PR #4 Empty Configuration Review Findings

Initial Debt

Codex PR review found two empty-value robustness issues:

• Blank punks auth login --token "" or whitespace token values were stored as successful credentials even though they cannot authenticate backend calls.
• Empty DP_BASELINE_* environment values were treated as configured baseline registry metadata and could produce blank artifact URLs or checksums.

Resolution

• Normalize local-development bearer tokens by trimming whitespace and treating empty values as missing.
• Normalize required and optional baseline registry environment values by trimming whitespace and treating empty values as unconfigured.
• Added direct CLI token normalization and API baseline registry empty-env tests.

Validation

• bun run test --filter=@punks/cli --filter=@punks/api: passed @punks/cli 78 tests and @punks/api 9 tests.
• bun run check-types --filter=@punks/cli --filter=@punks/api: passed 6 tasks.
• bun run check: passed.
• git diff --check: passed.
• bun run build --filter=@punks/cli: passed.
• Built CLI auth login --help: passed.
• Built CLI auth login --token "": failed with the intended non-empty token error and did not store credentials.