@a5c-ai/kradle 5.0.1-staging.3abdf9534c25

package/src/jitsi-agent-bridge.js

@@ -0,0 +1,141 @@
+import crypto from 'node:crypto';
+
+const DEFAULT_SIDECAR_IMAGE = 'ghcr.io/a5c-ai/jitsi-agent-sidecar:latest';
+const SOCKET_PATH = '/tmp/jitsi-agent.sock';
+const DEFAULT_TTL_MINUTES = 60;
+
+function isoNow(now) {
+  return (typeof now === 'function' ? now() : new Date()).toISOString();
+}
+
+export function createJitsiAgentBridge(options = {}) {
+  const {
+    meetingController,
+    dispatchController,
+    eventBus,
+    sidecarImage = process.env.KRADLE_JITSI_AGENT_SIDECAR_IMAGE || DEFAULT_SIDECAR_IMAGE,
+    now = () => new Date(),
+  } = options;
+
+  async function resolveMeeting(meetingRef, resources = {}) {
+    const meeting = await meetingController?.getMeeting?.(meetingRef);
+    if (meeting) return meeting;
+    return (resources.JitsiMeeting || []).find((candidate) => (
+      candidate.metadata?.name === meetingRef || candidate.spec?.roomId === meetingRef
+    )) || null;
+  }
+
+  function generateParticipantJwt(roomId, participant, ttlMinutes) {
+    if (meetingController?.generateParticipantJwt) {
+      return meetingController.generateParticipantJwt(roomId, participant, ttlMinutes);
+    }
+    const exp = Math.floor(now().getTime() / 1000) + Math.max(1, Number(ttlMinutes) || DEFAULT_TTL_MINUTES) * 60;
+    const claims = {
+      aud: 'jitsi',
+      iss: 'kradle',
+      sub: participant.org || 'kradle',
+      room: roomId,
+      exp,
+      context: {
+        user: {
+          id: participant.id,
+          name: participant.name,
+          type: 'agent',
+          role: participant.role || 'observer',
+          avatar: participant.avatar || '',
+        },
+      },
+    };
+    const encoded = Buffer.from(JSON.stringify(claims)).toString('base64url');
+    const secret = process.env.KRADLE_JITSI_JWT_SECRET || process.env.JITSI_JWT_SECRET || 'dev-jitsi-secret';
+    const signature = crypto.createHmac('sha256', secret).update(encoded).digest('base64url');
+    return `kradle-jitsi.${encoded}.${signature}`;
+  }
+
+  return {
+    role: 'jitsi-agent-bridge',
+
+    hasMeetingCapability(stack) {
+      return stack?.spec?.jitsiCapability === true;
+    },
+
+    async prepareMeetingContext(dispatchRun, meetingRef, stack = {}, { resources = {} } = {}) {
+      if (!meetingRef) return null;
+      if (!this.hasMeetingCapability(stack)) return null;
+      const meeting = await resolveMeeting(meetingRef, resources);
+      if (!meeting || meeting.status?.phase !== 'Active') {
+        throw new Error(`Meeting ${meetingRef} is not active`);
+      }
+      const participantName = stack.spec?.jitsiConfig?.participantName || stack.metadata?.name || dispatchRun.metadata?.name;
+      const participant = {
+        id: dispatchRun.metadata?.name,
+        name: participantName,
+        type: 'agent',
+        role: stack.spec?.jitsiConfig?.role || 'observer',
+      };
+      const jwt = generateParticipantJwt(
+        meeting.spec.roomId,
+        participant,
+        meeting.spec.ttlMinutes || 120,
+      );
+      const context = {
+        roomUrl: meeting.status.roomUrl,
+        roomId: meeting.spec.roomId,
+        jwt,
+        participantName,
+        role: participant.role,
+        capabilities: stack.spec?.jitsiConfig?.capabilities || {},
+      };
+      dispatchRun.spec.meetingRef = meetingRef;
+      dispatchRun.spec.meetingContext = {
+        roomUrl: context.roomUrl,
+        roomId: context.roomId,
+        participantName: context.participantName,
+        role: context.role,
+        capabilities: context.capabilities,
+        tokenRef: { runtimeOnly: true },
+      };
+      return context;
+    },
+
