@volter/twin-livekit 0.1.0

package/dist/src/livekit-twin.js

@@ -0,0 +1,1161 @@
+import { applyTwinWrite } from '@volter/world-core';
+import { EGRESS_STATUS, FIXED_NOW, INGRESS_INPUT, INGRESS_STATUS, SERVICE, defaultIngress, defaultParticipant, defaultRoom, egressId, egressResourceId, egresses, ingressId, ingressInput, ingresses, isActiveEgressStatus, participants, rooms, withCounts, SIP_TRANSPORT, agentDispatchId, agentDispatches, sipCallId, sipDispatchRuleId, sipDispatchRules, sipInboundTrunkId, sipInboundTrunks, sipOutboundTrunkId, sipOutboundTrunks, sipParticipantSid, sipParticipants, sipTransport, } from "./livekit-data.js";
+import { verifyAccessToken } from "./livekit-token.js";
+// Grant required to authorize each Twirp method (mirrors LiveKit server's auth
+// middleware). null = no specific video grant required beyond a valid token.
+// Exported so the connector's live-execute grant table can be BOUND to it by a test rather than
+// hand-copied and left to drift (§9 finding, 2026-07-26). Nothing at runtime imports it from here.
+export const GRANT_REQUIRED = {
+    'RoomService.CreateRoom': 'roomCreate',
+    'RoomService.DeleteRoom': 'roomCreate',
+    'RoomService.ListRooms': 'roomList',
+    'RoomService.UpdateRoomMetadata': 'roomAdmin',
+    'RoomService.ListParticipants': 'roomAdmin',
+    'RoomService.GetParticipant': 'roomAdmin',
+    'RoomService.RemoveParticipant': 'roomAdmin',
+    'RoomService.UpdateParticipant': 'roomAdmin',
+    'RoomService.MutePublishedTrack': 'roomAdmin',
+    'RoomService.UpdateSubscriptions': 'roomAdmin',
+    'RoomService.SendData': 'roomAdmin',
+    'Egress.StartRoomCompositeEgress': 'roomRecord',
+    'Egress.StartWebEgress': 'roomRecord',
+    'Egress.StartParticipantEgress': 'roomRecord',
+    'Egress.StartTrackCompositeEgress': 'roomRecord',
+    'Egress.StartTrackEgress': 'roomRecord',
+    'Egress.UpdateLayout': 'roomRecord',
+    'Egress.UpdateStream': 'roomRecord',
+    'Egress.StopEgress': 'roomRecord',
+    'Egress.ListEgress': 'roomRecord',
+    'Ingress.CreateIngress': 'ingressAdmin',
+    'Ingress.UpdateIngress': 'ingressAdmin',
+    'Ingress.ListIngress': 'ingressAdmin',
+    'Ingress.DeleteIngress': 'ingressAdmin',
+    // RoomService participant moves require room admin on the source room.
+    'RoomService.ForwardParticipant': 'roomAdmin',
+    'RoomService.MoveParticipant': 'roomAdmin',
+    // Agent dispatch is authorized via the roomAdmin grant (SDK signs with roomAdmin).
+    'AgentDispatchService.CreateDispatch': 'roomAdmin',
+    'AgentDispatchService.DeleteDispatch': 'roomAdmin',
+    'AgentDispatchService.ListDispatch': 'roomAdmin',
+    // SIP services authorize via the SIP grant (admin/call), not a video grant, so
+    // they are intentionally absent here — a valid token is required but no video
+    // grant is checked. (The vendor enforces the SIP grant; the twin's opt-in auth
+    // layer only models video-grant enforcement.)
+};
+function parseBody(body) {
+    if (!body?.trim())
+        return {};
+    try {
+        const parsed = JSON.parse(body);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function twirpError(status, code, msg) {
+    return { status, body: { code, msg, meta: {} } };
+}
+function route(path) {
+    const match = path.match(/^\/twirp\/livekit\.([^/]+)\/([^/?]+)$/);
+    return match ? { service: match[1], method: match[2] } : null;
+}
+function roomJson(room) {
+    return {
+        sid: room.sid,
+        name: room.name,
+        emptyTimeout: room.emptyTimeout,
+        departureTimeout: room.departureTimeout,
+        maxParticipants: room.maxParticipants,
+        creationTime: room.creationTime,
+        creationTimeMs: room.creationTimeMs,
+        metadata: room.metadata,
+        numParticipants: room.numParticipants,
+        activeRecording: room.activeRecording,
+    };
+}
+function participantJson(p) {
+    return {
+        sid: p.sid,
+        identity: p.identity,
+        state: p.state,
+        tracks: p.tracks,
+        metadata: p.metadata,
+        joinedAt: p.joinedAt,
+        joinedAtMs: p.joinedAtMs,
+        name: p.name,
+        version: p.version,
+        isPublisher: p.isPublisher,
+        kind: p.kind,
+        attributes: p.attributes,
+        permission: p.permission,
+        subscribedTracks: p.subscribedTracks,
+    };
+}
+function egressJson(e) {
+    // EgressInfo.request is a protobuf oneof whose JSON encoding is a single
+    // top-level field named after the active case (roomComposite|web|participant|
+    // trackComposite|track). Emitting it that way lets the vendor SDK's
+    // EgressInfo.fromJson() populate `request.case`/`request.value` correctly.
+    return {
+        egressId: e.egressId,
+        roomId: e.roomId,
+        roomName: e.roomName,
+        sourceType: e.sourceType,
+        status: e.status,
+        startedAt: e.startedAt,
+        endedAt: e.endedAt,
+        updatedAt: e.updatedAt,
+        details: e.details,
+        error: e.error,
+        errorCode: e.errorCode,
+        [e.requestCase]: e.request,
+        streamResults: (e.streamUrls ?? []).map((url) => ({ url, status: isActiveEgressStatus(e.status) ? 0 : 1 })),
+        fileResults: [],
+        segmentResults: [],
+        imageResults: [],
+    };
+}
+function ingressJson(i) {
+    return {
+        ingressId: i.ingressId,
+        name: i.name,
+        streamKey: i.streamKey,
+        url: i.url,
+        inputType: i.inputType,
+        bypassTranscoding: i.bypassTranscoding,
+        enableTranscoding: i.enableTranscoding,
+        audio: i.audio,
+        video: i.video,
+        roomName: i.roomName,
+        participantIdentity: i.participantIdentity,
+        participantName: i.participantName,
+        participantMetadata: i.participantMetadata,
+        reusable: i.reusable,
+        enabled: i.enabled,
+        state: i.state,
+    };
+}
+function sipInboundTrunkJson(t) {
+    return {
+        sipTrunkId: t.sipTrunkId,
+        name: t.name,
+        metadata: t.metadata,
+        numbers: t.numbers,
+        allowedAddresses: t.allowedAddresses,
+        allowedNumbers: t.allowedNumbers,
+        authUsername: t.authUsername,
+        authPassword: t.authPassword,
+        headers: t.headers,
+        headersToAttributes: t.headersToAttributes,
+        krispEnabled: t.krispEnabled,
+        includeHeaders: t.includeHeaders,
+        mediaEncryption: t.mediaEncryption,
+    };
+}
+function sipOutboundTrunkJson(t) {
+    return {
+        sipTrunkId: t.sipTrunkId,
+        name: t.name,
+        metadata: t.metadata,
+        address: t.address,
+        transport: t.transport,
+        numbers: t.numbers,
+        authUsername: t.authUsername,
+        authPassword: t.authPassword,
+        headers: t.headers,
+        headersToAttributes: t.headersToAttributes,
+        includeHeaders: t.includeHeaders,
+        mediaEncryption: t.mediaEncryption,
+        destinationCountry: t.destinationCountry,
+    };
+}
+function sipDispatchRuleJson(r) {
+    // The protobuf `rule` oneof JSON-encodes as a single field named after the case.
