@corelicense/node 0.5.0 → 0.5.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CoreLicense
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,193 +1,83 @@
 # @corelicense/node
 
-CoreLicense Node.js SDK — runtime license và policy layer cho ứng dụng Node.js.
+Runtime license và policy layer cho ứng dụng Node.js — không chỉ middleware HTTP, mà là lớp kiểm soát **bootstrap**, **module registry**, **DI**, **worker/CLI**, **quota** và **feature gate** theo policy đã ký.
 
-> **Trạng thái:** v0.4 — tích hợp sâu (module registry & DI), production default URL, revoke handling.
+**Phiên bản:** `0.5.1`  
+**License:** [MIT](./LICENSE)  
+**Repository:** [github.com/trailanglc/corelicense](https://github.com/trailanglc/corelicense)  
+**Docs trực tuyến:** [corelicense.net/docs](https://corelicense.net/docs/nodejs-sdk/quick-start)
 
-## Triết lý
+---
 
-CoreLicense không chỉ là middleware. SDK được thiết kế như một **Runtime Layer** nằm sâu trong bootstrap, runtime config, module registry, service guard, worker/CLI guard và quota enforcement.
+## CoreLicense là gì?
 
-## Cài đặt
+CoreLicense gồm **License Server** (API Go) và **Node.js SDK** (package này). Admin cấp license key + policy (features, limits, quotas). SDK:
 
-```bash
-npm install @corelicense/node
-```
-
-Peer dependencies tùy chọn (chỉ cài khi dùng integration tương ứng):
-
-```bash
-npm install express          # Express middleware
-npm install fastify          # Fastify plugin
-npm install @nestjs/common     # NestJS module/guard
-```
-
-## Quick start
-
-Chỉ cần **2 biến môi trường**. SDK mặc định kết nối `https://api.corelicense.net` — không cần cấu hình thêm cho production.
-
-License key mới (CL1.*) vẫn ưu tiên URL nhúng trong key nếu server generate với `SDK_PUBLIC_URL` khác.
-
-```env
-CORELICENSE_KEY=CL1.xxxxx.CL-AAAAA-BBBBB-...
-CORELICENSE_PRODUCT_ID=demo
-```
-
-`CORELICENSE_PUBLIC_KEY` **optional** — pin public key (enterprise / air-gapped).
-`CORELICENSE_API_URL` **optional** — override thủ công (dev local hoặc legacy key).
-
-Dev local với server Go chạy localhost:
-
-```env
-CORELICENSE_API_URL=http://localhost:8080
-```
-
-```ts
-import express from 'express';
-import { CoreLicense, loadOptionsFromEnv } from '@corelicense/node';
+1. Kích hoạt / kiểm tra license với server
+2. Verify **policy token** bằng public key (EdDSA)
+3. Cache policy local, refresh định kỳ
+4. Chặn runtime khi revoke / suspend / expired
+5. (Tùy chọn) Chỉ bind module & service được cấp trong policy
 
-const app = express();
+---
 
-const license = new CoreLicense(loadOptionsFromEnv({
-  cachePath: './storage/corelicense',
-  instance: {
-    strategy: 'install-id-domain-hash',
-    domain: process.env.APP_DOMAIN,
-  },
-}));
+## Tài liệu
 
-async function main() {
-  await license.boot();
+| Tài liệu | Nội dung |
+|----------|----------|
+| [Cài đặt](./docs/installation.md) | `npm install`, biến môi trường, boot lần đầu, dev/prod |
+| [Tích hợp](./docs/integration.md) | **Hướng dẫn chi tiết** — Express, Fastify, NestJS, registry/DI, worker, quota, production |
+| [API Reference](./docs/api-reference.md) | Public API, options, error codes |
+| [LICENSE](./LICENSE) | MIT |
 
-  app.use(license.express({
-    allowPaths: ['/health', '/license/status'],
-  }));
+> Dành cho agent / CI: đọc [docs/integration.md](./docs/integration.md) trước khi generate code tích hợp.
 