+    buildSidecarSpec(meetingUrl, jwt, agentName, context = {}) {
+      const capabilities = context.capabilities || {};
+      return {
+        name: 'jitsi-agent-sidecar',
+        image: context.sidecarImage || sidecarImage,
+        env: [
+          { name: 'JITSI_ROOM_URL', value: meetingUrl },
+          { name: 'JITSI_JWT', value: jwt },
+          { name: 'JITSI_ROOM_ID', value: context.roomId || '' },
+          { name: 'JITSI_PARTICIPANT_NAME', value: agentName || 'Kradle Agent' },
+          { name: 'JITSI_PARTICIPANT_ROLE', value: context.role || 'observer' },
+          { name: 'JITSI_AUDIO_MODE', value: capabilities.audio || 'listen' },
+          { name: 'JITSI_CHAT_MODE', value: capabilities.chat || 'read' },
+          { name: 'AGENT_SOCKET_PATH', value: SOCKET_PATH },
+        ],
+        volumeMounts: [{ name: 'agent-socket', mountPath: '/tmp' }],
+        resources: {
+          requests: { cpu: '100m', memory: '256Mi' },
+          limits: { cpu: '500m', memory: '512Mi' },
+        },
+      };
+    },
+
+    async onAgentJoined(dispatchRunRef, meetingRef) {
+      const event = { type: 'agent-joined-meeting', dispatchRunRef, meetingRef, timestamp: isoNow(now) };
+      eventBus?.emit?.(event);
+      await dispatchController?.recordMeetingEvent?.(event);
+      return event;
+    },
+
+    async onAgentLeft(dispatchRunRef, meetingRef, reason = 'completed') {
+      const event = { type: 'agent-left-meeting', dispatchRunRef, meetingRef, reason, timestamp: isoNow(now) };
+      eventBus?.emit?.(event);
+      await dispatchController?.recordMeetingEvent?.(event);
+      const participantEvent = { type: 'participant-left', dispatchRunRef, meetingRef, participant: { id: dispatchRunRef, type: 'agent' }, reason, timestamp: event.timestamp };
+      eventBus?.emit?.(participantEvent);
+      await dispatchController?.recordMeetingEvent?.(participantEvent);
+      return event;
+    },
+  };
+}

package/src/jitsi-meeting-controller.js

@@ -0,0 +1,291 @@
+import crypto from 'node:crypto';
+import { createResource, validateResource, clone } from './resource-model.js';
+
+const DEFAULT_TTL_MINUTES = 60;
+
+function isoNow(now) {
+  return (typeof now === 'function' ? now() : new Date()).toISOString();
+}
+
+function epochSeconds(now, ttlMinutes) {
+  return Math.floor((typeof now === 'function' ? now() : new Date()).getTime() / 1000) + ttlMinutes * 60;
+}
+
+function encodeJwtSegment(value) {
+  return Buffer.from(JSON.stringify(value)).toString('base64url');
+}
+
+function signJwt(claims, secret) {
+  const header = encodeJwtSegment({ alg: 'HS256', typ: 'JWT' });
+  const payload = encodeJwtSegment(claims);
+  const signature = crypto.createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url');
+  return `${header}.${payload}.${signature}`;
+}
+
+export function createJitsiMeetingController(options = {}) {
+  const {
+    providerClient = {},
+    resourceGateway = null,
+    eventBus = null,
+    dispatchController = null,
+    jwtConfig = {},
+    jwtSecret = process.env.KRADLE_JITSI_JWT_SECRET || process.env.JITSI_JWT_SECRET || 'dev-jitsi-secret',
+    now = () => new Date(),
+  } = options;
+
+  async function listMeetings() {
+    const result = await resourceGateway?.list?.('JitsiMeeting');
+    return result?.items || (Array.isArray(result) ? result : []);
+  }
+
+  async function getMeeting(nameOrRoomId) {
+    const direct = await resourceGateway?.get?.('JitsiMeeting', nameOrRoomId);
+    if (direct) return direct;
+    return (await listMeetings()).find((meeting) => meeting.metadata?.name === nameOrRoomId || meeting.spec?.roomId === nameOrRoomId) || null;
+  }
+
+  async function getResource(kind, name) {
+    if (!name) return null;
