better private key error handling

Author: ftheirs

src/helpers/accounts.ts

@@ -12,11 +12,11 @@ export type DerivedAccount = Readonly<{
   account: HDAccount;
   derivation: DerivationInfo;
   /**
-   * Derived private key (hex, 0x-prefixed) if available.
+   * Derived private key (hex, 0x-prefixed).
    *
    * IMPORTANT: Never log this unless explicitly gated by config.
    */
-  privateKey?: Hex;
+  privateKey: Hex;
 }>;
 
 export function derivePath(index: number): `m/44'/60'/${string}` {
@@ -45,18 +45,17 @@ export function deriveAccountFromMnemonic(
       ? toHex(hdKey.privateKey)
       : undefined;
 
-  const base: {
-    account: HDAccount;
-    derivation: DerivationInfo;
-    privateKey?: Hex;
-  } = {
+  if (!privateKey) {
+    // Sanity check: `mnemonicToAccount(...).getHdKey()` should normally yield a private key
+    // for a valid mnemonic + derivation path. If this happens, something is unexpectedly
+    // wrong (or the underlying library behavior changed), and callers cannot proceed
+    // because they always require a signer.
+    throw new Error("Derived account has no privateKey available");
+  }
+
+  return {
     account,
     derivation: { index, path },
+    privateKey,
   };
-
-  if (privateKey) {
-    base.privateKey = privateKey;
-  }
-
-  return base;
 }

src/processors/account-derive.ts

@@ -102,9 +102,6 @@ export async function deriveAccount(
     cacheAccountIndex(scenarioVars, selection);
 
     const derived = deriveAccountFromMnemonic(mnemonic, selection.index);
-    if (!derived.privateKey) {
-      throw new Error("Derived account has no privateKey available");
-    }
 
     persistVars(context, {
       privateKey: derived.privateKey,

src/processors/siwe-bootstrap.ts

@@ -46,26 +46,15 @@ export async function deriveAndPrint(
 
     const printPk = readBoolEnv("PRINT_DERIVED_PRIVATE_KEY");
     if (printPk) {
-      if (!derived.privateKey) {
-        logger.warn(
-          {
-            index: selection.index,
-            path: derived.derivation.path,
-            address: derived.account.address,
-          },
-          "derived account has no privateKey available to print"
-        );
-      } else {
-        logger.info(
-          {
-            index: selection.index,
-            path: derived.derivation.path,
-            address: derived.account.address,
-            privateKey: derived.privateKey,
-          },
-          "derived account (PRINT_DERIVED_PRIVATE_KEY enabled)"
-        );
-      }
+      logger.info(
+        {
+          index: selection.index,
+          path: derived.derivation.path,
+          address: derived.account.address,
+          privateKey: derived.privateKey,
+        },
+        "derived account (PRINT_DERIVED_PRIVATE_KEY enabled)"
+      );
     } else {
       logger.info(
         {