-  app.get('/license/status', async (_req, res) => {
-    res.json(await license.getStatus());
-  });
+---
 
-  app.listen(3000);
-}
+## Quick links
 
-main().catch(console.error);
+```bash
+npm install @corelicense/node
 ```
 
-### Pin public key (optional)
+Production mặc định: `https://api.corelicense.net` — chỉ cần `CORELICENSE_KEY` + `CORELICENSE_PRODUCT_ID`.
 
 ```ts
-const license = new CoreLicense(loadOptionsFromEnv({
-  publicKey: process.env.CORELICENSE_PUBLIC_KEY, // pinned mode
-}));
-```
-
-Khi pin, SDK không fetch keys từ server. Nếu verify fail sau key rotation, cập nhật `CORELICENSE_PUBLIC_KEY` thủ công.
-
-## Public API
-
-| Method | Mô tả |
-|--------|-------|
-| `boot()` | Khởi tạo SDK, fetch/cache public keys, load cache, verify token |
-| `refresh()` | Refresh policy token từ server |
-| `requireActive()` | Yêu cầu license active |
-| `requireFeature(name)` | Kiểm tra feature flag |
-| `checkLimit(name, value)` | Kiểm tra limit |
-| `consumeQuota(name, amount?)` | Tiêu thụ quota local |
-| `getStatus()` | Trạng thái license hiện tại |
-| `getPolicy()` | Policy đang active |
-| `getRuntimeConfig()` | Runtime config cho app bootstrap |
-| `express(options?)` | Express middleware |
-| `fastifyPlugin(options?)` | Fastify plugin |
-| `guardWorker(name)` | Guard worker |
-| `guardCommand(name)` | Guard CLI/cron command |
-| `createLicensedRegistry()` | Module registry gắn license |
-| `createLicensedContainer()` | DI container gắn license |
-| `bootstrap(options?)` | Bootstrap modules + services theo policy |
-
-## Tích hợp sâu (v0.4)
+import { CoreLicense, loadOptionsFromEnv } from '@corelicense/node';
 
