@gooddata/sdk-e2e-utils 11.60.0-alpha.2 → 11.60.0-alpha.4

package/esm/create-test/feature-hub/mock.d.ts

@@ -0,0 +1,5 @@
+import type { Test } from "../playwright/playwright-types.js";
+import type { IFeatureHubEnvironment } from "./types.js";
+/** FeatureHub mock — each test gets a fresh page, so route dies with it. */
+export declare function registerFeatureHubMock(testInstance: Test, featureHubResponse: IFeatureHubEnvironment[]): void;
+//# sourceMappingURL=mock.d.ts.map

package/esm/create-test/feature-hub/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../../src/create-test/feature-hub/mock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAClC,YAAY,EAAE,IAAI,EAClB,kBAAkB,EAAE,sBAAsB,EAAE,GAC7C,IAAI,CAYN"}

package/esm/create-test/feature-hub/mock.js

@@ -0,0 +1,15 @@
+// (C) 2026 GoodData Corporation
+/** FeatureHub mock — each test gets a fresh page, so route dies with it. */
+export function registerFeatureHubMock(testInstance, featureHubResponse) {
+    const body = JSON.stringify(featureHubResponse);
+    testInstance.beforeEach(async ({ page }) => {
+        await page.route("**/features*", async (route) => {
+            await route.fulfill({
+                status: 200,
+                contentType: "application/json",
+                headers: { "access-control-allow-origin": "*" },
+                body,
+            });
+        });
+    });
+}

package/esm/create-test/feature-hub/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @internal
+ */
+export interface IFeatureHubFeature {
+    id: string;
+    key: string;
+    l: boolean;
+    version?: number;
+    type: string;
+    value?: boolean | string | number;
+    strategies?: unknown[];
+    v?: string;
+}
+/**
+ * @internal
+ */
+export interface IFeatureHubEnvironment {
+    id: string;
+    features: IFeatureHubFeature[];
+}
+//# sourceMappingURL=types.d.ts.map

package/esm/create-test/feature-hub/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/create-test/feature-hub/types.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,EAAE,OAAO,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAClC"}

package/esm/create-test/feature-hub/types.js

@@ -0,0 +1,2 @@
+// (C) 2026 GoodData Corporation
+export {};

package/esm/create-test/goodmock/admin.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @internal
+ * Load goodmock stub mappings from a JSON file on disk.
+ *
+ * @param host - Goodmock host:port (e.g. "backend-mock:8080")
+ * @param mappingFilePath - Absolute path to the mapping JSON file
+ */
+export declare function loadMappings(host: string, mappingFilePath: string): Promise<void>;
+/**
+ * @internal
+ * Reset goodmock scenario state (sequence counters) without clearing mappings.
+ * Must be called between tests so scenario-driven stubs start from the
+ * beginning for every test — mirrors the Cypress `resetRecordingsScenarios` task.
+ */
+export declare function resetScenarios(host: string): Promise<void>;
+/**
+ * @internal
+ * Clear all goodmock stub mappings.
+ */
+export declare function resetMappings(host: string): Promise<void>;
+/**
+ * @internal
+ * Add a goodmock stub that mocks log requests (POST /gdc/app/projects/.../log).
+ * This prevents the app from failing when it tries to send logs.
+ */
+export declare function mockLogRequests(host: string): Promise<void>;
+/**
+ * @internal
+ * Add a catch-all proxy mapping so goodmock forwards every request to the
+ * real backend and records the interactions.  Must be called after
+ * {@link resetMappings} in recording mode.
+ */
+export declare function startRecording(host: string, backendHost: string): Promise<void>;
+//# sourceMappingURL=admin.d.ts.map

package/esm/create-test/goodmock/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/create-test/goodmock/admin.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBvF;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhE;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM/D;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrF"}

