feat(meditate): the operator's library on the server, and a course's lessons done synced

An operator's folder (MEDITATE_LIBRARY_DIR) of recordings, pictures and a
YAML manifest, library.yaml (commented sample: library.example.yaml), read
as the server starts and every ten minutes, held in memory. Items without
a licence or credit, files outside the folder, unknown categories and
courses pointing at items not served are refused and logged; a manifest
that doesn't read keeps the library served before. bin/check_library.dart
checks a folder before deploying.

The catalogue goes to signed-in people alone (LibraryEndpoint), with a
12-hour access the server signs; the web server's /library/<served name>
serves the files to that access only, by ranges (relic's StaticHandler).
No request path reaches the file system.

lesson_done: a lesson done, sealed and synced, a row each; the migration
creates the table with its spaceId index and the cascading foreign key to
the sync engine's spaces, as dream's did. ADR 0038, D16.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/meditate/halkyon_meditate_server/test/integration/library/library_test.dart

@@ -0,0 +1,123 @@
+import 'dart:io';
+
+import 'package:clock/clock.dart';
+import 'package:halkyon_meditate_server/src/library/library_files.dart';
+import 'package:halkyon_meditate_server/src/library/library_manifest.dart';
+import 'package:halkyon_meditate_server/src/library/meditate_library.dart';
+import 'package:serverpod/serverpod.dart';
+import 'package:test/test.dart';
+
+import '../test_tools/serverpod_test_tools.dart';
+
+void main() {
+  withServerpod('The instance’s library', (sessionBuilder, endpoints) {
+    late Directory folder;
+    late MeditateLibrary library;
+
+    setUp(() async {
+      folder = Directory.systemTemp.createTempSync('library');
+      File('${folder.path}/audio/rain.mp3')
+        ..createSync(recursive: true)
+        ..writeAsBytesSync(List.filled(100, 1));
+      File('${folder.path}/$libraryManifestName').writeAsStringSync('''
+categories:
+  - key: breathwork
+    english: Breathwork
+    german: Atemarbeit
+items:
+  - id: rain
+    title: Rain
+    category: sound
+    language: en
+    licence: CC0 1.0
+    credit: Sample Recordist
+    audio:
+      - file: audio/rain.mp3
+        duration: 60
+courses:
+  - id: listening
+    title: Listening
+    category: sound
+    language: en
+    lessons:
+      - item: rain
+''');
+      library = MeditateLibrary.of(sessionBuilder.build().serverpod)
+        ..folder = folder;
+      await library.reload();
+    });
+
+    tearDown(() async {
+      MeditateLibrary.of(sessionBuilder.build().serverpod).folder = null;
+      await library.reload();
+      folder.deleteSync(recursive: true);
+    });
+
+    final signedIn = sessionBuilder.copyWith(
+      authentication: AuthenticationOverride.authenticationInfo(
+        const Uuid().v7(),
+        {},
+      ),
+    );
+
+    test('gives a signed-in person the catalogue, where the files are and '
+        'an access to fetch them (ADR 0038, D16)', () async {
+      final catalogue = await endpoints.library.catalogue(signedIn);
+
+      expect(catalogue.items.single.id, 'rain');
+      expect(catalogue.items.single.credit, 'Sample Recordist');
+      expect(catalogue.courses.single.lessons.single.item, 'rain');
+      expect(catalogue.categories.single.key, 'breathwork');
+      expect(catalogue.filesUrl, endsWith('/library'));
+      expect(
+        library.access.allows(catalogue.access, clock.now()),
+        isTrue,
+      );
+      expect(catalogue.accessUntil!.isAfter(clock.now()), isTrue);
+    });
+
+    test('gives nobody signed out the catalogue: the content is the '
+        'operator’s, under licences that may not allow it', () async {
+      await expectLater(
+        endpoints.library.catalogue(sessionBuilder),
+        throwsA(isA<ServerpodUnauthenticatedException>()),
+      );
+    });
+
+    test('an instance without a library gives an empty catalogue, and no '
+        'access', () async {
+      library.folder = null;
+      await library.reload();
+
+      final catalogue = await endpoints.library.catalogue(signedIn);
+
+      expect(catalogue.items, isEmpty);
+      expect(catalogue.courses, isEmpty);
+      expect(catalogue.access, isNull);
+    });
+
+    test('a manifest broken while served keeps the last good library, and '
+        'one fixed is read again', () async {
+      final manifest = File('${folder.path}/$libraryManifestName');
+      final good = manifest.readAsStringSync();
+      manifest.writeAsStringSync('items: [broken');
+      expect(await library.reload(), isFalse);
+      expect(library.contents.items.single.id, 'rain');
+
+      manifest.writeAsStringSync(
+        good.replaceFirst('title: Rain', 'title: Rainfall'),
+      );
+      expect(await library.reload(), isTrue);
+      expect(library.contents.items.single.title, 'Rainfall');
+    });
+
+    test('the access it signs lets files be fetched, and no other does', () {
+      final (:token, until: _) = library.access.issue(clock.now());
+      expect(library.access.allows(token, clock.now()), isTrue);
+      expect(
+        LibraryFileAccess().allows(token, clock.now()),
+        isFalse,
+      );
+    });
+  });
+}

