fix(link-legacy-key): validate response with Zod and add fetch timeout

[matmilbury]

Summary

Addresses two issues from code review of #1:

• Replace as LinkResult cast with Zod schema parsing — res.json() returns external data from mcp-gateway. Casting with as bypasses runtime validation; if the response shape drifts, the code silently takes the wrong branch. Now uses LinkResultSchema.parse() which throws a clear error on malformed responses.
• Add AbortSignal.timeout(10s) to the fetch call — Without a timeout, a misbehaving mcp-gateway (accepts TCP, never responds) hangs eterna login indefinitely. The 10s timeout ensures the CLI falls through to the existing warning path.

Also adds zod as a production dependency and creates src/auth/validation.ts for the schema (per CLAUDE.md: "Define schemas in validation.ts").

Test plan

• Run eterna login with ETERNA_MCP_KEY set — verify link succeeds and prints "Legacy account linked"
• Run eterna login with ETERNA_MCP_KEY set against a non-JSON-returning endpoint — verify Zod parse error is caught gracefully
• Run eterna login with ETERNA_MCP_URL pointing to a blackhole (accepts TCP, never responds) — verify timeout after ~10s with warning message
• npm run typecheck passes
• npm run build passes

🤖 Generated with Claude Code

[matmilbury]

Code review

Found 1 issue:

1. LinkResultSchema.parse() can throw an unhandled ZodError when the server returns an unexpected response shape. Every other failure path in linkLegacyKey (network error, HTTP 409, other HTTP errors) uses console.warn and returns cleanly — the function was designed to never throw. The .parse() call on line 38 is outside the try/catch block (which only wraps fetch), so a ZodError propagates to the caller in login.ts, where it is caught by the outer try/catch that calls stopSpinner(false, "Authentication failed") and sets process.exitCode = 1 — even though OAuth login already succeeded and tokens were saved. Wrap the parse in a try/catch consistent with the existing pattern, or use .safeParse() instead.

eterna-cli/src/auth/link-legacy-key.ts

Lines 29 to 42 in ee8dd24

	});
	} catch {
	console.warn(
	"Warning: Could not reach mcp-gateway to link legacy key — your existing Bybit subaccount may not be preserved.",
	);
	return;
	}
	if (res.ok) {
	const data = LinkResultSchema.parse(await res.json());
	if (data.linked) {
	console.log(
	`✓ Legacy account linked — existing Bybit subaccount preserved`,
	);

Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}