@crvouga/mockingbird-service-twilio 3.13.0 → 3.14.0

package/API_EVIDENCE.md

@@ -1,3 +1,23 @@
 # twilio evidence
 
 Added vendor routes are checked against the pinned Emulate 0.12.1 npm package and licensed provider regression tests. Native fixture, namespace, checkpoint, branch and clock checks run separately. This is offline package evidence, not live vendor proof. See [coverage audit](../../../docs/EMULATE_COVERAGE.md) for the pinned source, coverage gate, reviewed differences and exact commands.
+
+## Message list paging and the un-prefixed routes (#762)
+
+**Best guess, not oracle-verified.** No Twilio credentials are available to this repository's
+parity runs, and Messages is never called live (it sends real SMS). The behavior follows:
+
+- Twilio's response-format docs (https://www.twilio.com/docs/usage/twilios-response#response-formats-list-paging-information)
+  and the Message resource reference (https://www.twilio.com/docs/messaging/api/message-resource):
+  `uri`, `first_page_uri`, `next_page_uri` and `previous_page_uri` are paths relative to
+  `https://api.twilio.com` (`/2010-04-01/Accounts/AC…/Messages.json?PageSize=1&Page=1&PageToken=PA…`).
+- twilio-node 5.10.0 source: `lib/base/Page.js` `getNextPageUrl` returns
+  `this._version._domain.absoluteUrl(next_page_uri)`, and `lib/base/Domain.js` `absoluteUrl` joins
+  it to the domain's base URL (`https://api.twilio.com`). An `httpClient` that rewrites that host
+  (`twilioMockUrl`) therefore adds the `/api` prefix back, so the URIs carry no mount prefix.
+
+The emulator keeps the vendor form of these URIs under every mount. The un-prefixed
+`/2010-04-01/…` routes accept the same Basic credentials as the `/api` ones and list Messages in
+the same newest-first order, so a raw client following the URIs from the emulator origin pages
+correctly. Tested in `twilio.collections.test.ts` (`#762` tests), including twilio-node paging
+`PageSize=1` across two pages with and without the `/api` prefix.

package/CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog — @crvouga/mockingbird-service-twilio
 
-## 3.13.0 (2026-11-13)
+## 3.14.0 (2026-11-15)
+
+### Features
+
+- expand in-process emulation and resolve Plane and streaming gaps ([e6733fd](https://github.com/crvouga/mockingbird/commit/e6733fd00f5dd03259f36cc0f452780a7e0deea4))
+- add browser runtime polyfills and edge-snapping app cycle ([815b739](https://github.com/crvouga/mockingbird/commit/815b7399f1e058b89b3fa025f79a5014172b3ab8))
+- run lab systems in browser PR previews ([df14882](https://github.com/crvouga/mockingbird/commit/df148828ca66db1e20cf9fa2fdf38b56b5116da4))
+- publish the shared runtime once; services depend on it instead of inlining it ([4903c4a](https://github.com/crvouga/mockingbird/commit/4903c4a748fd801001ad3fd34b6016b55e0f9953))
+- add transcript storage, signature and meetings; tags, teams, messages, macros and calls ([ee21e12](https://github.com/crvouga/mockingbird/commit/ee21e12024768bd52c6902b1722fb35a94d2444b))
+
+## 3.13.1 (2026-11-13)
+
+### Fixes and improvements
+
+- resolve redis, sqs and twilio parity reports (#753, #754, #762) ([32317c8](https://github.com/crvouga/mockingbird/commit/32317c8812ba35b04bc9c1819119e1bd923fe1ea))
+
+## 3.13.0 (2026-11-12)
 
 ### Features
 

package/README.md

@@ -119,7 +119,7 @@ await server.close()
 | `GET` / `POST /verify/v2/Services/{VA}/Verifications/{VE}` | Fetches a verification, or sets `Status=canceled\|approved` on one. |
 | `POST /api/2010-04-01/Accounts/{AC}/Messages.json` | `To`, `Body` or `MediaUrl`, and `From` or `MessagingServiceSid`. Returns 201 with an `SM…` sid (`MM…` with media) and RFC 2822 dates. `MessagingServiceSid` alone is status `accepted`, `from: null`, `num_segments: "0"` (a sender is not chosen yet). `From` alone is status `queued`. Both are kept and the status is `queued` (Twilio queues on a specific sender). There is no idempotency key: the same body creates another sid. Errors: 21604 (no To), 21602 (no Body), 21603 (no From), 21211 (invalid To), 21617 (over 1600 characters). The message is recorded in the outbox. **WhatsApp:** a `To` of `whatsapp:+15551234567` sends a WhatsApp message; the number behind the prefix is validated the same way (21211 when it is not a phone number), the response's `to` keeps the `whatsapp:` prefix, and the outbox entry has `channel: "whatsapp"` instead of `"sms"`. Pair it with a `whatsapp:` `From`, form-encoded so the `+` survives (`--data-urlencode` in curl). |
 | `GET /api/2010-04-01/Accounts/{AC}/Messages/{SM}.json` | Reads a message back. |
-| `GET /api/2010-04-01/Accounts/{AC}/Messages.json` | Newest-first Message resources for that account. `PageSize` defaults to 50 (1–1000), `PageToken` follows `next_page_uri`/`previous_page_uri`; `Page` is client state. Links keep the vendor path without `/api`, so apply the normal product-prefix rewrite. `To` and `From` filter stored resources. |
+| `GET /api/2010-04-01/Accounts/{AC}/Messages.json` | Newest-first Message resources for that account. `PageSize` defaults to 50 (1–1000), `PageToken` follows `next_page_uri`/`previous_page_uri`; `Page` is client state. Links (`uri`, `first_page_uri`, `next_page_uri`, `previous_page_uri`) are api.twilio.com-relative paths without `/api`, as Twilio returns them: twilio-node resolves them against `https://api.twilio.com` and your `httpClient` rewrite adds the prefix again, and a raw client can follow them from the emulator origin as-is, since the un-prefixed `/2010-04-01/…` routes accept the same credentials (#762; best guess from Twilio's docs and twilio-node source, not oracle-verified). `To` and `From` filter stored resources. |
 | `GET /api/2010-04-01/Accounts/{AC}/Recordings/{RE}.wav` | The recording as a RIFF WAV. With `RequestedChannels=2` you get both channels. Otherwise a dual-channel recording is mixed down to mono, as Twilio does. |
 | `GET` / `DELETE /api/2010-04-01/Accounts/{AC}/Recordings/{RE}.json` | Metadata, or a delete (204; a second delete is 404, which our consumer tolerates). |
 