+    return {
+        sipDispatchRuleId: r.sipDispatchRuleId,
+        rule: { [r.rule.case]: r.rule.value },
+        trunkIds: r.trunkIds,
+        inboundNumbers: r.inboundNumbers,
+        hidePhoneNumber: r.hidePhoneNumber,
+        name: r.name,
+        metadata: r.metadata,
+        attributes: r.attributes,
+        roomPreset: r.roomPreset,
+    };
+}
+// Applies a livekit.ListUpdate to a string list. The oneof-like fields are
+// honored in vendor order: `set` (or `clear`) wholly replaces; otherwise
+// `remove` then `add` (add de-duplicates, matching the vendor comment).
+function applyListUpdate(current, update) {
+    if (!update || typeof update !== 'object')
+        return current;
+    const u = update;
+    if (u.clear === true)
+        return [];
+    if (Array.isArray(u.set))
+        return u.set.map(String);
+    let next = [...current];
+    if (Array.isArray(u.remove)) {
+        const drop = new Set(u.remove.map(String));
+        next = next.filter((n) => !drop.has(n));
+    }
+    if (Array.isArray(u.add)) {
+        for (const item of u.add.map(String))
+            if (!next.includes(item))
+                next.push(item);
+    }
+    return next;
+}
+// Field-merge a scalar: only overwrite when the update field is present
+// (protobuf `optional` semantics — absence means "leave unchanged").
+function mergeScalar(current, update, key, coerce) {
+    return key in update && update[key] !== undefined ? coerce(update[key]) : current;
+}
+function sipParticipantJson(p) {
+    return {
+        participantId: p.participantId,
+        participantIdentity: p.participantIdentity,
+        roomName: p.roomName,
+        sipCallId: p.sipCallId,
+    };
+}
+function agentDispatchJson(a) {
+    return {
+        id: a.dispatchId,
+        agentName: a.agentName,
+        room: a.room,
+        metadata: a.metadata,
+        state: { jobs: [], createdAt: a.createdAt, deletedAt: '0' },
+    };
+}
+async function writeResource(type, id, operation, fields, occurredAt, root) {
+    await applyTwinWrite(SERVICE, {
+        operation,
+        subjectType: type,
+        subjectId: id,
+        fields,
+        occurredAt,
+        actor: { kind: 'system' },
+    }, root);
+}
+async function writeRoom(room, occurredAt, root) {
+    await applyTwinWrite(SERVICE, {
+        operation: 'room.upsert',
+        subjectType: 'room',
+        subjectId: room.id,
+        fields: room,
+        occurredAt,
+        actor: { kind: 'system' },
+    }, root);
+}
+async function writeParticipant(participant, occurredAt, root) {
+    await applyTwinWrite(SERVICE, {
+        operation: 'participant.upsert',
+        subjectType: 'participant',
+        subjectId: participant.id,
+        fields: participant,
+        occurredAt,
+        actor: { kind: 'system' },
+    }, root);
+}
+async function writeEgress(egress, operation, occurredAt, root) {
+    await applyTwinWrite(SERVICE, {
+        operation,
+        subjectType: 'egress',
+        subjectId: egress.id,
+        fields: egress,
+        occurredAt,
+        actor: { kind: 'system' },
+    }, root);
+}
+async function writeIngress(ingress, operation, occurredAt, root) {
+    await applyTwinWrite(SERVICE, {
+        operation,
+        subjectType: 'ingress',
+        subjectId: ingress.id,
+        fields: ingress,
+        occurredAt,
+        actor: { kind: 'system' },
+    }, root);
+}
+function requireRoom(name, root) {
+    return rooms(root).find((r) => r.name === name && !r.deleted) ?? null;
+}
+function latestRoom(name, root) {
+    const matches = rooms(root).filter((r) => r.name === name);
+    return matches[matches.length - 1] ?? null;
+}
+function requireParticipant(roomName, identity, root) {
+    return participants(root).find((p) => p.roomName === roomName && p.identity === identity) ?? null;
+}
+export async function handleLiveKitTwinRequest(req) {
+    const method = req.method.toUpperCase();
+    const url = new URL(req.path, 'http://twin.local');
+    const matched = route(url.pathname);
+    const body = parseBody(req.body);
+    const occurredAt = req.occurredAt ?? FIXED_NOW;
+    if (method !== 'POST' || !matched)
+        return twirpError(404, 'not_found', `LiveKit operation not modeled: ${method} ${url.pathname}`);
+    // Vendor-faithful access-token auth (opt-in: only enforced when apiKeys supplied).
+    // Internal Twin.* seeding endpoints are exempt — they are not part of the vendor surface.