+    return resourceGateway?.get?.(kind, name) || null;
+  }
+
+  async function persist(resource) {
+    if (resourceGateway?.apply) {
+      const result = await resourceGateway.apply(resource);
+      return result?.resource || resource;
+    }
+    return resource;
+  }
+
+  function emit(type, resource, extra = {}) {
+    eventBus?.emit?.({ type, resource, timestamp: isoNow(now), ...extra });
+  }
+
+  return {
+    role: 'jitsi-meeting-controller',
+
+    validate(resource) {
+      if (resource?.kind !== 'JitsiMeeting') throw new Error('Jitsi meeting controller validates JitsiMeeting resources only');
+      return validateResource(resource);
+    },
+
+    async createRoom(meetingSpec = {}) {
+      const roomId = meetingSpec.roomId;
+      if (!roomId) throw new Error('createRoom requires roomId');
+      const provider = await getResource('JitsiMeetProvider', meetingSpec.providerRef);
+      const template = await getResource('JitsiMeetingTemplate', meetingSpec.templateRef);
+      const mergedSpec = {
+        ...meetingSpec,
+        endpoint: meetingSpec.endpoint || provider?.spec?.endpoint,
+        ttlMinutes: meetingSpec.ttlMinutes || template?.spec?.ttlMinutes || provider?.spec?.defaultRoomTTL || DEFAULT_TTL_MINUTES,
+        roomConfig: {
+          ...(provider?.spec?.defaultRoomConfig || {}),
+          ...(template?.spec?.roomConfig || {}),
+          ...(meetingSpec.roomConfig || {}),
+        },
+      };
+      const providerResult = await providerClient.createRoom?.(mergedSpec) || {};
+      const resource = createResource('JitsiMeeting', {
+        name: meetingSpec.name || roomId,
+        namespace: meetingSpec.namespace || `kradle-org-${meetingSpec.organizationRef || 'default'}`,
+      }, {
+        organizationRef: meetingSpec.organizationRef || 'default',
+        providerRef: meetingSpec.providerRef || 'default',
+        templateRef: meetingSpec.templateRef,
+        roomId,
+        displayName: meetingSpec.displayName || roomId,
+        dispatchRunRef: meetingSpec.dispatchRunRef,
+        ttlMinutes: mergedSpec.ttlMinutes,
+        participants: clone(meetingSpec.participants || { invited: [] }),
+        roomConfig: clone(mergedSpec.roomConfig || {}),
+      }, {
+        phase: 'Active',
+        roomUrl: providerResult.roomUrl || meetingSpec.roomUrl || `${mergedSpec.endpoint || 'https://meet.kradle.local'}/${roomId}`,
+        startedAt: isoNow(now),
+        endedAt: null,
+        duration: null,
+        participants: { current: [], total: 0, peak: 0 },
+        recording: { active: false, recordingId: null },
+      });
+      this.validate(resource);
+      const persisted = await persist(resource);
+      emit('meeting-created', persisted, { roomId });
+      return persisted;
+    },
+
+    async endRoom(roomId) {
+      await providerClient.endRoom?.(roomId);
+      const meeting = await getMeeting(roomId);
+      if (!meeting) throw new Error(`JitsiMeeting for room ${roomId} not found`);
+      const endedAt = isoNow(now);
+      const updated = {
+        ...meeting,
+        status: {
+          ...(meeting.status || {}),
+          phase: 'Ended',
+          endedAt,
+        },
+      };
+      const persisted = await persist(updated);
+      emit('meeting-ended', persisted, { roomId });
+      return persisted;
+    },
+
+    generateParticipantJwt(roomId, participant = {}, ttlMinutes = DEFAULT_TTL_MINUTES, providerJwtConfig = {}) {
+      const config = { ...jwtConfig, ...providerJwtConfig, ...(participant.jwtConfig || {}) };
+      const claims = {
+        aud: config.audience || 'jitsi',
+        iss: config.issuer || 'kradle',
+        sub: config.subject || participant.subject || participant.org || 'kradle',