@@ -128,6 +128,10 @@ Authentication is HTTP Basic: an `AC…` (or `SK…`) username and a non-empty p
 `accounts` (or `--account-sid` plus `--auth-token`) only those pairs are accepted. A missing or
 wrong credential is 401 `20003`. For a wrong token the message matches the live one:
 `authentication failed, auth token is not valid for account AC…`.
+The same rule applies to the un-prefixed vendor-compatible routes (`/2010-04-01/…`,
+`/conversations/v1/…`, …): an account a valid credential names is created there on first use,
+and the seeded `AC00000000000000000000000000000000` / `twilio_test_auth_token` pair keeps
+working (#762).
 
 ### Webhooks (S8.4)
 

package/SUPPORT.md

@@ -13,7 +13,7 @@ Generated from `openapi.yaml`; do not edit by hand.
 | `FetchVerification` | `GET /verify/v2/Services/{ServiceSid}/Verifications/{Sid}` | ✅ supported | ✅ |  |
 | `UpdateVerification` | `POST /verify/v2/Services/{ServiceSid}/Verifications/{Sid}` | ✅ supported | ⚠️ unsafe (opt-in) |  |
 | `CreateVerificationCheck` | `POST /verify/v2/Services/{ServiceSid}/VerificationCheck` | ✅ supported | ⚠️ unsafe (opt-in) |  |
-| `ListMessages` | `GET /api/2010-04-01/Accounts/{AccountSid}/Messages.json` | ✅ supported | ✅ |  |
+| `ListMessages` | `GET /api/2010-04-01/Accounts/{AccountSid}/Messages.json` | ✅ supported | ✅ | Page URIs are api.twilio.com-relative (`/2010-04-01/…`, no `/api`), as twilio-node's `Page.getNextPageUrl` resolves them with `Domain.absoluteUrl` (#762; best guess from Twilio's paging docs and twilio-node 5.10.0 source, not oracle-verified). |
 | `CreateMessage` | `POST /api/2010-04-01/Accounts/{AccountSid}/Messages.json` | ✅ supported | ⚠️ unsafe (opt-in) |  |
 | `FetchMessage` | `GET /api/2010-04-01/Accounts/{AccountSid}/Messages/{Sid}.json` | ✅ supported | ✅ |  |
 | `POST /api/2010-04-01/Accounts/{accountSid}/Messages/{messageSid}.json` | `POST /api/2010-04-01/Accounts/{AccountSid}/Messages/{Sid}.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
@@ -48,7 +48,7 @@ Generated from `openapi.yaml`; do not edit by hand.
 | `POST /2010-04-01/Accounts/:accountSid/Calls.json` | `POST /2010-04-01/Accounts/{accountSid}/Calls.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
 | `GET /2010-04-01/Accounts/:accountSid/IncomingPhoneNumbers.json` | `GET /2010-04-01/Accounts/{accountSid}/IncomingPhoneNumbers.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
 | `POST /2010-04-01/Accounts/:accountSid/IncomingPhoneNumbers.json` | `POST /2010-04-01/Accounts/{accountSid}/IncomingPhoneNumbers.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
-| `GET /2010-04-01/Accounts/:accountSid/Messages.json` | `GET /2010-04-01/Accounts/{accountSid}/Messages.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
+| `GET /2010-04-01/Accounts/:accountSid/Messages.json` | `GET /2010-04-01/Accounts/{accountSid}/Messages.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. Accepts the same Basic credentials as `ListMessages` under `/api` and pages in the same newest-first order, so its page URIs and those `/api` returns can be followed from the emulator origin (#762; best guess from Twilio's paging docs and twilio-node source, not oracle-verified). |
 | `POST /2010-04-01/Accounts/:accountSid/Messages.json` | `POST /2010-04-01/Accounts/{accountSid}/Messages.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
 | `GET /2010-04-01/Accounts/:accountSid/Messages/:messageSid/Media.json` | `GET /2010-04-01/Accounts/{accountSid}/Messages/{messageSid}/Media.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |
 | `GET /2010-04-01/Accounts/:accountSid/Messages/:messageSid/Media/:mediaSid.json` | `GET /2010-04-01/Accounts/{accountSid}/Messages/{messageSid}/Media/{mediaSid}.json` | ✅ supported | ❌ disabled | Verified against a pinned package oracle; independent live vendor evidence is not available. |