+    if (req.apiKeys && matched.service !== 'Twin') {
+        const now = req.nowSeconds ?? secondsNum(occurredAt);
+        if (!req.authToken)
+            return twirpError(401, 'unauthenticated', 'authorization is required');
+        const result = verifyAccessToken(req.authToken, (k) => req.apiKeys[k], { nowSeconds: now });
+        if (!result.ok) {
+            const msg = result.reason === 'expired' ? 'token expired'
+                : result.reason === 'not_yet_valid' ? 'token not yet valid'
+                    : result.reason === 'unknown_key' ? 'unknown API key'
+                        : 'invalid authorization token';
+            return twirpError(401, 'unauthenticated', msg);
+        }
+        const required = GRANT_REQUIRED[`${matched.service}.${matched.method}`];
+        if (required) {
+            const video = (result.grants.video ?? {});
+            if (!video[required])
+                return twirpError(403, 'permission_denied', `missing required grant: ${required}`);
+        }
+    }
+    if (matched.service === 'Twin' && matched.method === 'UpsertParticipant') {
+        if (req.readOnly)
+            return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+        const roomName = String(body.roomName ?? body.room ?? '');
+        const identity = String(body.identity ?? '');
+        if (!roomName || !identity)
+            return twirpError(400, 'invalid_argument', 'roomName and identity are required');
+        if (!requireRoom(roomName, req.root))
+            await writeRoom(defaultRoom(roomName, occurredAt), occurredAt, req.root);
+        const participant = defaultParticipant(roomName, identity, occurredAt, body);
+        await writeParticipant(participant, occurredAt, req.root);
+        return { status: 200, body: participantJson(participant) };
+    }
+    if (matched.service === 'RoomService') {
+        if (matched.method === 'CreateRoom') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const name = String(body.name ?? '');
+            if (!name)
+                return twirpError(400, 'invalid_argument', 'name is required');
+            const existing = requireRoom(name, req.root);
+            const prior = latestRoom(name, req.root);
+            const generation = existing ? existing.generation : prior?.deleted ? (prior.generation ?? 0) + 1 : 0;
+            const room = existing
+                ? { ...existing, ...defaultRoom(name, existing.creationTimeMs ? new Date(Number(existing.creationTimeMs)).toISOString() : occurredAt, { ...body, generation }), id: existing.id, sid: existing.sid }
+                : defaultRoom(name, occurredAt, { ...body, generation });
+            await writeRoom(room, occurredAt, req.root);
+            return { status: 200, body: roomJson(withCounts(room, req.root)) };
+        }
+        if (matched.method === 'ListRooms') {
+            const names = Array.isArray(body.names) ? body.names.map(String) : [];
+            const listed = rooms(req.root).filter((r) => !r.deleted && (names.length === 0 || names.includes(r.name))).map((r) => roomJson(withCounts(r, req.root)));
+            return { status: 200, body: { rooms: listed } };
+        }
+        if (matched.method === 'DeleteRoom') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const room = String(body.room ?? '');
+            if (!room)
+                return twirpError(400, 'invalid_argument', 'room is required');
+            const existing = requireRoom(room, req.root);
+            if (!existing)
+                return twirpError(404, 'not_found', 'room not found');
+            for (const participant of participants(req.root).filter((p) => p.roomName === room && p.state !== 3)) {
+                await writeParticipant({ ...participant, state: 3 }, occurredAt, req.root);
+            }
+            for (const egress of egresses(req.root).filter((e) => e.roomName === room && (e.status === EGRESS_STATUS.STARTING || e.status === EGRESS_STATUS.ACTIVE || e.status === EGRESS_STATUS.ENDING))) {
+                await writeEgress({ ...egress, status: EGRESS_STATUS.COMPLETE, endedAt: secondsOrZero(occurredAt), updatedAt: secondsOrZero(occurredAt) }, 'egress.room_deleted', occurredAt, req.root);
+            }
+            await writeRoom({ ...existing, deleted: true }, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+        if (matched.method === 'UpdateRoomMetadata') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const name = String(body.room ?? '');
+            const existing = requireRoom(name, req.root);
+            if (!existing)
+                return twirpError(404, 'not_found', 'room not found');
+            const room = { ...existing, metadata: String(body.metadata ?? '') };
+            await writeRoom(room, occurredAt, req.root);
+            return { status: 200, body: roomJson(withCounts(room, req.root)) };
+        }
+        if (matched.method === 'ListParticipants') {
+            const roomName = String(body.room ?? '');
+            if (!roomName)
+                return twirpError(400, 'invalid_argument', 'room is required');
+            if (!requireRoom(roomName, req.root))
+                return twirpError(404, 'not_found', 'room not found');
+            return { status: 200, body: { participants: participants(req.root).filter((p) => p.roomName === roomName && p.state !== 3).map(participantJson) } };
+        }
+        if (matched.method === 'GetParticipant') {
+            const participant = requireParticipant(String(body.room ?? ''), String(body.identity ?? ''), req.root);
+            return participant ? { status: 200, body: participantJson(participant) } : twirpError(404, 'not_found', 'participant not found');
+        }
+        if (matched.method === 'RemoveParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const participant = requireParticipant(String(body.room ?? ''), String(body.identity ?? ''), req.root);
+            if (!participant)
+                return twirpError(404, 'not_found', 'participant not found');
+            await writeParticipant({ ...participant, state: 3 }, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+        if (matched.method === 'UpdateParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const participant = requireParticipant(String(body.room ?? ''), String(body.identity ?? ''), req.root);
+            if (!participant)
+                return twirpError(404, 'not_found', 'participant not found');
+            // permissions are updated atomically — the supplied object fully replaces the prior grant set.
+            const permission = body.permission && typeof body.permission === 'object'
+                ? {
+                    canSubscribe: Boolean(body.permission.canSubscribe ?? false),
+                    canPublish: Boolean(body.permission.canPublish ?? false),
+                    canPublishData: Boolean(body.permission.canPublishData ?? false),
+                    canUpdateMetadata: Boolean(body.permission.canUpdateMetadata ?? false),
+                    hidden: Boolean(body.permission.hidden ?? false),
+                    canSubscribeMetrics: Boolean(body.permission.canSubscribeMetrics ?? false),
+                }
+                : participant.permission;
+            const updated = {
+                ...participant,
+                metadata: body.metadata !== undefined ? String(body.metadata) : participant.metadata,
+                name: body.name !== undefined ? String(body.name) : participant.name,
+                attributes: body.attributes && typeof body.attributes === 'object' ? body.attributes : participant.attributes,
+                permission,
+                isPublisher: permission.canPublish,
+                version: participant.version + 1,
+            };
+            await writeParticipant(updated, occurredAt, req.root);
+            return { status: 200, body: participantJson(updated) };
+        }
+        if (matched.method === 'UpdateSubscriptions') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const participant = requireParticipant(String(body.room ?? ''), String(body.identity ?? ''), req.root);
+            if (!participant)
+                return twirpError(404, 'not_found', 'participant not found');
+            const trackSids = Array.isArray(body.trackSids) ? body.trackSids.map(String) : [];
+            const subscribe = Boolean(body.subscribe);
+            const current = new Set(participant.subscribedTracks);
+            for (const sid of trackSids) {
+                if (subscribe)
+                    current.add(sid);
+                else
+                    current.delete(sid);
+            }
+            const updated = { ...participant, subscribedTracks: [...current], version: participant.version + 1 };
+            await writeParticipant(updated, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+        if (matched.method === 'SendData') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const roomName = String(body.room ?? '');
+            const room = requireRoom(roomName, req.root);
+            if (!room)
+                return twirpError(404, 'not_found', 'room not found');
+            if (body.data === undefined || body.data === null)
+                return twirpError(400, 'invalid_argument', 'data is required');
+            // SendData is fire-and-forget media-plane signalling; the control-plane twin
+            // validates the request and acknowledges (the real server returns an empty body).
+            return { status: 200, body: {} };
+        }
+        if (matched.method === 'MutePublishedTrack') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const participant = requireParticipant(String(body.room ?? ''), String(body.identity ?? ''), req.root);
+            if (!participant)
+                return twirpError(404, 'not_found', 'participant not found');
+            const tracks = participant.tracks.map((track) => track.sid === body.trackSid ? { ...track, muted: Boolean(body.muted) } : track);
+            const track = tracks.find((t) => t.sid === body.trackSid);
+            if (!track)
+                return twirpError(404, 'not_found', 'track not found');
+            await writeParticipant({ ...participant, tracks, version: participant.version + 1 }, occurredAt, req.root);
+            return { status: 200, body: { track } };
+        }
+        // ForwardParticipant: mirror a participant's published tracks into a destination
+        // room. The original participant stays in the source room; a copy appears in the
+        // destination (the real server marks it a forwarded/non-publishing mirror).
+        if (matched.method === 'ForwardParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const sourceRoom = String(body.room ?? '');
+            const identity = String(body.identity ?? '');
+            const destinationRoom = String(body.destinationRoom ?? '');
+            if (!destinationRoom)
+                return twirpError(400, 'invalid_argument', 'destinationRoom is required');
+            const participant = requireParticipant(sourceRoom, identity, req.root);
+            if (!participant)
+                return twirpError(404, 'not_found', 'participant not found');
+            if (!requireRoom(destinationRoom, req.root))
+                await writeRoom(defaultRoom(destinationRoom, occurredAt), occurredAt, req.root);
+            if (requireParticipant(destinationRoom, identity, req.root))
+                return twirpError(409, 'already_exists', 'participant already present in destination room');
+            const mirrored = defaultParticipant(destinationRoom, identity, occurredAt, {
+                ...participant,
+                // A forwarded mirror cannot itself publish into the destination.