package/esm/create-test/goodmock/admin.js

@@ -0,0 +1,99 @@
+// (C) 2026 GoodData Corporation
+import { readFileSync } from "fs";
+/**
+ * @internal
+ * Load goodmock stub mappings from a JSON file on disk.
+ *
+ * @param host - Goodmock host:port (e.g. "backend-mock:8080")
+ * @param mappingFilePath - Absolute path to the mapping JSON file
+ */
+export async function loadMappings(host, mappingFilePath) {
+    let mappings;
+    try {
+        mappings = readFileSync(mappingFilePath, "utf-8");
+    }
+    catch {
+        console.warn(`No mapping file found: ${mappingFilePath}, skipping`);
+        return;
+    }
+    let json;
+    try {
+        json = JSON.parse(mappings);
+    }
+    catch {
+        console.error(`Failed to parse mapping file: ${mappingFilePath}`);
+        return;
+    }
+    const response = await fetch(`http://${host}/__admin/mappings/import`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(json),
+    });
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Goodmock mappings loaded from ${mappingFilePath} (status: ${response.status})`);
+}
+/**
+ * @internal
+ * Reset goodmock scenario state (sequence counters) without clearing mappings.
+ * Must be called between tests so scenario-driven stubs start from the
+ * beginning for every test — mirrors the Cypress `resetRecordingsScenarios` task.
+ */
+export async function resetScenarios(host) {
+    const response = await fetch(`http://${host}/__admin/scenarios/reset`, {
+        method: "POST",
+    });
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Goodmock scenarios reset (status: ${response.status})`);
+}
+/**
+ * @internal
+ * Clear all goodmock stub mappings.
+ */
+export async function resetMappings(host) {
+    const response = await fetch(`http://${host}/__admin/reset`, {
+        method: "POST",
+    });
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Goodmock mappings reset (status: ${response.status})`);
+}
+/**
+ * @internal
+ * Add a goodmock stub that mocks log requests (POST /gdc/app/projects/.../log).
+ * This prevents the app from failing when it tries to send logs.
+ */
+export async function mockLogRequests(host) {
+    const response = await fetch(`http://${host}/__admin/mappings`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            request: {
+                method: "POST",
+                urlPattern: "/gdc/app/projects/.*/log",
+            },
+            response: {
+                body: "",
+                status: 200,
+            },
+        }),
+    });
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Goodmock log requests mocked (status: ${response.status})`);
+}
+/**
+ * @internal
+ * Add a catch-all proxy mapping so goodmock forwards every request to the
+ * real backend and records the interactions.  Must be called after
+ * {@link resetMappings} in recording mode.
+ */
+export async function startRecording(host, backendHost) {
+    const response = await fetch(`http://${host}/__admin/mappings`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            request: { method: "ANY", urlPattern: ".*" },
+            response: { proxyBaseUrl: backendHost },
+        }),
+    });
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Goodmock recording started, proxying to ${backendHost} (status: ${response.status})`);
+}

package/esm/create-test/goodmock/mode.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @internal
+ * Which mode goodmock is running in
+ */
+export declare enum GoodmockMode {
+    Replay = "replay",
+    Record = "record",
+    Proxy = "proxy"
+}
+/**
+ * @internal
+ */
+export declare function goodmockMode(): GoodmockMode;
+//# sourceMappingURL=mode.d.ts.map

package/esm/create-test/goodmock/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../../src/create-test/goodmock/mode.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,oBAAY,YAAY;IACpB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,KAAK,UAAU;CAClB;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,YAAY,CAE3C"}

package/esm/create-test/goodmock/mode.js

@@ -0,0 +1,17 @@
+// (C) 2026 GoodData Corporation
+/**
+ * @internal
+ * Which mode goodmock is running in
+ */
+export var GoodmockMode;
+(function (GoodmockMode) {
+    GoodmockMode["Replay"] = "replay";
+    GoodmockMode["Record"] = "record";
+    GoodmockMode["Proxy"] = "proxy";
+})(GoodmockMode || (GoodmockMode = {}));
+/**
+ * @internal
+ */
+export function goodmockMode() {
+    return process.env["GOODMOCK_MODE"];
+}

