mod tests {
                 ZebraNetworkUpgrade::Nu6 => Some(NetworkUpgrade::Nu6),
                 ZebraNetworkUpgrade::Nu6_1 => Some(NetworkUpgrade::Nu6_1),
                 #[cfg(any(test, feature = "zebra-test"))]
-                ZebraNetworkUpgrade::Nu7 => None, // Not yet in production
+                ZebraNetworkUpgrade::Nu7 => None,
                 #[cfg(zcash_unstable = "zfuture")]
-                ZebraNetworkUpgrade::ZFuture => None, // Test-only
+                ZebraNetworkUpgrade::ZFuture => None,
             }
         }
 
@@ -222,10 +221,12 @@ mod tests {
                     continue;
                 }
 
-                let our_upgrade = from_zebra_upgrade(zebra_upgrade).expect(&format!(
-                    "Missing mapping for zebra upgrade {:?}. Add it to NetworkUpgrade enum!",
-                    zebra_upgrade
-                ));
+                let our_upgrade = from_zebra_upgrade(zebra_upgrade).unwrap_or_else(|| {
+                    panic!(
+                        "Missing mapping for zebra upgrade {:?}. Add it to NetworkUpgrade enum!",
+                        zebra_upgrade
+                    )
+                });
 
                 // Verify round-trip
                 assert_eq!(
@@ -253,7 +254,7 @@ mod tests {
                 let zebra_upgrade = to_zebra_upgrade(upgrade);
                 let expected = zebra_upgrade
                     .branch_id()
-                    .map(|b| u32::from(b))
+                    .map(u32::from)
                     .expect("upgrade should have branch_id");
 
                 assert_eq!(