+                isPublisher: false,
+                permission: { ...participant.permission, canPublish: false },
+            });
+            await writeParticipant(mirrored, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+        // MoveParticipant: relocate a participant to a destination room — they leave the
+        // source room (disconnected) and appear in the destination room.
+        if (matched.method === 'MoveParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const sourceRoom = String(body.room ?? '');
+            const identity = String(body.identity ?? '');
+            const destinationRoom = String(body.destinationRoom ?? '');
+            if (!destinationRoom)
+                return twirpError(400, 'invalid_argument', 'destinationRoom is required');
+            const participant = requireParticipant(sourceRoom, identity, req.root);
+            if (!participant || participant.state === 3)
+                return twirpError(404, 'not_found', 'participant not found');
+            if (!requireRoom(destinationRoom, req.root))
+                await writeRoom(defaultRoom(destinationRoom, occurredAt), occurredAt, req.root);
+            if (requireParticipant(destinationRoom, identity, req.root))
+                return twirpError(409, 'already_exists', 'participant already present in destination room');
+            // disconnect from source
+            await writeParticipant({ ...participant, state: 3 }, occurredAt, req.root);
+            // appear in destination, preserving identity/name/tracks/permissions
+            const moved = defaultParticipant(destinationRoom, identity, occurredAt, participant);
+            await writeParticipant(moved, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+    }
+    if (matched.service === 'Egress') {
+        const startMap = {
+            StartRoomCompositeEgress: { case: 'roomComposite', sourceType: 0, op: 'egress.start_room_composite' },
+            StartWebEgress: { case: 'web', sourceType: 1, op: 'egress.start_web' },
+            StartParticipantEgress: { case: 'participant', sourceType: 2, op: 'egress.start_participant' },
+            StartTrackCompositeEgress: { case: 'trackComposite', sourceType: 3, op: 'egress.start_track_composite' },
+            StartTrackEgress: { case: 'track', sourceType: 4, op: 'egress.start_track' },
+        };
+        const start = startMap[matched.method];
+        if (start) {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            if (req.maxActiveEgress !== undefined) {
+                const activeCount = egresses(req.root).filter((e) => isActiveEgressStatus(e.status)).length;
+                if (activeCount >= req.maxActiveEgress)
+                    return twirpError(429, 'resource_exhausted', 'egress capacity limit reached');
+            }
+            // Web egress is keyed on a URL and has no backing room; the others require a known room.
+            const roomName = String(body.roomName ?? '');
+            let roomSid = '';
+            if (start.case !== 'web') {
+                const room = requireRoom(roomName, req.root);
+                if (!room)
+                    return twirpError(404, 'not_found', 'room not found');
+                roomSid = room.sid;
+                if (start.case === 'participant') {
+                    if (!body.identity)
+                        return twirpError(400, 'invalid_argument', 'identity is required');
+                }
+                if (start.case === 'trackComposite' && !body.audioTrackId && !body.videoTrackId) {
+                    return twirpError(400, 'invalid_argument', 'audioTrackId or videoTrackId is required');
+                }
+                if (start.case === 'track' && !body.trackId) {
+                    return twirpError(400, 'invalid_argument', 'trackId is required');
+                }
+            }
+            else if (!body.url) {
+                return twirpError(400, 'invalid_argument', 'url is required');
+            }
+            const sequence = egresses(req.root).length + 1;
+            const id = egressId(roomName || String(body.url ?? ''), body, occurredAt, sequence);
+            const streamUrls = collectStreamUrls(body);
+            const egress = {
+                id: egressResourceId(id),
+                egressId: id,
+                roomId: roomSid,
+                roomName,
+                sourceType: start.sourceType,
+                status: EGRESS_STATUS.ACTIVE,
+                startedAt: secondsOrZero(occurredAt),
+                endedAt: '0',
+                updatedAt: secondsOrZero(occurredAt),
+                details: '',
+                error: '',
+                errorCode: 0,
+                layout: String(body.layout ?? ''),
+                requestCase: start.case,
+                streamUrls,
+                fileOutputs: Array.isArray(body.fileOutputs) ? body.fileOutputs : [],
+                streamOutputs: Array.isArray(body.streamOutputs) ? body.streamOutputs : [],
+                segmentOutputs: Array.isArray(body.segmentOutputs) ? body.segmentOutputs : [],
+                imageOutputs: Array.isArray(body.imageOutputs) ? body.imageOutputs : [],
+                request: body,
+            };
+            await writeEgress(egress, start.op, occurredAt, req.root);
+            return { status: 200, body: egressJson(egress) };
+        }
+        if (matched.method === 'ListEgress') {
+            const roomName = body.roomName === undefined ? '' : String(body.roomName);
+            const id = body.egressId === undefined ? '' : String(body.egressId);
+            const active = body.active === undefined ? null : Boolean(body.active);
+            const rows = egresses(req.root).filter((e) => {
+                if (roomName && e.roomName !== roomName)
+                    return false;
+                if (id && e.egressId !== id)
+                    return false;
+                if (active !== null && active !== isActiveEgressStatus(e.status))
+                    return false;
+                return true;
+            });
+            return { status: 200, body: { items: rows.map(egressJson) } };
+        }
+        if (matched.method === 'StopEgress') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = egresses(req.root).find((e) => e.egressId === String(body.egressId ?? ''));
+            if (!existing)
+                return twirpError(404, 'not_found', 'egress not found');
+            if (!isActiveEgressStatus(existing.status))
+                return twirpError(412, 'failed_precondition', 'egress is not active');
+            const updated = { ...existing, status: EGRESS_STATUS.COMPLETE, endedAt: secondsOrZero(occurredAt), updatedAt: secondsOrZero(occurredAt) };
+            await writeEgress(updated, 'egress.stop', occurredAt, req.root);
+            return { status: 200, body: egressJson(updated) };
+        }
+        if (matched.method === 'UpdateLayout') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = egresses(req.root).find((e) => e.egressId === String(body.egressId ?? ''));
+            if (!existing)
+                return twirpError(404, 'not_found', 'egress not found');
+            const updated = { ...existing, layout: String(body.layout ?? ''), updatedAt: secondsOrZero(occurredAt), request: { ...existing.request, layout: String(body.layout ?? '') } };
+            await writeEgress(updated, 'egress.update_layout', occurredAt, req.root);
+            return { status: 200, body: egressJson(updated) };
+        }
+        if (matched.method === 'UpdateStream') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = egresses(req.root).find((e) => e.egressId === String(body.egressId ?? ''));
+            if (!existing)
+                return twirpError(404, 'not_found', 'egress not found');
+            if (!isActiveEgressStatus(existing.status))
+                return twirpError(412, 'failed_precondition', 'egress is not active');
+            const add = Array.isArray(body.addOutputUrls) ? body.addOutputUrls.map(String) : [];
+            const remove = new Set(Array.isArray(body.removeOutputUrls) ? body.removeOutputUrls.map(String) : []);
+            const streamUrls = [...existing.streamUrls.filter((u) => !remove.has(u)), ...add.filter((u) => !existing.streamUrls.includes(u))];
+            const updated = { ...existing, streamUrls, updatedAt: secondsOrZero(occurredAt) };
+            await writeEgress(updated, 'egress.update_stream', occurredAt, req.root);
+            return { status: 200, body: egressJson(updated) };
+        }
+        // Twin-only: force an egress into a terminal failure state for failure-path testing.