package/esm/create-test/goodmock/playwright.d.ts

@@ -0,0 +1,5 @@
+import { type test } from "@playwright/test";
+import { type IGoodmockOptions } from "./types.js";
+/** Goodmock lifecycle hooks */
+export declare function registerGoodmockHooks(testInstance: typeof test, gm: IGoodmockOptions, specName: string): void;
+//# sourceMappingURL=playwright.d.ts.map

package/esm/create-test/goodmock/playwright.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"playwright.d.ts","sourceRoot":"","sources":["../../../src/create-test/goodmock/playwright.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAK7C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,+BAA+B;AAC/B,wBAAgB,qBAAqB,CACjC,YAAY,EAAE,OAAO,IAAI,EACzB,EAAE,EAAE,gBAAgB,EACpB,QAAQ,EAAE,MAAM,GACjB,IAAI,CAiCN"}

package/esm/create-test/goodmock/playwright.js

@@ -0,0 +1,37 @@
+// (C) 2026 GoodData Corporation
+import { loadMappings, resetMappings, startRecording } from "./admin.js";
+import { GoodmockMode, goodmockMode as getGoodmockMode } from "./mode.js";
+import { snapshotAndSaveRecording } from "./snapshot/snapshot-and-save-recording.js";
+/** Goodmock lifecycle hooks */
+export function registerGoodmockHooks(testInstance, gm, specName) {
+    const goodmockMode = getGoodmockMode();
+    if (goodmockMode === GoodmockMode.Proxy) {
+        return;
+    }
+    testInstance.beforeAll(async () => {
+        await resetMappings(gm.host);
+        if (goodmockMode === GoodmockMode.Record) {
+            await startRecording(gm.host, gm.backendHost);
+        }
+        else if (goodmockMode === GoodmockMode.Replay) {
+            await loadMappings(gm.host, gm.getMappingPath(specName));
+        }
+    });
+    testInstance.afterAll(async () => {
+        if (goodmockMode === GoodmockMode.Record) {
+            await snapshotAndSaveRecording(gm.host, gm.getMappingPath(specName), {
+                workspaceIdMappings: gm.workspaceIdMappings,
+                backendHost: gm.backendHost,
+                baseUrl: gm.baseUrl,
+                secretMappings: gm.secretMappings,
+                leakPatterns: gm.leakPatterns,
+                sanitizeMappings: gm.sanitizeMappings,
+            });
+        }
+        await resetMappings(gm.host);
+    });
+    // TODO: When this is supported in goodmock, uncomment this block
+    // testInstance.beforeEach(async () => {
+    //     await resetScenarios(gm.host);
+    // });
+}

package/esm/create-test/goodmock/snapshot/assert-no-leak-patterns.d.ts

@@ -0,0 +1,9 @@
+import { type ILeakPattern } from "../types.js";
+/**
+ * Pattern guard: catch credential-shaped values from ANY source (not just the ones the
+ * tests typed), e.g. a real key stored in a backend org setting under an unexpected field.
+ * Patterns are consumer-supplied — this module has no built-in notion of what a secret
+ * looks like for a given domain (see ISnapshotAndSaveRecordingOptions.leakPatterns).
+ */
+export declare function assertNoLeakPatterns(output: string, leakPatterns: ILeakPattern[] | undefined, mappingFilePath: string): void;
+//# sourceMappingURL=assert-no-leak-patterns.d.ts.map

package/esm/create-test/goodmock/snapshot/assert-no-leak-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-no-leak-patterns.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/assert-no-leak-patterns.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAChC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAAE,GAAG,SAAS,EACxC,eAAe,EAAE,MAAM,GACxB,IAAI,CAcN"}