-```ts
+const license = new CoreLicense(loadOptionsFromEnv({ cachePath: './storage/corelicense' }));
 await license.boot();
-
-const { modules, services, skipped } = await license.bootstrap({
-  modules: [
-    { name: 'automation', feature: 'automation', factory: ({ license }) => new AutomationModule(license) },
-  ],
-  services: [
-    { name: 'ExportService', feature: 'export', factory: ({ license }) => new ExportService(license) },
-  ],
-});
-
-const automation = await modules.get<AutomationModule>('automation');
-const exportService = await services.resolve<ExportService>('ExportService');
-
-import { registerLicensedRoutes } from '@corelicense/node';
-registerLicensedRoutes(app, modules, [
-  { path: '/automation', module: 'automation', router: automationRouter },
-]);
-```
-
-`get()` và `resolve()` gọi `requireFeature` mỗi lần truy cập — revoke/suspend chặn ngay. Đổi feature trong policy vẫn cần **restart** để bind/unbind module mới.
-
-Xem [Tích hợp sâu](https://corelicense.net/docs/nodejs-sdk/deep-integration) trên docs site.
-
-## Xử lý lỗi
-
-Mọi lỗi SDK đều có `code` (mã định vị) và `source` (module SDK phát sinh):
-
-```ts
-import { isLicenseError, formatLicenseError, LicenseErrorCode } from '@corelicense/node';
-
-try {
-  await license.boot();
-} catch (error) {
-  if (isLicenseError(error)) {
-    console.error(error.code, error.source); // e.g. CONFIG_MISSING_ENV, load-options-from-env
-  }
-}
 ```
 
-Dùng `error.toJSON()` hoặc `formatLicenseError(error)` khi trả lỗi qua HTTP API.
-
-## Production deploy
+Chi tiết: [docs/installation.md](./docs/installation.md) → [docs/integration.md](./docs/integration.md).
 
-**SDK:** `cd SDK/corelicense-node && npm test && npm run build && npm publish --access public`
+---
 
-**API (Go):** deploy backend với `SDK_PUBLIC_URL=https://api.corelicense.net`, policy signer configured, và `APP_ENV=production`. Production validate yêu cầu HTTPS URL (không localhost) và secrets không dùng `change-me`.
+## Subpath exports
 
-## Cấu trúc module
-
-```txt
-src/
-  core-license.ts       # Class chính
-  types/                # TypeScript interfaces
-  errors/               # Error hierarchy
-  crypto/               # Policy token verification + public key resolver
-  client/               # License API + public keys client
-  cache/                # File/memory cache
-  instance/             # Instance ID resolution
-  guards/               # Express, Fastify, NestJS, worker, CLI
-  runtime/              # Runtime config, module registry, DI container
-  audit/                # Local audit log
-  events/               # Event bus
-```
+| Import | Mục đích |
+|--------|----------|
+| `@corelicense/node` | Core API |
+| `@corelicense/node/express` | Express middleware |
+| `@corelicense/node/fastify` | Fastify plugin |
+| `@corelicense/node/nestjs` | NestJS module, guards, filter |
 
-## Tài liệu thiết kế
+---
 
-Xem [CoreLicense Node.js SDK — Tài liệu thiết kế & tích hợp sâu](../../docs/CoreLicense_NodeJS_SDK_Deep_Integration.md).
+## Yêu cầu
 
-## Roadmap
+- Node.js **≥ 18**
+- License Server reachable (hoặc cache + offline grace hợp lệ)
 
-- **v0.1** — Types, errors, boot, express middleware, file cache, local audit
-- **v0.2** — Auto-fetch public keys, key rotation retry, worker/CLI guard, offline grace
-- **v0.3** — Production default URL, activate flow, revoke handling, server contract sync
-- **v0.4** — Licensed module registry, DI container, Express routes, NestJS `@RequireFeature`
-- **v0.4.1** — Runtime re-check license trên `get()` / `resolve()`, fix `ModuleNotLicensedError` status
-- **v0.4.2** — Mã lỗi (`code`) + `source` trên mọi `LicenseError`, `LicenseErrorCode`, `formatLicenseError()`
-- **v0.4.3** — Re-check registry/DI không ghi audit; middleware 403 trả `source` qua `toClientPayload()`