+        room: roomId,
+        exp: epochSeconds(now, Math.max(1, Number(ttlMinutes) || DEFAULT_TTL_MINUTES)),
+        context: {
+          user: {
+            id: participant.id || participant.ref || participant.name || 'kradle-user',
+            name: participant.name || participant.displayName || participant.id || 'Kradle user',
+            type: participant.type || 'user',
+            role: participant.role || 'participant',
+            avatar: participant.avatar || '',
+          },
+          features: participant.features || {},
+        },
+      };
+      return signJwt(claims, config.secret || jwtSecret);
+    },
+
+    async reconcile(meeting) {
+      this.validate(meeting);
+      const state = await providerClient.getRoom?.(meeting.spec.roomId) || {};
+      const currentTotal = Number(state.participantCount ?? meeting.status?.participants?.current?.length ?? 0);
+      const updated = {
+        ...meeting,
+        status: {
+          ...(meeting.status || {}),
+          phase: state.phase || meeting.status?.phase || 'Active',
+          participants: {
+            ...(meeting.status?.participants || {}),
+            total: currentTotal,
+            peak: Math.max(Number(meeting.status?.participants?.peak || 0), currentTotal),
+          },
+          lastReconciledAt: isoNow(now),
+        },
+      };
+      return persist(updated);
+    },
+
+    async listActiveMeetings(organizationRef) {
+      return (await listMeetings()).filter((meeting) => (
+        meeting.spec?.organizationRef === organizationRef && meeting.status?.phase === 'Active'
+      ));
+    },
+
+    async getMeeting(nameOrRoomId) {
+      return getMeeting(nameOrRoomId);
+    },
+
+    async getMeetingStats(roomId) {
+      return providerClient.getStats?.(roomId) || { active: false, participantCount: 0 };
+    },
+
+    async dispatchAutoJoinAgents(meetingRef, { resources = {}, repository = 'default', ref = 'main', actor = 'jitsi-meeting-controller', namespace = null } = {}) {
+      const meeting = typeof meetingRef === 'string' ? await getMeeting(meetingRef) : meetingRef;
+      if (!meeting) throw new Error(`JitsiMeeting ${meetingRef} not found`);
+      const template = meeting.spec?.templateRef
+        ? (resources.JitsiMeetingTemplate || []).find((candidate) => candidate.metadata?.name === meeting.spec.templateRef)
+        : null;
+      const autoJoin = meeting.spec?.agentConfig?.autoJoin === true || template?.spec?.agentConfig?.autoJoin === true;
+      if (!autoJoin) return [];
+      const participants = [
+        ...(meeting.spec?.participants?.autoInvite || []),
+        ...(template?.spec?.participants?.autoInvite || []),
+      ];
+      const dispatched = [];
+      for (const participant of participants) {
+        if (!['agentStack', 'agentDefinition'].includes(participant.type)) continue;
+        const result = await dispatchController?.createManualDispatch?.({
+          repository,
+          ref,
+          actor,
+          namespace: namespace || meeting.metadata?.namespace || 'default',
+          organizationRef: meeting.spec?.organizationRef || 'default',
+          meetingRef: meeting.metadata?.name,
+          resources,
+          taskKind: participant.taskKind || 'meeting',
+          ...(participant.type === 'agentDefinition' ? { agentDefinition: participant.ref } : { agentStack: participant.ref }),
+        });
+        if (result) dispatched.push(result);
+      }
+      return dispatched;
+    },
+
+    async startRecording(meetingRef) {
+      const meeting = await getMeeting(meetingRef);
+      if (!meeting) throw new Error(`JitsiMeeting ${meetingRef} not found`);
+      const result = await providerClient.startRecording?.(meeting.spec.roomId) || {};