package/esm/create-test/goodmock/snapshot/assert-no-leak-patterns.js

@@ -0,0 +1,20 @@
+// (C) 2026 GoodData Corporation
+/**
+ * Pattern guard: catch credential-shaped values from ANY source (not just the ones the
+ * tests typed), e.g. a real key stored in a backend org setting under an unexpected field.
+ * Patterns are consumer-supplied — this module has no built-in notion of what a secret
+ * looks like for a given domain (see ISnapshotAndSaveRecordingOptions.leakPatterns).
+ */
+export function assertNoLeakPatterns(output, leakPatterns, mappingFilePath) {
+    for (const { label, pattern } of leakPatterns ?? []) {
+        // Reset lastIndex in case pattern carries the g/y flag — exec() on a stateful regex
+        // would otherwise resume from wherever a previous call (e.g. a prior recording) left off.
+        pattern.lastIndex = 0;
+        const match = pattern.exec(output);
+        if (match) {
+            throw new Error(`Recording for ${mappingFilePath} contains a value shaped like a ${label} ` +
+                `("${match[0].slice(0, 8)}…"). Refusing to save the mapping file — extend ` +
+                `sanitizeMappings / secretMappings so it gets sanitized.`);
+        }
+    }
+}

package/esm/create-test/goodmock/snapshot/assert-no-secret-leaks.d.ts

@@ -0,0 +1,4 @@
+import { type ISecretMapping } from "../types.js";
+/** Leak guard: never write a recording that still contains a real secret (full or masked). */
+export declare function assertNoSecretLeaks(output: string, secretMappings: ISecretMapping[] | undefined, mappingFilePath: string): void;
+//# sourceMappingURL=assert-no-secret-leaks.d.ts.map

package/esm/create-test/goodmock/snapshot/assert-no-secret-leaks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-no-secret-leaks.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/assert-no-secret-leaks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,EAC5C,eAAe,EAAE,MAAM,GACxB,IAAI,CAWN"}

package/esm/create-test/goodmock/snapshot/assert-no-secret-leaks.js

@@ -0,0 +1,14 @@
+// (C) 2026 GoodData Corporation
+import { buildMaskedFormPattern } from "./build-masked-form-pattern.js";
+import { getEffectiveSecretMappings } from "./get-effective-secret-mappings.js";
+/** Leak guard: never write a recording that still contains a real secret (full or masked). */
+export function assertNoSecretLeaks(output, secretMappings, mappingFilePath) {
+    for (const { secret } of getEffectiveSecretMappings(secretMappings)) {
+        const escapedSecret = JSON.stringify(secret).slice(1, -1);
+        const maskedForm = buildMaskedFormPattern(escapedSecret);
+        if (output.includes(escapedSecret) || output.includes(secret) || maskedForm?.test(output)) {
+            throw new Error(`Recording for ${mappingFilePath} still contains a secret after sanitization ` +
+                `(e.g. in an encoded form). Refusing to save the mapping file.`);
+        }
+    }
+}

package/esm/create-test/goodmock/snapshot/build-masked-form-pattern.d.ts

@@ -0,0 +1,2 @@
+export declare const buildMaskedFormPattern: (escapedSecret: string) => RegExp | undefined;
+//# sourceMappingURL=build-masked-form-pattern.d.ts.map

package/esm/create-test/goodmock/snapshot/build-masked-form-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-masked-form-pattern.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/build-masked-form-pattern.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,sBAAsB,kBAAmB,MAAM,KAAG,MAAM,GAAG,SAUvE,CAAC"}