apps/meditate/halkyon_meditate_server/test/integration/sitting/person_deletion_test.dart

@@ -52,8 +52,8 @@ void main() {
       });
 
       test(
-        'deleting a person deletes their space with every key, sitting, dream and '
-        "their settings in it, and nobody else's",
+        'deleting a person deletes their space with every key, sitting, dream, '
+        "lesson done and their settings in it, and nobody else's",
         () async {
           for (final person in [alice, bob]) {
             await _sittingOf(session, person);
@@ -100,7 +100,13 @@ void main() {
 final _syncDatabases = Expando<OfflineSyncDatabase>();
 
 /// Every synced table of Meditate's.
-const _tables = ['content_key', 'sitting', 'meditate_settings', 'dream'];
+const _tables = [
+  'content_key',
+  'sitting',
+  'meditate_settings',
+  'dream',
+  'lesson_done',
+];
 
 /// A key, a sitting, the settings and a dream in [person]'s personal space,
 /// written as their device would through the sync engine (payloads stand in
@@ -132,4 +138,9 @@ Future<void> _sittingOf(Session session, UuidValue person) =>
         Dream(keyId: 'meditate1.0.key', payload: sealed, nonce: sealed),
         transaction: transaction,
       );
+      await LessonDone.db.insertRow(
+        session,
+        LessonDone(keyId: 'meditate1.0.key', payload: sealed, nonce: sealed),
+        transaction: transaction,
+      );
     });

apps/meditate/halkyon_meditate_server/test/integration/test_tools/serverpod_test_tools.dart

@@ -11,9 +11,12 @@
 // ignore_for_file: no_leading_underscores_for_local_identifiers
 
 // ignore_for_file: no_leading_underscores_for_library_prefixes
+import 'dart:async' as _ida;
 import 'dart:io' as _idi;
 import 'package:halkyon_meditate_server/src/generated/future_calls.dart'
     as _iluznlp5;
+import 'package:halkyon_meditate_server/src/generated/library/library_catalogue.dart'
+    as _i7d1chg9;
 import 'package:serverpod/serverpod.dart' as _is;
 import 'package:serverpod_test/serverpod_test.dart' as _ist;
 import 'package:halkyon_meditate_server/src/generated/protocol.dart';
@@ -150,6 +153,8 @@ void withServerpod(
 
 class TestEndpoints {
   late final futureCalls = _FutureCalls();
+
+  late final _LibraryEndpoint library;
 }
 
 class _InternalTestEndpoints extends TestEndpoints
@@ -158,13 +163,76 @@ class _InternalTestEndpoints extends TestEndpoints
   void initialize(
     _is.SerializationManager serializationManager,
     _is.EndpointDispatch endpoints,
-  ) {}
+  ) {
+    library = _LibraryEndpoint(
+      endpoints,
+      serializationManager,
+    );
+  }
 }
 
 class _FutureCalls {
+  late final libraryReload = _LibraryReloadFutureCall();
+
   late final pruning = _PruningFutureCall();
 }
 