-- **v0.5.0** — Fail-closed offline boot, quota/limit gates, apiUrl pin, Nest 403 filter, sync mutex
-- **v1.0** — Stable API, production-ready, security review
+---
 
-## License
+## Changelog (tóm tắt)
 
-MIT
+| Version | Highlights |
+|---------|------------|
+| **0.5.1** | Tách tài liệu (installation, integration, api-reference), sửa repository URL |
+| **0.5.0** | Fail-closed offline boot, quota/limit gates, apiUrl pin, sync mutex, Nest 403 filter |
+| **0.4.x** | Deep integration (registry/DI), error `code` + `source`, runtime re-check |
+| **0.3.x** | Production default URL, activate/revoke sync |
+| **0.2.x** | Auto-fetch public keys, worker/CLI guard |
+| **0.1.x** | Boot, express middleware, file cache |

package/dist/core-license.js

@@ -25,7 +25,7 @@ import { PolicySignatureError } from './errors/policy-error.js';
 import { throwForTerminalStatus } from './errors/throw-for-status.js';
 import { resolveApiUrl, parseEmbeddedApiUrl } from './env/resolve-api-url.js';
 const SDK_NAME = '@corelicense/node';
-const SDK_VERSION = '0.5.0';
+const SDK_VERSION = '0.5.1';
 const DEFAULT_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
 function hashPolicyToken(token) {
     return createHash('sha256').update(token).digest('hex');

package/docs/api-reference.md

@@ -0,0 +1,210 @@
+# API Reference
+
+Public API `@corelicense/node` v0.5.1.
+
+---
+
+## CoreLicense
+
+### Constructor
+
+```ts
+new CoreLicense(options: CoreLicenseOptions)
+```
+
+### Lifecycle
+
+| Method | Returns | Mô tả |
+|--------|---------|--------|
+| `boot()` | `Promise<void>` | Khởi tạo, sync server, fail-closed |
+| `refresh()` | `Promise<LicenseStatus>` | Force refresh policy |
+| `startBackgroundCheck()` | `void` | Bật interval sync |
+| `stopBackgroundCheck()` | `void` | Tắt interval |
+
+### License gates
+
+| Method | Mô tả |
+|--------|--------|
+| `requireActive()` | Throw nếu không active |
+| `requireFeature(feature)` | Throw + audit nếu feature off |
+| `checkLimit(name, current)` | Throw nếu vượt limit |
+| `consumeQuota(name, amount?)` | Tiêu thụ quota local |
+| `getStatus()` | Trạng thái hiện tại |
+| `getPolicy()` | Policy đã verify (null nếu chưa có) |
+| `getRuntimeConfig()` | Config derived từ policy |
+
+### HTTP integrations
+
+| Method | Mô tả |
+|--------|--------|
+| `express(options?)` | Express `RequestHandler` |
+| `fastifyPlugin(options?)` | Fastify plugin |
+
+### Worker / CLI
+
+| Method | Mô tả |
+|--------|--------|
+| `guardWorker(name)` | Guard worker process |
+| `guardCommand(name)` | Guard CLI/cron command |
+
+### Deep integration
+
+| Method | Mô tả |
+|--------|--------|
+| `bootstrap(options)` | Register modules + services |
+| `createLicensedRegistry()` | `LicensedModuleRegistry` riêng |
+| `createLicensedContainer()` | `LicensedServiceContainer` riêng |
+
+### Events
+
+```ts
+license.on(event, handler)
+license.off(event, handler)
+```
+
+Events: `statusChanged` | `policyUpdated` | `licenseRevoked` | `licenseSuspended` | `offlineMode`
+
+---
+
+## LicensedModuleRegistry
+
+| Method | Mô tả |
+|--------|--------|
+| `bootstrap(definitions, ctx)` | Register hàng loạt |
+| `registerLicensed(def, ctx)` | Register một module |
+| `has(name)` | Module đã bind? |
+| `get<T>(name)` | Lấy module + re-check license |
+| `list()` | Tên modules đã register |
+
+---
+
+## LicensedServiceContainer
+
+| Method | Mô tả |
+|--------|--------|
+| `bootstrap(definitions, ctx)` | Bind services |
+| `resolve<T>(name)` | Resolve + re-check license |
+| `has(name)` | Service đã bind? |
+
+---
+
+## Helpers
+
+```ts
+loadOptionsFromEnv(overrides?: Partial<CoreLicenseOptions>): CoreLicenseOptions
+resolveApiUrl(options, cachedApiUrl?): string
+parseEmbeddedApiUrl(licenseKey): string | null
+registerLicensedRoutes(app, registry, routes): string[]
+isLicenseError(error): boolean
+formatLicenseError(error): string