+        if (matched.method === 'FailEgress') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = egresses(req.root).find((e) => e.egressId === String(body.egressId ?? ''));
+            if (!existing)
+                return twirpError(404, 'not_found', 'egress not found');
+            const status = Number(body.status ?? EGRESS_STATUS.FAILED);
+            if (status !== EGRESS_STATUS.FAILED && status !== EGRESS_STATUS.ABORTED && status !== EGRESS_STATUS.LIMIT_REACHED) {
+                return twirpError(400, 'invalid_argument', 'status must be a terminal failure state');
+            }
+            const updated = {
+                ...existing,
+                status,
+                error: String(body.error ?? 'egress failed'),
+                errorCode: Number(body.errorCode ?? 1),
+                endedAt: secondsOrZero(occurredAt),
+                updatedAt: secondsOrZero(occurredAt),
+            };
+            await writeEgress(updated, 'egress.fail', occurredAt, req.root);
+            return { status: 200, body: egressJson(updated) };
+        }
+    }
+    if (matched.service === 'Ingress') {
+        if (matched.method === 'CreateIngress') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const inputType = ingressInput(body.inputType ?? body.input_type);
+            const identity = String(body.participantIdentity ?? '');
+            if (!identity)
+                return twirpError(400, 'invalid_argument', 'participantIdentity is required');
+            if (inputType === INGRESS_INPUT.URL_INPUT && !body.url)
+                return twirpError(400, 'invalid_argument', 'url is required for URL input');
+            const sequence = ingresses(req.root).length + 1;
+            const id = ingressId(String(body.roomName ?? ''), identity, body, sequence);
+            const ingress = defaultIngress(id, inputType, occurredAt, body);
+            await writeIngress(ingress, 'ingress.create', occurredAt, req.root);
+            return { status: 200, body: ingressJson(ingress) };
+        }
+        if (matched.method === 'UpdateIngress') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = ingresses(req.root).find((i) => i.ingressId === String(body.ingressId ?? '') && !i.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'ingress not found');
+            const enableTranscoding = body.enableTranscoding !== undefined ? Boolean(body.enableTranscoding) : existing.enableTranscoding;
+            const updated = {
+                ...existing,
+                name: body.name !== undefined ? String(body.name) : existing.name,
+                roomName: body.roomName !== undefined ? String(body.roomName) : existing.roomName,
+                participantIdentity: body.participantIdentity !== undefined ? String(body.participantIdentity) : existing.participantIdentity,
+                participantName: body.participantName !== undefined ? String(body.participantName) : existing.participantName,
+                participantMetadata: body.participantMetadata !== undefined ? String(body.participantMetadata) : existing.participantMetadata,
+                enableTranscoding,
+                bypassTranscoding: !enableTranscoding,
+                enabled: body.enabled !== undefined ? Boolean(body.enabled) : existing.enabled,
+                audio: body.audio && typeof body.audio === 'object' ? body.audio : existing.audio,
+                video: body.video && typeof body.video === 'object' ? body.video : existing.video,
+            };
+            await writeIngress(updated, 'ingress.update', occurredAt, req.root);
+            return { status: 200, body: ingressJson(updated) };
+        }
+        if (matched.method === 'ListIngress') {
+            const roomName = body.roomName === undefined ? '' : String(body.roomName);
+            const id = body.ingressId === undefined ? '' : String(body.ingressId);
+            const rows = ingresses(req.root).filter((i) => {
+                if (i.deleted)
+                    return false;
+                if (roomName && i.roomName !== roomName)
+                    return false;
+                if (id && i.ingressId !== id)
+                    return false;
+                return true;
+            });
+            return { status: 200, body: { items: rows.map(ingressJson) } };
+        }
+        if (matched.method === 'DeleteIngress') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = ingresses(req.root).find((i) => i.ingressId === String(body.ingressId ?? '') && !i.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'ingress not found');
+            const updated = { ...existing, deleted: true, state: { ...existing.state, status: INGRESS_STATUS.ENDPOINT_COMPLETE, endedAt: secondsOrZero(occurredAt), updatedAt: secondsOrZero(occurredAt) } };
+            await writeIngress(updated, 'ingress.delete', occurredAt, req.root);
+            return { status: 200, body: ingressJson(updated) };
+        }
+    }
+    // --- SIP (SIPService Twirp surface) -------------------------------------
+    if (matched.service === 'SIP') {
+        if (matched.method === 'CreateSIPInboundTrunk') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const trunk = (body.trunk && typeof body.trunk === 'object' ? body.trunk : body);
+            const numbers = Array.isArray(trunk.numbers) ? trunk.numbers.map(String) : [];
+            if (numbers.length === 0)
+                return twirpError(400, 'invalid_argument', 'inbound trunk requires at least one number');
+            const sequence = sipInboundTrunks(req.root).length + 1;
+            const id = sipInboundTrunkId(String(trunk.name ?? ''), numbers, sequence);
+            const row = {
+                id: `sip_inbound_trunk_${id}`,
+                sipTrunkId: id,
+                name: String(trunk.name ?? ''),
+                metadata: String(trunk.metadata ?? ''),
+                numbers,
+                allowedAddresses: Array.isArray(trunk.allowedAddresses) ? trunk.allowedAddresses.map(String) : [],
+                allowedNumbers: Array.isArray(trunk.allowedNumbers) ? trunk.allowedNumbers.map(String) : [],
+                authUsername: String(trunk.authUsername ?? ''),
+                authPassword: String(trunk.authPassword ?? ''),
+                headers: trunk.headers && typeof trunk.headers === 'object' ? trunk.headers : {},
+                headersToAttributes: trunk.headersToAttributes && typeof trunk.headersToAttributes === 'object' ? trunk.headersToAttributes : {},
+                krispEnabled: Boolean(trunk.krispEnabled ?? false),
+                includeHeaders: String(trunk.includeHeaders ?? 'SIP_NO_HEADERS'),
+                mediaEncryption: String(trunk.mediaEncryption ?? 'SIP_MEDIA_ENCRYPT_DISABLE'),
+            };
+            await writeResource('sip_inbound_trunk', row.id, 'sip.inbound_trunk.create', row, occurredAt, req.root);
+            return { status: 200, body: sipInboundTrunkJson(row) };
+        }
+        if (matched.method === 'CreateSIPOutboundTrunk') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const trunk = (body.trunk && typeof body.trunk === 'object' ? body.trunk : body);
+            const address = String(trunk.address ?? '');
+            if (!address)
+                return twirpError(400, 'invalid_argument', 'outbound trunk requires an address');
+            const sequence = sipOutboundTrunks(req.root).length + 1;
+            const id = sipOutboundTrunkId(String(trunk.name ?? ''), address, sequence);
+            const row = {
+                id: `sip_outbound_trunk_${id}`,
+                sipTrunkId: id,
+                name: String(trunk.name ?? ''),
+                metadata: String(trunk.metadata ?? ''),
+                address,
+                transport: sipTransport(trunk.transport ?? SIP_TRANSPORT.SIP_TRANSPORT_AUTO),
+                numbers: Array.isArray(trunk.numbers) ? trunk.numbers.map(String) : [],
+                authUsername: String(trunk.authUsername ?? ''),
+                authPassword: String(trunk.authPassword ?? ''),
+                headers: trunk.headers && typeof trunk.headers === 'object' ? trunk.headers : {},
+                headersToAttributes: trunk.headersToAttributes && typeof trunk.headersToAttributes === 'object' ? trunk.headersToAttributes : {},
+                includeHeaders: String(trunk.includeHeaders ?? 'SIP_NO_HEADERS'),
+                mediaEncryption: String(trunk.mediaEncryption ?? 'SIP_MEDIA_ENCRYPT_DISABLE'),
+                destinationCountry: String(trunk.destinationCountry ?? ''),
+            };
+            await writeResource('sip_outbound_trunk', row.id, 'sip.outbound_trunk.create', row, occurredAt, req.root);
+            return { status: 200, body: sipOutboundTrunkJson(row) };
+        }
+        if (matched.method === 'UpdateSIPInboundTrunk') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const id = String(body.sipTrunkId ?? '');
+            const existing = sipInboundTrunks(req.root).find((t) => t.sipTrunkId === id && !t.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'sip inbound trunk not found');
+            let next;
+            if (body.replace && typeof body.replace === 'object') {
+                // Full replace: a complete SIPInboundTrunkInfo overwrites everything but identity.