+class _LibraryEndpoint {
+  _LibraryEndpoint(
+    this._endpointDispatch,
+    this._serializationManager,
+  );
+
+  final _is.EndpointDispatch _endpointDispatch;
+
+  final _is.SerializationManager _serializationManager;
+
+  _ida.Future<_i7d1chg9.LibraryCatalogue> catalogue(
+    _ist.TestSessionBuilder sessionBuilder,
+  ) async {
+    return _ist.callAwaitableFunctionAndHandleExceptions(() async {
+      var _localUniqueSession =
+          (sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild(
+            endpoint: 'library',
+            method: 'catalogue',
+          );
+      try {
+        var _localCallContext = await _endpointDispatch.getMethodCallContext(
+          createSessionCallback: (_) => _localUniqueSession,
+          endpointPath: 'library',
+          methodName: 'catalogue',
+          parameters: _ist.testObjectToJson({}),
+          serializationManager: _serializationManager,
+        );
+        var _localReturnValue =
+            await (_localCallContext.method.call(
+                  _localUniqueSession,
+                  _localCallContext.arguments,
+                )
+                as _ida.Future<_i7d1chg9.LibraryCatalogue>);
+        return _localReturnValue;
+      } finally {
+        await _localUniqueSession.close();
+      }
+    });
+  }
+}
+
+class _LibraryReloadFutureCall {
+  Future<void> reloadLibrary(_ist.TestSessionBuilder sessionBuilder) async {
+    var _localUniqueSession =
+        (sessionBuilder as _ist.InternalTestSessionBuilder).internalBuild();
+    try {
+      await _iluznlp5.LibraryReloadReloadLibraryFutureCall().invoke(
+        _localUniqueSession,
+        null,
+      );
+    } finally {
+      await _localUniqueSession.close();
+    }
+  }
+}
+
 class _PruningFutureCall {
   Future<void> pruneAccounts(_ist.TestSessionBuilder sessionBuilder) async {
     var _localUniqueSession =

apps/meditate/halkyon_meditate_server/test/unit/library/library_files_test.dart

@@ -0,0 +1,140 @@
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:clock/clock.dart';
+import 'package:halkyon_meditate_server/src/library/library_files.dart';
+import 'package:halkyon_meditate_server/src/library/library_manifest.dart';
+import 'package:serverpod/serverpod.dart';
+import 'package:test/test.dart';
+
+void main() {
+  late Directory folder;
+  late LibraryContents contents;
+  late LibraryFileAccess access;
+  late RelicServer server;
+  late HttpClient http;
+  late String served;
+
+  setUp(() async {
+    folder = Directory.systemTemp.createTempSync('library');
+    File('${folder.path}/audio/rain.mp3')
+      ..createSync(recursive: true)
+      ..writeAsBytesSync(List.generate(1000, (i) => i % 256));
+    File('${folder.path}/secret.txt').writeAsStringSync('not served');
+    File('${folder.path}/$libraryManifestName').writeAsStringSync('''
+items:
+  - id: rain
+    title: Rain
+    category: sound
+    language: en
+    licence: CC0 1.0
+    credit: Sample Recordist
+    audio:
+      - file: audio/rain.mp3
+        duration: 60
+''');
+    contents = readLibrary(folder);
+    served = contents.items.single.audio.single.file;
+    access = LibraryFileAccess();
+    server =
+        await (RelicApp()..get(
+              '/library/**',
+              (request) => serveLibraryFile(
+                request,
+                contents: contents,
+                access: access,