package/esm/create-test/goodmock/snapshot/build-masked-form-pattern.js

@@ -0,0 +1,17 @@
+// (C) 2026 GoodData Corporation
+const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// Below this, prefix/suffix would overlap or leave nothing to mask — there's no safe
+// "partial reveal" shape to detect, so such secrets rely on the exact-match replace in replaceSecrets.
+const MIN_MASKABLE_SECRET_LENGTH = 6;
+// Masking keeps a variable-length prefix/suffix of the key around the asterisks; scale how
+// much we match by the secret's own length instead of assuming a fixed provider convention
+// (e.g. OpenAI's "sk-prox***********abcd") so shorter secrets and other providers' masking
+// shapes are still caught.
+export const buildMaskedFormPattern = (escapedSecret) => {
+    if (escapedSecret.length < MIN_MASKABLE_SECRET_LENGTH) {
+        return undefined;
+    }
+    const prefixLength = Math.min(7, Math.floor(escapedSecret.length / 3));
+    const suffixLength = Math.min(4, Math.floor(escapedSecret.length / 4));
+    return new RegExp(`${escapeRegex(escapedSecret.slice(0, prefixLength))}[^"*\\\\]*[*]+[^"*\\\\]*${escapeRegex(escapedSecret.slice(-suffixLength))}`, "g");
+};

package/esm/create-test/goodmock/snapshot/get-effective-secret-mappings.d.ts

@@ -0,0 +1,3 @@
+import { type ISecretMapping } from "../types.js";
+export declare const getEffectiveSecretMappings: (secretMappings: ISecretMapping[] | undefined) => ISecretMapping[];
+//# sourceMappingURL=get-effective-secret-mappings.d.ts.map

package/esm/create-test/goodmock/snapshot/get-effective-secret-mappings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-effective-secret-mappings.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/get-effective-secret-mappings.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,eAAO,MAAM,0BAA0B,mBAAoB,cAAc,EAAE,GAAG,SAAS,KAAG,cAAc,EACR,CAAC"}

package/esm/create-test/goodmock/snapshot/get-effective-secret-mappings.js

@@ -0,0 +1,2 @@
+// (C) 2026 GoodData Corporation
+export const getEffectiveSecretMappings = (secretMappings) => (secretMappings ?? []).filter(({ secret, placeholder }) => secret && secret !== placeholder);

package/esm/create-test/goodmock/snapshot/replace-secrets.d.ts

@@ -0,0 +1,10 @@
+import { type ISecretMapping } from "../types.js";
+/**
+ * Replace secrets typed into the UI / sent by API helpers during recording with their
+ * replay-time placeholders. JSON-escape both sides so values containing characters that
+ * JSON.stringify escapes (quotes, backslashes) are still found in the serialized output.
+ * Provider error messages echo keys in a masked form ("sk-prox***********abcd"), so that
+ * shape is rewritten too — it still leaks the ends of a real key.
+ */
+export declare function replaceSecrets(output: string, secretMappings: ISecretMapping[] | undefined): string;
+//# sourceMappingURL=replace-secrets.d.ts.map

package/esm/create-test/goodmock/snapshot/replace-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-secrets.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/replace-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,GAAG,MAAM,CAYnG"}

package/esm/create-test/goodmock/snapshot/replace-secrets.js

@@ -0,0 +1,23 @@
+// (C) 2026 GoodData Corporation
+import { buildMaskedFormPattern } from "./build-masked-form-pattern.js";
+import { getEffectiveSecretMappings } from "./get-effective-secret-mappings.js";
+/**
+ * Replace secrets typed into the UI / sent by API helpers during recording with their
+ * replay-time placeholders. JSON-escape both sides so values containing characters that
+ * JSON.stringify escapes (quotes, backslashes) are still found in the serialized output.
+ * Provider error messages echo keys in a masked form ("sk-prox***********abcd"), so that
+ * shape is rewritten too — it still leaks the ends of a real key.
+ */
+export function replaceSecrets(output, secretMappings) {
+    let result = output;
+    for (const { secret, placeholder } of getEffectiveSecretMappings(secretMappings)) {
+        const escapedSecret = JSON.stringify(secret).slice(1, -1);
+        const escapedPlaceholder = JSON.stringify(placeholder).slice(1, -1);
+        result = result.replaceAll(escapedSecret, escapedPlaceholder);
+        const maskedForm = buildMaskedFormPattern(escapedSecret);
+        if (maskedForm) {
+            result = result.replace(maskedForm, escapedPlaceholder);
+        }
+    }
+    return result;
+}