+      const recordingId = result.recordingId || `rec-${meeting.metadata.name}`;
+      const recording = createResource('JitsiRecording', {
+        name: recordingId,
+        namespace: meeting.metadata?.namespace,
+      }, {
+        organizationRef: meeting.spec.organizationRef,
+        meetingRef: meeting.metadata.name,
+        providerRef: meeting.spec.providerRef,
+        format: result.format || 'mp4',
+        storageRef: result.storageRef,
+      }, {
+        phase: 'Recording',
+        startedAt: isoNow(now),
+        transcript: { available: false },
+      });
+      const updated = {
+        ...meeting,
+        status: {
+          ...(meeting.status || {}),
+          recording: { active: true, recordingId },
+        },
+      };
+      await persist(recording);
+      const persisted = await persist(updated);
+      emit('recording-started', persisted, { recordingId });
+      return persisted;
+    },
+
+    async stopRecording(meetingRef) {
+      const meeting = await getMeeting(meetingRef);
+      if (!meeting) throw new Error(`JitsiMeeting ${meetingRef} not found`);
+      const result = await providerClient.stopRecording?.(meeting.spec.roomId) || {};
+      const recordingId = result.recordingId || meeting.status?.recording?.recordingId || null;
+      if (recordingId) {
+        const existingRecording = await getResource('JitsiRecording', recordingId);
+        const recording = existingRecording || createResource('JitsiRecording', {
+          name: recordingId,
+          namespace: meeting.metadata?.namespace,
+        }, {
+          organizationRef: meeting.spec.organizationRef,
+          meetingRef: meeting.metadata.name,
+          providerRef: meeting.spec.providerRef,
+          format: result.format || 'mp4',
+          storageRef: result.storageRef,
+        }, {});
+        await persist({
+          ...recording,
+          status: {
+            ...(recording.status || {}),
+            phase: 'Completed',
+            endedAt: isoNow(now),
+            duration: result.duration,
+            transcript: recording.status?.transcript || { available: false },
+          },
+        });
+      }
+      const updated = {
+        ...meeting,
+        status: {
+          ...(meeting.status || {}),
+          recording: { active: false, recordingId },
+        },
+      };
+      return persist(updated);
+    },
+  };
+}

package/src/jitsi-sync-controller.js

@@ -0,0 +1,198 @@
+import { createResource, clone } from './resource-model.js';
+
+const EVENT_ALIASES = {
+  room_created: 'room-created',
+  room_destroyed: 'room-destroyed',
+  participant_joined: 'participant-joined',
+  participant_left: 'participant-left',
+  recording_started: 'recording-started',
+  recording_stopped: 'recording-stopped',
+};
+
+function canonicalType(value) {
+  return EVENT_ALIASES[value] || String(value || '').replaceAll('_', '-');
+}
+
+function isoNow(now) {
+  return (typeof now === 'function' ? now() : new Date()).toISOString();
+}
+
+export function createJitsiSyncController(options = {}) {
+  const { persistFn, eventBus, now = () => new Date() } = options;
+  const meetings = new Map();
+  const recordings = new Map();
+  const watermarks = new Map();
+  const processedDeliveries = new Set();
+
+  async function persist(resource) {
+    if (typeof persistFn === 'function') await persistFn(resource);
+    return resource;
+  }
+
+  function emit(type, resource, extra = {}) {
+    eventBus?.emit?.({ type, resource, timestamp: isoNow(now), ...extra });
+  }
+
+  function meetingName(roomId, state = {}) {
+    return state.meetingRef || state.name || roomId;
+  }
+
+  function rememberDelivery(event = {}) {