+              ),
+            ))
+            .serve(port: 0);
+    http = HttpClient();
+  });
+
+  tearDown(() async {
+    http.close(force: true);
+    await server.close();
+    folder.deleteSync(recursive: true);
+  });
+
+  /// Asks for [path] on the test server, with [headers].
+  Future<HttpClientResponse> get(
+    String path, {
+    Map<String, String> headers = const {},
+  }) async {
+    final request = await http.getUrl(
+      Uri.parse('http://localhost:${server.port}$path'),
+    );
+    headers.forEach(request.headers.set);
+    return await request.close();
+  }
+
+  String token() => access.issue(clock.now()).token;
+
+  test('serves a file to whoever holds an access the server signed, by '
+      'ranges as players ask (ADR 0038, D16)', () async {
+    final whole = await get('/library/$served?access=${token()}');
+    expect(whole.statusCode, HttpStatus.ok);
+    expect(whole.headers.value(HttpHeaders.acceptRangesHeader), 'bytes');
+    expect(whole.headers.contentType?.mimeType, 'audio/mpeg');
+    expect((await whole.toList()).expand((chunk) => chunk), hasLength(1000));
+
+    final part = await get(
+      '/library/$served?access=${token()}',
+      headers: {HttpHeaders.rangeHeader: 'bytes=10-19'},
+    );
+    expect(part.statusCode, HttpStatus.partialContent);
+    expect(
+      part.headers.value(HttpHeaders.contentRangeHeader),
+      'bytes 10-19/1000',
+    );
+    expect((await part.toList()).expand((chunk) => chunk), [
+      for (var i = 10; i < 20; i++) i,
+    ]);
+  });
+
+  test('refuses a request without an access, with one not signed by this '
+      'server, and with one expired', () async {
+    final none = await get('/library/$served');
+    expect(none.statusCode, HttpStatus.unauthorized);
+    await none.drain<void>();
+
+    final forged = LibraryFileAccess().issue(clock.now()).token;
+    final foreign = await get('/library/$served?access=$forged');
+    expect(foreign.statusCode, HttpStatus.forbidden);
+    await foreign.drain<void>();
+
+    final (:token, :until) = access.issue(clock.now());
+    final altered = token.replaceFirst(
+      RegExp(r'^\d+'),
+      '${until.add(const Duration(days: 30)).millisecondsSinceEpoch ~/ 1000}',
+    );
+    final lengthened = await get('/library/$served?access=$altered');
+    expect(lengthened.statusCode, HttpStatus.forbidden);
+    await lengthened.drain<void>();
+
+    final old = access
+        .issue(clock.now().subtract(LibraryFileAccess.lifetime * 2))
+        .token;
+    final expired = await get('/library/$served?access=$old');
+    expect(expired.statusCode, HttpStatus.forbidden);
+    await expired.drain<void>();
+  });
+
+  test('serves only the files the manifest names, by their served names: '
+      'a path of the folder, or one out of it, is no such name', () async {
+    for (final path in [
+      '/library/secret.txt',
+      '/library/audio/rain.mp3',
+      '/library/..%2Fsecret.txt',
+      '/library/%2E%2E/%2E%2E/etc/passwd',
+      '/library/${served.replaceFirst('.mp3', '.txt')}',
+    ]) {
+      final response = await get('$path?access=${token()}');
+      expect(response.statusCode, HttpStatus.notFound, reason: path);
+      expect(
+        utf8.decode((await response.toList()).expand((c) => c).toList()),
+        isNot(contains('not served')),
+        reason: path,
+      );
+    }
+  });
+}