+isFeatureEnabled(policy, feature): boolean
+```
+
+---
+
+## Subpath exports
+
+### `@corelicense/node/express`
+
+```ts
+createExpressMiddleware(license, options?): RequestHandler
+```
+
+### `@corelicense/node/fastify`
+
+```ts
+createFastifyPlugin(license, options?): FastifyPluginAsync
+coreLicenseFastifyPlugin
+```
+
+### `@corelicense/node/nestjs`
+
+```ts
+CoreLicenseModule.forRoot(options): DynamicModule
+CoreLicenseGuard
+CoreLicenseFeatureGuard
+CoreLicenseExceptionFilter
+RequireFeature(feature)  // decorator
+REQUIRE_FEATURE_KEY
+```
+
+---
+
+## Types
+
+### `CoreLicenseOptions`
+
+Xem [installation.md](./installation.md#4-corelicenseoptions-constructor).
+
+### `ExpressGuardOptions` / `FastifyGuardOptions`
+
+```ts
+{
+  allowPaths?: string[];
+  mode?: 'block' | 'limited';
+}
+```
+
+### `BootstrapResult`
+
+```ts
+{
+  modules: LicensedModuleRegistry;
+  services: LicensedServiceContainer;
+  registeredModules: string[];
+  registeredServices: string[];
+  skipped: { name: string; feature: string; reason: 'feature_disabled' }[];
+}
+```
+
+### `LicenseStatus`
+
+```ts
+{
+  status: 'active' | 'suspended' | 'revoked' | 'expired' | 'invalid' | 'blocked';
+  policyVersion?: string;
+  expiresAt?: string;
+  // ...
+}
+```
+
+---
+
+## Error codes
+
+Mọi `LicenseError` có `code`, `source`, `message`, `toClientPayload()`, `toJSON()`.
+
+| Code | HTTP (middleware) |
+|------|-------------------|
+| `LICENSE_REVOKED` | 403 |
+| `LICENSE_SUSPENDED` | 403 |
+| `LICENSE_EXPIRED` | 403 |
+| `LICENSE_INVALID` | 403 |
+| `OFFLINE_GRACE_EXPIRED` | 403 |
+| `FEATURE_DISABLED` | 403 |
+| `MODULE_NOT_LICENSED` | 403 |
+| `QUOTA_EXCEEDED` | 403 |
+| `MAX_INSTANCES` | 403 |
+| `INSTANCE_BLOCKED` | 403 |
+| `CONFIG_MISSING_ENV` | — (boot fail) |
+| `POLICY_SIGNATURE_ERROR` | — (boot fail) |
+| `BOOT_NOT_CALLED` | — |
+| `WORKER_NOT_ALLOWED` | — |
+| `COMMAND_NOT_ALLOWED` | — |
+
+Danh sách đầy đủ trong source: `src/errors/codes.ts`
+
+---
+
+## Client API (License Server)
+
+SDK gọi các endpoint (không gọi trực tiếp từ app thường):
+
+| Endpoint | Mô tả |
+|----------|--------|
+| `POST /v1/client/activate` | Lần đầu |
+| `POST /v1/client/check` | Periodic check |
+| `POST /v1/client/refresh` | Force refresh |
+| `GET /v1/public/products/{id}/keys` | Public keys |
+
+Chi tiết: [corelicense.net/docs/client-api](https://corelicense.net/docs/client-api)

package/docs/installation.md

@@ -0,0 +1,188 @@
+# Cài đặt
+
+Hướng dẫn cài package, cấu hình môi trường và chạy `boot()` lần đầu.
+
+---
+
+## 1. Cài package
+
+```bash
+npm install @corelicense/node
+```
+
+### Peer dependencies (tùy framework)
+
+Chỉ cài khi dùng integration tương ứng:
+
+```bash
+npm install express              # Express middleware
+npm install fastify              # Fastify plugin
+npm install @nestjs/common @nestjs/core   # NestJS
+```
+
+SDK không bắt buộc peer deps — tree-shake an toàn nếu chỉ dùng `CoreLicense` trực tiếp.
+
+---
+
+## 2. Biến môi trường
+
+### Bắt buộc
+
+| Biến | Mô tả |
+|------|--------|
+| `CORELICENSE_KEY` | License key do admin cấp (`CL-...` hoặc `CL1.<base64url-api>.CL-...`) |
+| `CORELICENSE_PRODUCT_ID` | Product ID trên License Server |
+
+### Tùy chọn
+
+| Biến | Mô tả | Mặc định |
+|------|--------|----------|
+| `CORELICENSE_API_URL` | Override URL License API | `https://api.corelicense.net` |
+| `CORELICENSE_PUBLIC_KEY` | Pin public key (SPKI PEM) — bỏ qua fetch keys | auto-fetch |
+
+**Thứ tự resolve API URL** (không cần set thủ công trên production):
+
+1. `options.apiUrl` / `CORELICENSE_API_URL`
+2. URL nhúng trong key `CL1.<base64url>.CL-...`
+3. Cache `sdk.endpoint.json`
+4. `https://api.corelicense.net`
+
+### Dev local
+
+```env
+CORELICENSE_KEY=CL-AAAAA-BBBBB-CCCCC-DDDDD-EEEEE
+CORELICENSE_PRODUCT_ID=demo
+CORELICENSE_API_URL=http://localhost:8080
+```
+
+### Production
