feat: add superstruct.sensitive

[ccharly]

Adding a new superstruct "decorator" to mark a field as "sensitive" this way, it never gets logged by mistake in superstruct error messages.

Requires:

• feat: add sensitive struct superstruct#41

---

Note

Medium Risk
Changes how private-key material appears in validation errors (security-sensitive), but behavior is narrowly scoped to struct validation/redaction with explicit tests and no export signing logic changes.

Overview
Adopts @metamask/superstruct 3.4.0 and wraps privateKey in PrivateKeyExportedAccountStruct with sensitive(string()), so failed assert / validation on export-account payloads redacts the key (e.g. ***) in error messages and failure branches instead of echoing the raw value.

The same superstruct bump is applied across keyring workspace packages (lockfile included). New unit tests in private-key.test.ts cover valid payloads, invalid privateKey, and sibling-field failures where the key must not appear in StructError output.

^{Reviewed by Cursor Bugbot for commit 2ddcfbc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ccharly]

Since it's marked as sensitive AND that we use our object struct, this field will never be display in validation/error messages from superstruct.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​superstruct@​3.3.0 ⏵ 3.4.0	+1			+4

View full report

[hmalik88]

Suggested change

	- This make sure the private key value is always redacted in case of validation errors.
	- This ensures the private key value is always redacted in case of validation errors.

[hmalik88]

Can we also add sensitive to the privateKey field in CreateAccountPrivateKeyOptionsStruct:

accounts/packages/keyring-api/src/v2/api/create-account/private-key.ts

Line 18 in ae48896

privateKey: string(),