apps/meditate/halkyon_meditate_server/test/unit/library/library_manifest_test.dart

@@ -0,0 +1,295 @@
+import 'dart:io';
+
+import 'package:halkyon_meditate_server/src/library/library_manifest.dart';
+import 'package:test/test.dart';
+
+/// A neutral item of the manifest, as an operator would write it, with
+/// [changes] over it (null drops a field).
+String _item(String id, {Map<String, String?> changes = const {}}) {
+  final fields = <String, String?>{
+    'id': id,
+    'title': 'Evening rest',
+    'category': 'meditation',
+    'description': 'A short sitting before sleep.',
+    'speaker': 'Sample Speaker',
+    'language': 'en',
+    'licence': 'CC BY 4.0',
+    'credit': 'Sample Speaker, for the example instance',
+    ...changes,
+  };
+  final audio =
+      fields.remove('audio') ??
+      '    - file: audio/$id.mp3\n'
+          '      duration: 600\n';
+  return [
+    '  - id: ${fields.remove('id')}',
+    for (final MapEntry(:key, :value) in fields.entries)
+      if (value != null) '    $key: $value',
+    '    audio:',
+    audio.trimRight(),
+  ].join('\n');
+}
+
+void main() {
+  late Directory folder;
+
+  setUp(() {
+    folder = Directory.systemTemp.createTempSync('library');
+    Directory('${folder.path}/audio').createSync();
+  });
+  tearDown(() => folder.deleteSync(recursive: true));
+
+  /// Writes [name] in the folder, of [bytes] bytes.
+  void file(String name, {int bytes = 16}) => File('${folder.path}/$name')
+    ..createSync(recursive: true)
+    ..writeAsBytesSync(List.filled(bytes, 7));
+
+  /// Writes the manifest.
+  void manifest(String yaml) =>
+      File('${folder.path}/$libraryManifestName').writeAsStringSync(yaml);
+
+  test('reads items, their recordings and courses whose lessons point at '
+      'them (ADR 0038, D16)', () {
+    file('audio/evening.mp3', bytes: 1000);
+    file('audio/evening-long.mp3', bytes: 2000);
+    file('audio/rain.ogg');
+    file('images/evening.jpg');
+    manifest('''
+version: 1
+items:
+${_item('evening', changes: {'image': 'images/evening.jpg', 'audio': '''
+    - file: audio/evening.mp3
+      label: 10 minutes
+      duration: "10:00"
+    - file: audio/evening-long.mp3
+      label: 20 minutes
+      duration: 1200
+'''})}
+${_item('rain', changes: {'category': 'sound', 'speaker': null, 'audio': '''
+    - file: audio/rain.ogg
+      duration: 1800
+'''})}
+courses:
+  - id: first-week
+    title: A first week
+    description: Seven evenings.
+    category: meditation
+    language: en
+    lessons:
+      - item: evening
+        title: The first evening
+      - item: rain
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.problems, isEmpty);
+    expect(library.items.map((item) => item.id), ['evening', 'rain']);
+    final evening = library.items.first;
+    expect(evening.title, 'Evening rest');
+    expect(evening.speaker, 'Sample Speaker');
+    expect(evening.licence, 'CC BY 4.0');
+    expect(evening.credit, 'Sample Speaker, for the example instance');
+    expect(evening.audio.map((audio) => audio.durationSeconds), [600, 1200]);
+    expect(evening.audio.map((audio) => audio.label), [
+      '10 minutes',
+      '20 minutes',
+    ]);
+    expect(evening.audio.map((audio) => audio.size), [1000, 2000]);
+    expect(library.items.last.speaker, isNull);
+    // Served under names of their own, which say nothing of the folder.
+    for (final audio in evening.audio) {
+      expect(audio.file, matches(RegExp(r'^[0-9a-f]{24}\.mp3$')));
+      expect(library.files[audio.file]!.path, endsWith('.mp3'));
+    }
+    expect(evening.image, matches(RegExp(r'^[0-9a-f]{24}\.jpg$')));
+    expect(library.files, contains(evening.image));
+    final course = library.courses.single;
+    expect(course.id, 'first-week');
+    expect(course.lessons.map((lesson) => lesson.item), ['evening', 'rain']);
+    expect(course.lessons.first.title, 'The first evening');
+  });
+
+  test('refuses an item without a licence or a credit, saying why, and '
+      'serves the others', () {
+    file('audio/a.mp3');
+    file('audio/b.mp3');
+    file('audio/c.mp3');
+    manifest('''
+items:
+${_item('a', changes: {'licence': null})}
+${_item('b', changes: {'credit': '""'})}
+${_item('c')}
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.items.map((item) => item.id), ['c']);
+    expect(library.problems, [
+      allOf(contains('`a`'), contains('licence')),
+      allOf(contains('`b`'), contains('credit')),
+    ]);
+  });
+
+  test('refuses a recording outside the folder, however its path gets '
+      'there (path traversal)', () {
+    final outside = Directory.systemTemp.createTempSync('outside');
+    addTearDown(() => outside.deleteSync(recursive: true));
+    File('${outside.path}/secret.mp3').writeAsStringSync('not yours');
+    Link('${folder.path}/audio/linked.mp3').createSync(
+      '${outside.path}/secret.mp3',
+    );
+    file('audio/fine.mp3');
+    manifest('''
+items:
+${_item('up', changes: {'audio': '    - file: ../${outside.uri.pathSegments.where((s) => s.isNotEmpty).last}/secret.mp3\n      duration: 60\n'})}
+${_item('absolute', changes: {'audio': '    - file: ${outside.path}/secret.mp3\n      duration: 60\n'})}