+
+```env
+CORELICENSE_KEY=CL1.xxxxx.CL-AAAAA-BBBBB-...
+CORELICENSE_PRODUCT_ID=my-product
+# Không cần CORELICENSE_API_URL — SDK dùng api.corelicense.net
+```
+
+Server Go production cần `SDK_PUBLIC_URL=https://api.corelicense.net` khi generate key `CL1.*`.
+
+---
+
+## 3. Khởi tạo tối thiểu
+
+```ts
+import { CoreLicense, loadOptionsFromEnv } from '@corelicense/node';
+
+const license = new CoreLicense(
+  loadOptionsFromEnv({
+    cachePath: './storage/corelicense',
+    instance: {
+      strategy: 'install-id-domain-hash',
+      domain: process.env.APP_DOMAIN, // ví dụ: app.example.com
+    },
+    audit: {
+      enabled: true,
+      path: './storage/logs/corelicense.log',
+    },
+  }),
+);
+
+await license.boot();
+```
+
+`loadOptionsFromEnv()` throw `ConfigError` (`CONFIG_MISSING_ENV`) nếu thiếu biến bắt buộc.
+
+---
+
+## 4. `CoreLicenseOptions` (constructor)
+
+| Field | Type | Mặc định | Mô tả |
+|-------|------|----------|--------|
+| `productId` | `string` | — | **Bắt buộc** |
+| `licenseKey` | `string` | — | **Bắt buộc** |
+| `apiUrl` | `string` | auto | License Server base URL |
+| `publicKey` | `string` | — | Pin SPKI PEM |
+| `cachePath` | `string` | `./storage/corelicense` | Thư mục cache |
+| `checkIntervalMs` | `number` | `21600000` (6h) | Background refresh; `0` = tắt |
+| `requestTimeoutMs` | `number` | `5000` | HTTP timeout |
+| `offlineGrace` | `boolean` | `true` | Cho phép dùng cache khi server unreachable |
+| `defaultBlockMode` | `'block' \| 'limited'` | `'limited'` | Middleware mode mặc định |
+| `instance.strategy` | `'install-id-domain-hash' \| 'custom'` | `'install-id-domain-hash'` | Cách tính instance ID |
+| `instance.domain` | `string` | — | Domain app (cho hash) |
+| `instance.customId` | `string` | — | Khi `strategy: 'custom'` |
+| `audit.enabled` | `boolean` | `true` | Ghi audit local |
+| `audit.path` | `string` | `./storage/logs/corelicense.log` | File audit |
+| `appVersion` | `string` | — | Gửi kèm SDK info lên server |
+
+---
+
+## 5. Luồng `boot()`
+
+1. Resolve API URL (pin / cache / env / default)
+2. Tính **instance ID** (install-id + domain hash)
+3. Fetch hoặc dùng **pinned public key**
+4. Load policy token từ cache → verify
+5. Nếu cần: `activate` (lần đầu) hoặc `check` (refresh)
+6. Bật background checker (nếu `checkIntervalMs > 0`)
+7. **`requireActive()`** — fail-closed nếu license không active
+
+**Lưu ý v0.5:** Offline + grace hết hạn → `boot()` **throw**, không cho app chạy “im lặng”.
+
+---
+
+## 6. Pin public key (enterprise)
+
+```ts
+const license = new CoreLicense(
+  loadOptionsFromEnv({
+    publicKey: process.env.CORELICENSE_PUBLIC_KEY,
+  }),
+);
+```
+
+Khi pin, SDK **không** gọi `GET /v1/public/products/{id}/keys`. Sau key rotation trên server, cập nhật `CORELICENSE_PUBLIC_KEY` và restart app.
+
+---
+
+## 7. File trên disk
+
+```
+storage/corelicense/
+  instance.json       # instanceId đã resolve
+  policy.token        # JWT policy (signed)
+  usage.json          # quota usage theo ngày
+  sdk.endpoint.json   # apiUrl tin cậy từ server
+
+storage/logs/
+  corelicense.log     # audit events (JSON lines)
+```
+
+Thêm `storage/` vào `.gitignore` của app khách.
+
+---
+
+## 8. Kiểm tra sau cài
+
+```ts
+const status = await license.getStatus();
+console.log(status); // { status: 'active', ... }
+
+const policy = await license.getPolicy();
+console.log(policy?.features);
+```
+
+HTTP health route (không qua license guard):
+
+```ts
+app.get('/health', (_req, res) => res.json({ ok: true }));
+app.get('/license/status', async (_req, res) => {
+  res.json(await license.getStatus());
+});
+```
+
+---
+
+## 9. Bước tiếp theo
+
+→ [Tích hợp chi tiết](./integration.md) — Express, NestJS, module registry, DI, worker, production checklist.
+
+→ [API Reference](./api-reference.md) — danh sách method và error codes.