package/esm/create-test/goodmock/snapshot/sanitize-credentials.d.ts

@@ -0,0 +1,4 @@
+import { type IGoodmockMapping } from "../types.js";
+/** Sanitize credentials (login cookie, resolveSettings map tokens) in place. */
+export declare function sanitizeCredentials(mappings: IGoodmockMapping[]): void;
+//# sourceMappingURL=sanitize-credentials.d.ts.map

package/esm/create-test/goodmock/snapshot/sanitize-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-credentials.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/sanitize-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAyCtE"}

package/esm/create-test/goodmock/snapshot/sanitize-credentials.js

@@ -0,0 +1,41 @@
+// (C) 2026 GoodData Corporation
+/** Sanitize credentials (login cookie, resolveSettings map tokens) in place. */
+export function sanitizeCredentials(mappings) {
+    for (const mapping of mappings) {
+        if (mapping?.request?.url === "/gdc/account/login") {
+            delete mapping.request.bodyPatterns;
+            if (mapping.response.headers) {
+                delete mapping.response.headers["Set-Cookie"];
+            }
+        }
+        // Sanitize secrets from resolveSettings responses. Match both org-level
+        // (/api/v1/actions/resolveSettings) and workspace-level variants, via either `url`
+        // (no query) or `urlPath` (with query params).
+        const requestPath = mapping?.request?.url ?? mapping?.request?.urlPath;
+        if (typeof requestPath === "string" && requestPath.includes("/resolveSettings")) {
+            try {
+                const body = mapping?.response?.jsonBody;
+                const settings = Array.isArray(body)
+                    ? body
+                    : Array.isArray(body?.data)
+                        ? body.data
+                        : null;
+                if (settings) {
+                    for (const setting of settings) {
+                        const content = setting?.content;
+                        if (!content || typeof content !== "object") {
+                            continue;
+                        }
+                        // Map tokens (agGrid, mapbox) are stored under content.value.
+                        if (setting?.id === "agGridToken" || setting?.id === "mapboxToken") {
+                            content["value"] = "";
+                        }
+                    }
+                }
+            }
+            catch {
+                console.warn(`sanitizeCredentials – resolveSettings body is not valid JSON for: ${requestPath}`);
+            }
+        }
+    }
+}

package/esm/create-test/goodmock/snapshot/sanitize-workspace-ids.d.ts

@@ -0,0 +1,4 @@
+import { type IGoodmockMapping, type IWorkspaceIdMapping } from "../types.js";
+/** Apply every source/target workspace ID rewrite, in order. */
+export declare function sanitizeWorkspaceIds(mappings: IGoodmockMapping[], workspaceIdMappings: IWorkspaceIdMapping | IWorkspaceIdMapping[] | undefined): IGoodmockMapping[];
+//# sourceMappingURL=sanitize-workspace-ids.d.ts.map

package/esm/create-test/goodmock/snapshot/sanitize-workspace-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-workspace-ids.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/sanitize-workspace-ids.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAqB9E,gEAAgE;AAChE,wBAAgB,oBAAoB,CAChC,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,mBAAmB,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,GAAG,SAAS,GAC7E,gBAAgB,EAAE,CAWpB"}

package/esm/create-test/goodmock/snapshot/sanitize-workspace-ids.js

@@ -0,0 +1,21 @@
+// (C) 2026 GoodData Corporation
+function sanitizeWorkspaceId(mappings, sourceWorkspaceId, targetWorkspaceId) {
+    if (sourceWorkspaceId === targetWorkspaceId) {
+        return mappings;
+    }
+    const dataString = JSON.stringify({ mappings });
+    const sanitizedDataString = dataString.split(sourceWorkspaceId).join(targetWorkspaceId);
+    const sanitizedData = JSON.parse(sanitizedDataString);
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Sanitized workspaceId in mappings (${sourceWorkspaceId} -> ${targetWorkspaceId})`);
+    return sanitizedData.mappings;
+}
+/** Apply every source/target workspace ID rewrite, in order. */
+export function sanitizeWorkspaceIds(mappings, workspaceIdMappings) {
+    const mappingsToApply = Array.isArray(workspaceIdMappings)
+        ? workspaceIdMappings
+        : workspaceIdMappings
+            ? [workspaceIdMappings]
+            : [];
+    return mappingsToApply.reduce((acc, { sourceWorkspaceId, targetWorkspaceId }) => sanitizeWorkspaceId(acc, sourceWorkspaceId, targetWorkspaceId), mappings);
+}