+                const r = body.replace;
+                next = {
+                    ...existing,
+                    name: String(r.name ?? ''),
+                    metadata: String(r.metadata ?? ''),
+                    numbers: Array.isArray(r.numbers) ? r.numbers.map(String) : [],
+                    allowedAddresses: Array.isArray(r.allowedAddresses) ? r.allowedAddresses.map(String) : [],
+                    allowedNumbers: Array.isArray(r.allowedNumbers) ? r.allowedNumbers.map(String) : [],
+                    authUsername: String(r.authUsername ?? ''),
+                    authPassword: String(r.authPassword ?? ''),
+                    headers: r.headers && typeof r.headers === 'object' ? r.headers : {},
+                    headersToAttributes: r.headersToAttributes && typeof r.headersToAttributes === 'object' ? r.headersToAttributes : {},
+                    krispEnabled: Boolean(r.krispEnabled ?? false),
+                    includeHeaders: String(r.includeHeaders ?? 'SIP_NO_HEADERS'),
+                    mediaEncryption: String(r.mediaEncryption ?? 'SIP_MEDIA_ENCRYPT_DISABLE'),
+                };
+            }
+            else if (body.update && typeof body.update === 'object') {
+                // Field merge: scalars overwrite only when present; lists use ListUpdate.
+                const u = body.update;
+                next = {
+                    ...existing,
+                    numbers: applyListUpdate(existing.numbers, u.numbers),
+                    allowedAddresses: applyListUpdate(existing.allowedAddresses, u.allowedAddresses),
+                    allowedNumbers: applyListUpdate(existing.allowedNumbers, u.allowedNumbers),
+                    authUsername: mergeScalar(existing.authUsername, u, 'authUsername', String),
+                    authPassword: mergeScalar(existing.authPassword, u, 'authPassword', String),
+                    name: mergeScalar(existing.name, u, 'name', String),
+                    metadata: mergeScalar(existing.metadata, u, 'metadata', String),
+                    mediaEncryption: mergeScalar(existing.mediaEncryption, u, 'mediaEncryption', String),
+                };
+            }
+            else {
+                return twirpError(400, 'invalid_argument', 'update requires a replace or update action');
+            }
+            await writeResource('sip_inbound_trunk', existing.id, 'sip.inbound_trunk.update', next, occurredAt, req.root);
+            return { status: 200, body: sipInboundTrunkJson(next) };
+        }
+        if (matched.method === 'UpdateSIPOutboundTrunk') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const id = String(body.sipTrunkId ?? '');
+            const existing = sipOutboundTrunks(req.root).find((t) => t.sipTrunkId === id && !t.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'sip outbound trunk not found');
+            let next;
+            if (body.replace && typeof body.replace === 'object') {
+                const r = body.replace;
+                next = {
+                    ...existing,
+                    name: String(r.name ?? ''),
+                    metadata: String(r.metadata ?? ''),
+                    address: String(r.address ?? ''),
+                    transport: sipTransport(r.transport ?? SIP_TRANSPORT.SIP_TRANSPORT_AUTO),
+                    numbers: Array.isArray(r.numbers) ? r.numbers.map(String) : [],
+                    authUsername: String(r.authUsername ?? ''),
+                    authPassword: String(r.authPassword ?? ''),
+                    headers: r.headers && typeof r.headers === 'object' ? r.headers : {},
+                    headersToAttributes: r.headersToAttributes && typeof r.headersToAttributes === 'object' ? r.headersToAttributes : {},
+                    includeHeaders: String(r.includeHeaders ?? 'SIP_NO_HEADERS'),
+                    mediaEncryption: String(r.mediaEncryption ?? 'SIP_MEDIA_ENCRYPT_DISABLE'),
+                    destinationCountry: String(r.destinationCountry ?? ''),
+                };
+            }
+            else if (body.update && typeof body.update === 'object') {
+                const u = body.update;
+                next = {
+                    ...existing,
+                    numbers: applyListUpdate(existing.numbers, u.numbers),
+                    address: mergeScalar(existing.address, u, 'address', String),
+                    transport: 'transport' in u && u.transport !== undefined ? sipTransport(u.transport) : existing.transport,
+                    destinationCountry: mergeScalar(existing.destinationCountry, u, 'destinationCountry', String),
+                    authUsername: mergeScalar(existing.authUsername, u, 'authUsername', String),
+                    authPassword: mergeScalar(existing.authPassword, u, 'authPassword', String),
+                    name: mergeScalar(existing.name, u, 'name', String),
+                    metadata: mergeScalar(existing.metadata, u, 'metadata', String),
+                    mediaEncryption: mergeScalar(existing.mediaEncryption, u, 'mediaEncryption', String),
+                };
+            }
+            else {
+                return twirpError(400, 'invalid_argument', 'update requires a replace or update action');
+            }
+            await writeResource('sip_outbound_trunk', existing.id, 'sip.outbound_trunk.update', next, occurredAt, req.root);
+            return { status: 200, body: sipOutboundTrunkJson(next) };
+        }
+        if (matched.method === 'ListSIPInboundTrunk') {
+            const ids = Array.isArray(body.trunkIds) ? body.trunkIds.map(String) : [];
+            const numbers = Array.isArray(body.numbers) ? body.numbers.map(String) : [];
+            const items = sipInboundTrunks(req.root).filter((t) => !t.deleted
+                && (ids.length === 0 || ids.includes(t.sipTrunkId))
+                && (numbers.length === 0 || t.numbers.some((n) => numbers.includes(n))));
+            return { status: 200, body: { items: items.map(sipInboundTrunkJson) } };
+        }
+        if (matched.method === 'ListSIPOutboundTrunk') {
+            const ids = Array.isArray(body.trunkIds) ? body.trunkIds.map(String) : [];
+            const numbers = Array.isArray(body.numbers) ? body.numbers.map(String) : [];
+            const items = sipOutboundTrunks(req.root).filter((t) => !t.deleted
+                && (ids.length === 0 || ids.includes(t.sipTrunkId))
+                && (numbers.length === 0 || t.numbers.some((n) => numbers.includes(n))));
+            return { status: 200, body: { items: items.map(sipOutboundTrunkJson) } };
+        }
+        if (matched.method === 'DeleteSIPTrunk') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const id = String(body.sipTrunkId ?? '');
+            const inbound = sipInboundTrunks(req.root).find((t) => t.sipTrunkId === id && !t.deleted);
+            if (inbound) {
+                await writeResource('sip_inbound_trunk', inbound.id, 'sip.inbound_trunk.delete', { ...inbound, deleted: true }, occurredAt, req.root);
+                return { status: 200, body: sipInboundTrunkJson(inbound) };
+            }
+            const outbound = sipOutboundTrunks(req.root).find((t) => t.sipTrunkId === id && !t.deleted);
+            if (outbound) {
+                await writeResource('sip_outbound_trunk', outbound.id, 'sip.outbound_trunk.delete', { ...outbound, deleted: true }, occurredAt, req.root);
+                return { status: 200, body: sipOutboundTrunkJson(outbound) };
+            }
+            return twirpError(404, 'not_found', 'sip trunk not found');
+        }
+        if (matched.method === 'CreateSIPDispatchRule') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            // `rule` is a oneof JSON-encoded as { dispatchRuleDirect: {...} } or { dispatchRuleIndividual: {...} }.
