test(e2e): mock Polymarket endpoints to remove from allowlist (MMQA-1800)

The wallet's Explore tab (TrendingView / usePredictMarketData) fetches
data from gamma-api.polymarket.com and other Polymarket hosts when
rendered. Many specs pass through Explore on the way to the browser
via navigateToBrowserView() — Explore → Trending → Browser — so
Polymarket calls fire across many specs that aren't predict-related.

Adds minimal-safe default mocks for the endpoints fired during Explore
render (events/pagination, public-search, events/{id}, markets, parent
events, homepage/carousel, crypto-price, data-api positions/activity/
upnl). Response shapes match the consumer's expected payload (e.g.
events/pagination returns { data: [] } since the consumer reads
data?.data).

Predict and trending specs already register POLYMARKET_COMPLETE_MOCKS
as testSpecificMock at higher priority, so their flows are unaffected
by these defaults.

Removes both Polymarket entries from ALLOWLISTED_HOSTS:
- gamma-api.polymarket.com (was redundant — covered by the wildcard)
- *.polymarket.com (covered all subdomains + apex)

clob.polymarket.com is not in defaults because it only fires on trade
actions, not Explore render. If CI surfaces leakage, follow up.

ALLOWLISTED_HOSTS is now down to 5 entries (4 local + metamask.github.io).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chrisleewilcox

tests/api-mocking/mock-e2e-allowlist.ts

@@ -6,8 +6,6 @@ export const ALLOWLISTED_HOSTS = [
   '127.0.0.1',
   'localhost',
   '10.0.2.2', // Android emulator host
-  'gamma-api.polymarket.com',
-  '*.polymarket.com',
   'metamask.github.io', // Test-snaps and test-dapp pages loaded in browser
 ];
 

tests/api-mocking/mock-responses/defaults/polymarket-apis.ts

@@ -1,5 +1,14 @@
 /**
- * Default mock responses for Polymarket API endpoints
+ * Default mock responses for Polymarket API endpoints.
+ *
+ * These defaults cover the calls fired by the wallet's Explore tab
+ * (TrendingView / usePredictMarketData) so that non-predict specs that pass
+ * through Explore (e.g. via navigateToBrowserView()) don't leak live requests
+ * to Polymarket. Predict and trending specs override these via
+ * POLYMARKET_COMPLETE_MOCKS registered as testSpecificMock at higher priority.
+ *
+ * clob.polymarket.com is intentionally not covered here — it only fires on
+ * trade actions, never during Explore render.
  */
 
 /** Single source of truth for geoblock mock (eligible region). Reused in defaults and in POLYMARKET_COMPLETE_MOCKS. */
@@ -13,7 +22,70 @@ export const POLYMARKET_GEOBLOCK_ELIGIBLE = {
 } as const;
 
 export const POLYMARKET_API_MOCKS = {
-  GET: [POLYMARKET_GEOBLOCK_ELIGIBLE],
+  GET: [
+    POLYMARKET_GEOBLOCK_ELIGIBLE,
+    // gamma-api: events pagination — consumer reads `data?.data`
+    {
+      urlEndpoint:
+        /^https:\/\/gamma-api\.polymarket\.com\/events\/pagination(\?.*)?$/,
+      responseCode: 200,
+      response: { data: [] },
+    },
+    // gamma-api: public-search — consumer reads `data?.events`
+    {
+      urlEndpoint:
+        /^https:\/\/gamma-api\.polymarket\.com\/public-search(\?.*)?$/,
+      responseCode: 200,
+      response: { events: [] },
+    },
+    // gamma-api: single event lookup — consumer accesses `data?.markets`
+    {
+      urlEndpoint: /^https:\/\/gamma-api\.polymarket\.com\/events\/[^/?]+$/,
+      responseCode: 200,
+      response: { markets: [] },
+    },
+    // gamma-api: parent event lookup
+    {
+      urlEndpoint:
+        /^https:\/\/gamma-api\.polymarket\.com\/events(\?.*parent_event_id=.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    // gamma-api: markets list
+    {
+      urlEndpoint: /^https:\/\/gamma-api\.polymarket\.com\/markets(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    // polymarket.com: homepage carousel
+    {
+      urlEndpoint: 'https://polymarket.com/api/homepage/carousel',
+      responseCode: 200,
+      response: [],
+    },
+    // polymarket.com: crypto price feed
+    {
+      urlEndpoint: /^https:\/\/polymarket\.com\/api\/crypto\/crypto-price.*$/,
+      responseCode: 200,
+      response: {},
+    },
+    // data-api: positions / activity / upnl
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/positions(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/activity(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+    {
+      urlEndpoint: /^https:\/\/data-api\.polymarket\.com\/upnl(\?.*)?$/,
+      responseCode: 200,
+      response: [],
+    },
+  ],
   POST: [],
   PUT: [],
   DELETE: [],