package/esm/create-test/goodmock/snapshot/snapshot-and-save-recording.d.ts

@@ -0,0 +1,50 @@
+import { type IGoodmockMapping, type ILeakPattern, type ISecretMapping, type IWorkspaceIdMapping } from "../types.js";
+/**
+ * @internal
+ */
+export interface ISnapshotAndSaveRecordingOptions {
+    /** Source/target workspace ID rewrite(s) applied before mappings are saved. */
+    workspaceIdMappings?: IWorkspaceIdMapping | IWorkspaceIdMapping[];
+    /**
+     * Real backend URL (e.g. "https://example.gooddata.com"). When provided together with
+     * baseUrl, all occurrences are replaced in the saved mappings so that recorded responses
+     * (e.g. geo tile URLs) resolve correctly during replay.
+     */
+    backendHost?: string;
+    /** App base URL (e.g. "http://kpi-dashboards-ui:9500") that replaces backendHost references. */
+    baseUrl?: string;
+    /**
+     * Secret rewrites. Each secret value is replaced by its placeholder everywhere in the saved
+     * mappings (request bodyPatterns included, and masked variants such as "sk-prox***abcd").
+     * Saving fails hard if any secret still remains afterwards.
+     */
+    secretMappings?: ISecretMapping[];
+    /**
+     * Credential-shaped patterns that must never appear anywhere in the saved output, regardless
+     * of which field they came from. A backstop for secrets `secretMappings` doesn't know about
+     * (e.g. a value a backend echoed back that the test never typed). Saving fails hard on a match.
+     */
+    leakPatterns?: ILeakPattern[];
+    /**
+     * Consumer-supplied hook to redact domain-specific secrets from the collected mappings (e.g.
+     * blank a `content.apiKey` field on a settings entity) before they're merged and written out.
+     * Runs once, right after the built-in credential handling (login cookie, resolveSettings map
+     * tokens) and before workspace-id rewriting.
+     */
+    sanitizeMappings?: (mappings: IGoodmockMapping[]) => IGoodmockMapping[];
+}
+/**
+ * @internal
+ * Snapshot goodmock recordings, save the combined mappings to a JSON file
+ * on disk, and sanitize any credentials from the output.
+ *
+ * A single snapshot is taken with repeatsAsScenarios enabled: goodmock turns a
+ * request into a scenario chain only when its responses differ across the
+ * recording, so stateful sequences are preserved and everything else stays flat.
+ *
+ * @param host - Goodmock host:port (e.g. "backend-mock:8080")
+ * @param mappingFilePath - Absolute path to write the mapping JSON file to
+ * @param options - See {@link ISnapshotAndSaveRecordingOptions}.
+ */
+export declare function snapshotAndSaveRecording(host: string, mappingFilePath: string, options?: ISnapshotAndSaveRecordingOptions): Promise<void>;
+//# sourceMappingURL=snapshot-and-save-recording.d.ts.map

package/esm/create-test/goodmock/snapshot/snapshot-and-save-recording.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-and-save-recording.d.ts","sourceRoot":"","sources":["../../../../src/create-test/goodmock/snapshot/snapshot-and-save-recording.ts"],"names":[],"mappings":"AAKA,OAAO,EACH,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAC3B,MAAM,aAAa,CAAC;AASrB;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC7C,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;IAClE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gGAAgG;IAChG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC;IAClC;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,CAAC;CAC3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC1C,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE,gCAAqC,GAC/C,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/esm/create-test/goodmock/snapshot/snapshot-and-save-recording.js