+            const ruleObj = body.rule && typeof body.rule === 'object' ? body.rule : {};
+            let ruleCase = null;
+            let ruleValue = {};
+            if (ruleObj.dispatchRuleDirect && typeof ruleObj.dispatchRuleDirect === 'object') {
+                ruleCase = 'dispatchRuleDirect';
+                ruleValue = { roomName: String(ruleObj.dispatchRuleDirect.roomName ?? ''), pin: String(ruleObj.dispatchRuleDirect.pin ?? '') };
+                if (!ruleValue.roomName)
+                    return twirpError(400, 'invalid_argument', 'direct dispatch rule requires roomName');
+            }
+            else if (ruleObj.dispatchRuleIndividual && typeof ruleObj.dispatchRuleIndividual === 'object') {
+                ruleCase = 'dispatchRuleIndividual';
+                ruleValue = { roomPrefix: String(ruleObj.dispatchRuleIndividual.roomPrefix ?? ''), pin: String(ruleObj.dispatchRuleIndividual.pin ?? '') };
+            }
+            if (!ruleCase)
+                return twirpError(400, 'invalid_argument', 'dispatch rule requires a direct or individual rule');
+            const sequence = sipDispatchRules(req.root).length + 1;
+            const id = sipDispatchRuleId(body, sequence);
+            const row = {
+                id: `sip_dispatch_rule_${id}`,
+                sipDispatchRuleId: id,
+                name: String(body.name ?? ''),
+                metadata: String(body.metadata ?? ''),
+                trunkIds: Array.isArray(body.trunkIds) ? body.trunkIds.map(String) : [],
+                hidePhoneNumber: Boolean(body.hidePhoneNumber ?? false),
+                attributes: body.attributes && typeof body.attributes === 'object' ? body.attributes : {},
+                roomPreset: String(body.roomPreset ?? ''),
+                inboundNumbers: Array.isArray(body.inboundNumbers) ? body.inboundNumbers.map(String) : [],
+                rule: { case: ruleCase, value: ruleValue },
+            };
+            await writeResource('sip_dispatch_rule', row.id, 'sip.dispatch_rule.create', row, occurredAt, req.root);
+            return { status: 200, body: sipDispatchRuleJson(row) };
+        }
+        if (matched.method === 'ListSIPDispatchRule') {
+            const ids = Array.isArray(body.dispatchRuleIds) ? body.dispatchRuleIds.map(String) : [];
+            const trunkIds = Array.isArray(body.trunkIds) ? body.trunkIds.map(String) : [];
+            const items = sipDispatchRules(req.root).filter((r) => !r.deleted
+                && (ids.length === 0 || ids.includes(r.sipDispatchRuleId))
+                // wildcard rules (no trunkIds) match any trunk filter
+                && (trunkIds.length === 0 || r.trunkIds.length === 0 || r.trunkIds.some((t) => trunkIds.includes(t))));
+            return { status: 200, body: { items: items.map(sipDispatchRuleJson) } };
+        }
+        if (matched.method === 'UpdateSIPDispatchRule') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const id = String(body.sipDispatchRuleId ?? '');
+            const existing = sipDispatchRules(req.root).find((r) => r.sipDispatchRuleId === id && !r.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'sip dispatch rule not found');
+            // Parse a `rule` oneof ({ dispatchRuleDirect } | { dispatchRuleIndividual }).
+            const parseRule = (ruleObj) => {
+                if (ruleObj.dispatchRuleDirect && typeof ruleObj.dispatchRuleDirect === 'object') {
+                    const d = ruleObj.dispatchRuleDirect;
+                    if (!d.roomName)
+                        return null;
+                    return { case: 'dispatchRuleDirect', value: { roomName: String(d.roomName), pin: String(d.pin ?? '') } };
+                }
+                if (ruleObj.dispatchRuleIndividual && typeof ruleObj.dispatchRuleIndividual === 'object') {
+                    const i = ruleObj.dispatchRuleIndividual;
+                    return { case: 'dispatchRuleIndividual', value: { roomPrefix: String(i.roomPrefix ?? ''), pin: String(i.pin ?? '') } };
+                }
+                return null;
+            };
+            let next;
+            if (body.replace && typeof body.replace === 'object') {
+                const r = body.replace;
+                const rule = r.rule && typeof r.rule === 'object' ? parseRule(r.rule) : null;
+                if (!rule)
+                    return twirpError(400, 'invalid_argument', 'dispatch rule requires a direct or individual rule');
+                next = {
+                    ...existing,
+                    name: String(r.name ?? ''),
+                    metadata: String(r.metadata ?? ''),
+                    trunkIds: Array.isArray(r.trunkIds) ? r.trunkIds.map(String) : [],
+                    hidePhoneNumber: Boolean(r.hidePhoneNumber ?? false),
+                    attributes: r.attributes && typeof r.attributes === 'object' ? r.attributes : {},
+                    roomPreset: String(r.roomPreset ?? ''),
+                    inboundNumbers: Array.isArray(r.inboundNumbers) ? r.inboundNumbers.map(String) : [],
+                    rule,
+                };
+            }
+            else if (body.update && typeof body.update === 'object') {
+                const u = body.update;
+                let rule = existing.rule;
+                if (u.rule && typeof u.rule === 'object') {
+                    const parsed = parseRule(u.rule);
+                    if (!parsed)
+                        return twirpError(400, 'invalid_argument', 'dispatch rule requires a direct or individual rule');
+                    rule = parsed;
+                }
+                next = {
+                    ...existing,
+                    trunkIds: applyListUpdate(existing.trunkIds, u.trunkIds),
+                    name: mergeScalar(existing.name, u, 'name', String),
+                    metadata: mergeScalar(existing.metadata, u, 'metadata', String),
+                    attributes: u.attributes && typeof u.attributes === 'object' ? u.attributes : existing.attributes,
+                    rule,
+                };
+            }
+            else {
+                return twirpError(400, 'invalid_argument', 'update requires a replace or update action');
+            }
+            await writeResource('sip_dispatch_rule', existing.id, 'sip.dispatch_rule.update', next, occurredAt, req.root);
+            return { status: 200, body: sipDispatchRuleJson(next) };
+        }
+        if (matched.method === 'DeleteSIPDispatchRule') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = sipDispatchRules(req.root).find((r) => r.sipDispatchRuleId === String(body.sipDispatchRuleId ?? '') && !r.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'sip dispatch rule not found');
+            await writeResource('sip_dispatch_rule', existing.id, 'sip.dispatch_rule.delete', { ...existing, deleted: true }, occurredAt, req.root);
+            return { status: 200, body: sipDispatchRuleJson(existing) };
+        }
+        if (matched.method === 'CreateSIPParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const trunkId = String(body.sipTrunkId ?? '');
+            const roomName = String(body.roomName ?? '');
+            const sipCallTo = String(body.sipCallTo ?? '');
+            if (!roomName)
+                return twirpError(400, 'invalid_argument', 'roomName is required');
+            if (!sipCallTo)
+                return twirpError(400, 'invalid_argument', 'sipCallTo (number to dial) is required');
+            // Dialing requires a known outbound trunk (unless a trunk config is inlined).