+    if (!event.deliveryId) return false;
+    if (processedDeliveries.has(event.deliveryId)) return true;
+    processedDeliveries.add(event.deliveryId);
+    return false;
+  }
+
+  return {
+    role: 'jitsi-sync-controller',
+
+    normalizeEvent(rawWebhookPayload = {}) {
+      const eventType = canonicalType(rawWebhookPayload.eventType || rawWebhookPayload.type || rawWebhookPayload.event);
+      return {
+        deliveryId: rawWebhookPayload.deliveryId || rawWebhookPayload.id || null,
+        eventType,
+        providerRef: rawWebhookPayload.providerRef || rawWebhookPayload.provider || 'default',
+        organizationRef: rawWebhookPayload.organizationRef || rawWebhookPayload.org || 'default',
+        roomId: rawWebhookPayload.roomId || rawWebhookPayload.roomName || rawWebhookPayload.room,
+        meetingRef: rawWebhookPayload.meetingRef,
+        recordingId: rawWebhookPayload.recordingId,
+        participant: rawWebhookPayload.participant || rawWebhookPayload.user || {},
+        timestamp: rawWebhookPayload.timestamp || rawWebhookPayload.receivedAt || isoNow(now),
+        data: rawWebhookPayload,
+      };
+    },
+
+    async syncRoom(roomId, jitsiState = {}) {
+      if (rememberDelivery(jitsiState)) return meetings.get(roomId) || null;
+      const eventType = canonicalType(jitsiState.eventType || jitsiState.type || 'room-created');
+      const key = roomId;
+      const existing = meetings.get(key);
+      const phase = eventType === 'room-destroyed' ? 'Ended' : (jitsiState.phase || 'Active');
+      const resource = {
+        ...(existing || createResource('JitsiMeeting', {
+          name: meetingName(roomId, jitsiState),
+          namespace: jitsiState.namespace || `kradle-org-${jitsiState.organizationRef || 'default'}`,
+        }, {
+          organizationRef: jitsiState.organizationRef || 'default',
+          providerRef: jitsiState.providerRef || 'default',
+          roomId,
+          displayName: jitsiState.displayName || roomId,
+          ttlMinutes: jitsiState.ttlMinutes || 120,
+          participants: { invited: [] },
+          roomConfig: {},
+        }, {
+          participants: { current: [], total: 0, peak: 0 },
+          recording: { active: false, recordingId: null },
+        })),
+      };
+      resource.status = {
+        ...(resource.status || {}),
+        phase,
+        roomUrl: jitsiState.roomUrl || resource.status?.roomUrl || `https://meet.kradle.local/${roomId}`,
+        ...(phase === 'Active' && !resource.status?.startedAt ? { startedAt: jitsiState.timestamp || isoNow(now) } : {}),
+        ...(phase === 'Ended' ? { endedAt: jitsiState.timestamp || isoNow(now) } : {}),
+      };
+      meetings.set(key, resource);
+      await persist(resource);
+      emit(phase === 'Ended' ? 'meeting-ended' : 'meeting-created', resource, { roomId });
+      return resource;
+    },
+
+    async syncParticipant(roomId, participantEvent = {}) {
+      if (rememberDelivery(participantEvent)) return meetings.get(roomId) || null;
+      const eventType = canonicalType(participantEvent.eventType || participantEvent.type || 'participant-joined');
+      const meeting = meetings.get(roomId) || await this.syncRoom(roomId, participantEvent);
+      const participant = {
+        id: participantEvent.participant?.id || participantEvent.id || participantEvent.participant?.name,
+        name: participantEvent.participant?.name || participantEvent.name || participantEvent.participant?.id,
+        type: participantEvent.participant?.type || participantEvent.type || 'user',
+        joinedAt: participantEvent.timestamp || isoNow(now),
+        ...clone(participantEvent.participant || {}),
+      };
+      const existing = meeting.status?.participants?.current || [];