@@ -0,0 +1,64 @@
+// (C) 2026 GoodData Corporation
+import { mkdirSync, writeFileSync } from "fs";
+import { dirname } from "path";
+import { assertNoLeakPatterns } from "./assert-no-leak-patterns.js";
+import { assertNoSecretLeaks } from "./assert-no-secret-leaks.js";
+import { replaceSecrets } from "./replace-secrets.js";
+import { sanitizeCredentials } from "./sanitize-credentials.js";
+import { sanitizeWorkspaceIds } from "./sanitize-workspace-ids.js";
+import { snapshotParams } from "./snapshot-param.js";
+/**
+ * @internal
+ * Snapshot goodmock recordings, save the combined mappings to a JSON file
+ * on disk, and sanitize any credentials from the output.
+ *
+ * A single snapshot is taken with repeatsAsScenarios enabled: goodmock turns a
+ * request into a scenario chain only when its responses differ across the
+ * recording, so stateful sequences are preserved and everything else stays flat.
+ *
+ * @param host - Goodmock host:port (e.g. "backend-mock:8080")
+ * @param mappingFilePath - Absolute path to write the mapping JSON file to
+ * @param options - See {@link ISnapshotAndSaveRecordingOptions}.
+ */
+export async function snapshotAndSaveRecording(host, mappingFilePath, options = {}) {
+    const { workspaceIdMappings, backendHost, baseUrl, secretMappings, leakPatterns, sanitizeMappings } = options;
+    // Snapshot everything with scenarios enabled. goodmock only emits a scenario
+    // chain when a given request produced *different* responses across the
+    // recording; identical repeats collapse to a single mapping. This captures
+    // stateful sequences (e.g. a GET whose result changes after a POST) that the
+    // old per-URL dedup path silently dropped, while keeping idempotent traffic flat.
+    const snapshotRes = await fetch(`http://${host}/__admin/recordings/snapshot`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            repeatsAsScenarios: true,
+            persist: false,
+            ...snapshotParams,
+        }),
+    });
+    const snapshotData = (await snapshotRes.json());
+    const mappings = [...snapshotData.mappings];
+    // An empty snapshot means the recording journal was lost (e.g. a worker crash re-ran the
+    // beforeAll reset mid-spec) or the spec made no requests at all. Never overwrite a previous
+    // recording with an empty one, and fail the run so the broken recording cannot go unnoticed.
+    if (mappings.length === 0) {
+        throw new Error(`Recording snapshot for ${mappingFilePath} is empty — keeping the existing mapping ` +
+            `file. Investigate (worker crash mid-spec? goodmock proxy misconfigured?) and re-record.`);
+    }
+    sanitizeCredentials(mappings);
+    // Consumer-supplied redaction for secrets this module has no knowledge of (e.g. an LLM
+    // provider's API key echoed back on a settings entity).
+    const sanitizedByCaller = sanitizeMappings ? sanitizeMappings(mappings) : mappings;
+    const sanitizedMappings = sanitizeWorkspaceIds(sanitizedByCaller, workspaceIdMappings);
+    let output = JSON.stringify({ mappings: sanitizedMappings }, null, 4) + "\n";
+    if (backendHost && baseUrl) {
+        output = output.replaceAll(backendHost, baseUrl);
+    }
+    output = replaceSecrets(output, secretMappings);
+    assertNoSecretLeaks(output, secretMappings, mappingFilePath);
+    assertNoLeakPatterns(output, leakPatterns, mappingFilePath);
+    mkdirSync(dirname(mappingFilePath), { recursive: true });
+    writeFileSync(mappingFilePath, output);
+    // oxlint-disable-next-line eslint-js/no-console
+    console.log(`Recording saved to ${mappingFilePath} (${sanitizedMappings.length} mappings)`);
+}