+${_item('linked', changes: {'audio': '    - file: audio/linked.mp3\n      duration: 60\n'})}
+${_item('fine', changes: {'audio': '    - file: audio/fine.mp3\n      duration: 60\n'})}
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.items.map((item) => item.id), ['fine']);
+    expect(library.problems, hasLength(3));
+    for (final problem in library.problems) {
+      expect(problem, contains('outside the library'));
+    }
+    expect(
+      library.files.values.map((file) => file.path),
+      everyElement(isNot(contains('secret'))),
+    );
+  });
+
+  test('refuses an item whose recording is missing, has no length or is no '
+      'sound, or whose id, category or language is wrong', () {
+    file('audio/notes.txt');
+    file('audio/ok.mp3');
+    manifest('''
+items:
+${_item('missing', changes: {'audio': '    - file: audio/missing.mp3\n      duration: 60\n'})}
+${_item('no-length', changes: {'audio': '    - file: audio/ok.mp3\n'})}
+${_item('text', changes: {'audio': '    - file: audio/notes.txt\n      duration: 60\n'})}
+${_item('Not A Slug', changes: {'audio': '    - file: audio/ok.mp3\n      duration: 60\n'})}
+${_item('odd-category', changes: {'category': 'cooking', 'audio': '    - file: audio/ok.mp3\n      duration: 60\n'})}
+${_item('odd-language', changes: {'language': 'english please', 'audio': '    - file: audio/ok.mp3\n      duration: 60\n'})}
+${_item('none', changes: {'audio': ''})}
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.items, isEmpty);
+    expect(library.problems, [
+      allOf(contains('`missing`'), contains('no file')),
+      allOf(contains('`no-length`'), contains('duration')),
+      allOf(contains('`text`'), contains('not a sound')),
+      contains('id'),
+      allOf(contains('`odd-category`'), contains('category')),
+      allOf(contains('`odd-language`'), contains('language')),
+      allOf(contains('`none`'), contains('recording')),
+    ]);
+  });
+
+  test("takes the operator's own categories with their names, but none "
+      "under Meditate's own keys", () {
+    file('audio/a.mp3');
+    manifest('''
+categories:
+  - key: breathwork
+    english: Breathwork
+    german: Atemarbeit
+  - key: sleep-story
+    english: Bedtime
+    german: Gute Nacht
+items:
+${_item('a', changes: {'category': 'breathwork', 'audio': '    - file: audio/a.mp3\n      duration: 60\n'})}
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.categories.map((category) => category.key), [
+      'breathwork',
+    ]);
+    expect(library.categories.single.german, 'Atemarbeit');
+    expect(library.items.single.category, 'breathwork');
+    expect(library.problems.single, contains('sleep-story'));
+  });
+
+  test('refuses a second item under an id taken, and a course pointing at '
+      'an item not served', () {
+    file('audio/a.mp3');
+    manifest('''
+items:
+${_item('a', changes: {'audio': '    - file: audio/a.mp3\n      duration: 60\n'})}
+${_item('a', changes: {'title': 'Again', 'audio': '    - file: audio/a.mp3\n      duration: 60\n'})}
+courses:
+  - id: broken
+    title: Broken
+    category: meditation
+    language: en
+    lessons:
+      - item: a
+      - item: gone
+  - id: fine
+    title: Fine
+    category: meditation
+    language: en
+    lessons:
+      - item: a
+''');
+
+    final library = readLibrary(folder);
+
+    expect(library.items.single.title, 'Evening rest');
+    expect(library.courses.map((course) => course.id), ['fine']);
+    expect(library.problems, [
+      allOf(contains('`a`'), contains('taken')),
+      allOf(contains('`broken`'), contains('`gone`')),
+    ]);
+  });
+
+  test('a folder without a manifest is no library, and a manifest that '
+      "isn't YAML says so", () {
+    expect(readLibrary(folder).items, isEmpty);
+    expect(readLibrary(folder).problems.single, contains('no library.yaml'));
+
+    manifest('items: [unclosed');
+    expect(readLibrary(folder).items, isEmpty);
+    expect(readLibrary(folder).problems.single, contains('YAML'));
+  });
+
+  test('the fingerprint changes with the manifest and with a file, and '
+      'only then', () {
+    file('audio/a.mp3');
+    manifest(
+      'items:\n${_item('a', changes: {'audio': '    - file: audio/a.mp3\n      duration: 60\n'})}\n',
+    );
+    final first = readLibrary(folder).fingerprint;
+    expect(readLibrary(folder).fingerprint, first);
+
+    file('audio/a.mp3', bytes: 99);
+    final second = readLibrary(folder).fingerprint;
+    expect(second, isNot(first));
+
+    manifest(
+      'items:\n${_item('a', changes: {'title': 'Changed', 'audio': '    - file: audio/a.mp3\n      duration: 60\n'})}\n',
+    );
+    expect(readLibrary(folder).fingerprint, isNot(second));
+  });
+
+  test('the example manifest in the repository passes, its files made up', () {
+    final example = File('library.example.yaml').readAsStringSync();
+    manifest(example);
+    for (final match in RegExp(
+      r'(?:file|image): ([\w/.-]+)',
+    ).allMatches(example)) {
+      file(match.group(1)!);
+    }
+
+    final library = readLibrary(folder);
+
+    expect(library.problems, isEmpty);
+    expect(library.items, isNotEmpty);
+    expect(library.courses, isNotEmpty);
+  });
+}