+            const hasTrunk = trunkId
+                ? sipOutboundTrunks(req.root).some((t) => t.sipTrunkId === trunkId && !t.deleted)
+                : (body.trunk && typeof body.trunk === 'object');
+            if (!hasTrunk)
+                return twirpError(404, 'not_found', 'sip outbound trunk not found');
+            if (!requireRoom(roomName, req.root))
+                await writeRoom(defaultRoom(roomName, occurredAt), occurredAt, req.root);
+            const identity = String(body.participantIdentity ?? 'sip-participant');
+            const sequence = sipParticipants(req.root).length + 1;
+            const callId = sipCallId(roomName, sipCallTo, sequence);
+            const row = {
+                id: `sip_participant_${callId}`,
+                participantId: sipParticipantSid(roomName, identity),
+                participantIdentity: identity,
+                roomName,
+                sipCallId: callId,
+                sipTrunkId: trunkId,
+                sipCallTo,
+                fromNumber: String(body.sipNumber ?? body.fromNumber ?? ''),
+            };
+            await writeResource('sip_participant', row.id, 'sip.participant.create', row, occurredAt, req.root);
+            // The dialed SIP caller also appears as a room participant (kind=SIP).
+            const roomParticipant = defaultParticipant(roomName, identity, occurredAt, {
+                name: String(body.participantName ?? identity),
+                kind: 3, // ParticipantInfo.Kind.SIP
+                attributes: body.participantAttributes && typeof body.participantAttributes === 'object' ? body.participantAttributes : {},
+                metadata: String(body.participantMetadata ?? ''),
+            });
+            await writeParticipant({ ...roomParticipant, sid: row.participantId }, occurredAt, req.root);
+            return { status: 200, body: sipParticipantJson(row) };
+        }
+        if (matched.method === 'TransferSIPParticipant') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const roomName = String(body.roomName ?? '');
+            const identity = String(body.participantIdentity ?? '');
+            const transferTo = String(body.transferTo ?? '');
+            if (!transferTo)
+                return twirpError(400, 'invalid_argument', 'transferTo is required');
+            const participant = requireParticipant(roomName, identity, req.root);
+            if (!participant || participant.state === 3)
+                return twirpError(404, 'not_found', 'sip participant not found');
+            // Transfer is a media-plane operation; the control-plane twin records the
+            // transfer destination on the participant attributes and acks (empty body).
+            const attributes = { ...participant.attributes, 'sip.transferTo': transferTo };
+            await writeParticipant({ ...participant, attributes, version: participant.version + 1 }, occurredAt, req.root);
+            return { status: 200, body: {} };
+        }
+    }
+    // --- Agent dispatch (AgentDispatchService Twirp surface) ----------------
+    if (matched.service === 'AgentDispatchService') {
+        if (matched.method === 'CreateDispatch') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const room = String(body.room ?? '');
+            const agentName = String(body.agentName ?? '');
+            if (!room)
+                return twirpError(400, 'invalid_argument', 'room is required');
+            if (!agentName)
+                return twirpError(400, 'invalid_argument', 'agentName is required');
+            const sequence = agentDispatches(req.root).length + 1;
+            const id = agentDispatchId(room, agentName, sequence);
+            const row = {
+                id: `agent_dispatch_${id}`,
+                dispatchId: id,
+                agentName,
+                room,
+                metadata: String(body.metadata ?? ''),
+                createdAt: secondsOrZero(occurredAt),
+            };
+            await writeResource('agent_dispatch', row.id, 'agent.dispatch.create', row, occurredAt, req.root);
+            return { status: 200, body: agentDispatchJson(row) };
+        }
+        if (matched.method === 'ListDispatch') {
+            const room = body.room === undefined ? '' : String(body.room);
+            const dispatchId = body.dispatchId === undefined ? '' : String(body.dispatchId);
+            const items = agentDispatches(req.root).filter((a) => !a.deleted
+                && (room === '' || a.room === room)
+                && (dispatchId === '' || a.dispatchId === dispatchId));
+            return { status: 200, body: { agentDispatches: items.map(agentDispatchJson) } };
+        }
+        if (matched.method === 'DeleteDispatch') {
+            if (req.readOnly)
+                return twirpError(405, 'permission_denied', 'LiveKit twin is read-only');
+            const existing = agentDispatches(req.root).find((a) => a.dispatchId === String(body.dispatchId ?? '') && !a.deleted);
+            if (!existing)
+                return twirpError(404, 'not_found', 'agent dispatch not found');
+            await writeResource('agent_dispatch', existing.id, 'agent.dispatch.delete', { ...existing, deleted: true }, occurredAt, req.root);
+            return { status: 200, body: agentDispatchJson(existing) };
+        }
+    }
+    return twirpError(404, 'not_found', `LiveKit operation not modeled: ${matched.service}.${matched.method}`);
+}
+function collectStreamUrls(body) {
+    const urls = [];
+    const outputs = Array.isArray(body.streamOutputs) ? body.streamOutputs : [];
+    for (const out of outputs) {
+        if (out && typeof out === 'object' && Array.isArray(out.urls))
+            urls.push(...out.urls.map(String));
+    }
+    if (body.stream && typeof body.stream === 'object' && Array.isArray(body.stream.urls))
+        urls.push(...body.stream.urls.map(String));
+    return urls;
+}
+function secondsOrZero(iso) {
+    const value = Math.floor(new Date(iso).getTime() / 1000);
+    return Number.isFinite(value) ? String(value) : '0';
+}
+function secondsNum(iso) {
+    const value = Math.floor(new Date(iso).getTime() / 1000);
+    return Number.isFinite(value) ? value : 0;
+}