+      const current = eventType === 'participant-left'
+        ? existing.filter((item) => item.id !== participant.id)
+        : [...existing.filter((item) => item.id !== participant.id), participant];
+      const previousTotal = Number(meeting.status?.participants?.total || 0);
+      const total = eventType === 'participant-joined' && !existing.some((item) => item.id === participant.id)
+        ? previousTotal + 1
+        : previousTotal;
+      meeting.status = {
+        ...(meeting.status || {}),
+        participants: {
+          current,
+          total,
+          peak: Math.max(Number(meeting.status?.participants?.peak || 0), current.length, total),
+        },
+      };
+      meetings.set(roomId, meeting);
+      await persist(meeting);
+      emit(eventType, meeting, { roomId, participant });
+      return meeting;
+    },
+
+    async syncRecording(roomId, recordingEvent = {}) {
+      if (rememberDelivery(recordingEvent)) return recordings.get(recordingEvent.recordingId || `rec-${roomId}`) || null;
+      const eventType = canonicalType(recordingEvent.eventType || recordingEvent.type || 'recording-started');
+      const recordingId = recordingEvent.recordingId || `rec-${roomId}`;
+      const existing = recordings.get(recordingId);
+      const phase = eventType === 'recording-stopped' ? 'Completed' : 'Recording';
+      const resource = {
+        ...(existing || createResource('JitsiRecording', {
+          name: recordingId,
+          namespace: recordingEvent.namespace || `kradle-org-${recordingEvent.organizationRef || 'default'}`,
+        }, {
+          organizationRef: recordingEvent.organizationRef || 'default',
+          meetingRef: recordingEvent.meetingRef || roomId,
+          providerRef: recordingEvent.providerRef || 'default',
+          format: recordingEvent.format || 'mp4',
+          storageRef: recordingEvent.storageRef,
+        }, {
+          transcript: { available: false },
+        })),
+      };
+      resource.status = {
+        ...(resource.status || {}),
+        phase,
+        ...(phase === 'Recording' ? { startedAt: recordingEvent.timestamp || isoNow(now) } : {}),
+        ...(phase === 'Completed' ? { endedAt: recordingEvent.timestamp || isoNow(now), duration: recordingEvent.duration } : {}),
+      };
+      recordings.set(recordingId, resource);
+      const meeting = meetings.get(roomId);
+      if (meeting) {
+        meeting.status = {
+          ...(meeting.status || {}),
+          recording: { active: phase === 'Recording', recordingId: phase === 'Recording' ? recordingId : null },
+        };
+        await persist(meeting);
+      }
+      await persist(resource);
+      emit(eventType, resource, { roomId, recordingId });
+      return resource;
+    },
+
+    async updateWatermark(providerRef, timestamp, options = {}) {
+      const current = watermarks.get(providerRef);
+      if (!current || timestamp > current) {
+        watermarks.set(providerRef, timestamp);
+        await persist({
+          apiVersion: 'kradle.a5c.ai/v1alpha1',
+          kind: 'ExternalSyncState',
+          metadata: {
+            name: `jitsi-watermark-${providerRef}`,
+            namespace: options.namespace || `kradle-org-${options.organizationRef || 'default'}`,
+            labels: {},
+            annotations: {},
+          },
+          spec: { organizationRef: options.organizationRef || 'default', providerRef, resourceRef: 'jitsi', phase: 'Synced', watermark: timestamp },
+          status: { phase: 'Synced', lastSuccessfulSyncAt: isoNow(now) },
+        });
+      }
+    },
+
+    getWatermark(providerRef) {
+      return watermarks.get(providerRef) || null;
+    },
+  };
+}