chore: format markdown

Signed-off-by: Dmytro Stanchiev <git@dmytros.dev>

docs/superpowers/specs/2026-04-21-cookie-env-only-design.md

@@ -3,7 +3,9 @@
 ## Summary
 
 Remove all file-based and request-provided cookie inputs across the repo.
-The only supported authentication input becomes a raw `Cookie` header string supplied through scraper-specific environment variables such as `FACEBOOK_COOKIE` and `EBAY_COOKIE`.
+The only supported authentication input becomes a raw `Cookie` header string supplied
+through scraper-specific environment variables such as `FACEBOOK_COOKIE` and
+`EBAY_COOKIE`.
 
 ## Goals
 
@@ -17,7 +19,8 @@ The only supported authentication input becomes a raw `Cookie` header string sup
 
 - Changing scraper behavior unrelated to authentication input.
 - Adding new cookie formats or migration helpers.
-- Preserving backward compatibility for cookie files, JSON cookie arrays, or request overrides.
+- Preserving backward compatibility for cookie files, JSON cookie arrays, or request
+  overrides.
 
 ## Current State
 
@@ -27,27 +30,33 @@ The current shared cookie utilities support three sources in priority order:
 2. Environment variable
 3. Cookie file
 
-`packages/core/src/utils/cookies.ts` includes file loading, JSON array parsing, and auto-detection between JSON and header-string formats.
-Facebook also exposes deprecated `cookiePath` arguments that still reach shared loading logic.
-Docs in `cookies/AGENTS.md` still describe file-based setup and request-level overrides.
+`packages/core/src/utils/cookies.ts` includes file loading, JSON array parsing, and
+auto-detection between JSON and header-string formats.
+Facebook also exposes deprecated `cookiePath` arguments that still reach shared loading
+logic. Docs in `cookies/AGENTS.md` still describe file-based setup and request-level
+overrides.
 
 ## Chosen Approach
 
 Use the hard-reset approach.
-Delete the shared multi-source cookie-loading model and reduce the cookie surface to env-header parsing only.
-This is a larger diff than a surgical removal, but it avoids leaving behind abstractions that imply unsupported inputs still exist.
+Delete the shared multi-source cookie-loading model and reduce the cookie surface to
+env-header parsing only.
+This is a larger diff than a surgical removal, but it avoids leaving behind abstractions
+that imply unsupported inputs still exist.
 
 ## Design
 
 ### Shared Cookie Utilities
 
-`packages/core/src/utils/cookies.ts` will keep only the pieces needed for env-header-based auth:
+`packages/core/src/utils/cookies.ts` will keep only the pieces needed for
+env-header-based auth:
 
 - `Cookie` type
 - A reduced cookie config shape containing only `name`, `domain`, and `envVar`
 - `parseCookieString()` for raw `Cookie` header strings
 - `formatCookiesForHeader()` for domain filtering and request formatting
-- An env-only loader that reads `process.env[config.envVar]`, parses it, and throws a targeted error when missing or invalid
+- An env-only loader that reads `process.env[config.envVar]`, parses it, and throws a
+  targeted error when missing or invalid
 
 The following shared utilities will be removed:
 
@@ -68,15 +77,18 @@ For Facebook this means:
 
 For eBay this means:
 
-- Remove any remaining fallback/file-oriented behavior from shared calls and error strings
+- Remove any remaining fallback/file-oriented behavior from shared calls and error
+  strings
 - Keep the existing env-var auth path, but make it the only path
 
 ### Public API Surface
 
 Exports from `packages/core/src/index.ts` should reflect the new contract.
-If exported functions currently advertise cookie-source or cookie-path arguments, their signatures will be tightened so callers cannot pass unsupported inputs.
+If exported functions currently advertise cookie-source or cookie-path arguments, their
+signatures will be tightened so callers cannot pass unsupported inputs.
 
-Downstream adapter packages should continue calling core through the simplified signatures without adding their own cookie-loading behavior.
+Downstream adapter packages should continue calling core through the simplified
+signatures without adding their own cookie-loading behavior.
 
 ### Error Handling
 
@@ -93,8 +105,8 @@ Errors should be blunt and specific:
 
 ### Testing Strategy
 
-Follow TDD.
-Start by changing or adding core tests so the old file/request behavior is no longer accepted.
+Follow TDD. Start by changing or adding core tests so the old file/request behavior is
+no longer accepted.
 
 Coverage targets:
 
@@ -102,7 +114,8 @@ Coverage targets:
 2. Missing env vars fail with the new env-only error.
 3. Invalid env strings fail without falling back to files or request data.
 4. Facebook APIs no longer expose or honor cookie-path/request-cookie behavior.
-5. Existing tests that depended on missing files or JSON cookie arrays are rewritten to the env-only contract.
+5. Existing tests that depended on missing files or JSON cookie arrays are rewritten to
+   the env-only contract.
 
 Verification target after implementation:
 
@@ -121,11 +134,15 @@ Update cookie-related docs to match the new contract:
 
 ## Risks
 
-- External callers using request cookie overrides will break at compile time or runtime, depending on how they consume the package.
-- Recent work added support for custom Facebook cookie paths, so removing that path intentionally reverses a newly introduced behavior.
-- Tests that currently model missing-file behavior must be rewritten rather than preserved.
+- External callers using request cookie overrides will break at compile time or runtime,
+  depending on how they consume the package.
+- Recent work added support for custom Facebook cookie paths, so removing that path
+  intentionally reverses a newly introduced behavior.
+- Tests that currently model missing-file behavior must be rewritten rather than
+  preserved.
 
 ## Rollout Notes
 
 This is an intentional contract break.
-The code, tests, and docs should all land together so there is no mixed messaging about supported cookie sources.
+The code, tests, and docs should all land together so there is no mixed messaging about
+supported cookie sources.