\n );\n}\n```\n\n### Rendering a markdown card (RSC-safe)\n\n```typescript\n// Works in React Server Components — no 'use client' needed\nimport { renderIntegrationMarkdown } from '@lssm-tech/module.integration-hub/renderers';\n\nexport async function IntegrationCard({ id }: { id: string }) {\n const integration = await fetchIntegration(id);\n const markdown = renderIntegrationMarkdown({\n id: integration.id,\n name: integration.name,\n description: integration.description,\n category: integration.category,\n status: integration.status,\n connectionCount: integration.connections.length,\n });\n return ;\n}\n```\n\n## RSC directive boundaries\n\nHooks carry `'use client'` — import them only in client components. Model types\nand the markdown renderer have no directive and are safe to import anywhere,\nincluding React Server Components. See `AGENTS.md` for the full boundary table\nand lint rules.\n\n## Deployment topology\n\n`validateIntegrationDeploymentTopology` models service operator, runtime and\ndata placement, credential custody, identity trust, API commercial mode,\nnetwork policy, residency, and evidence placement as independent axes. It is a\npure fail-closed validator: customer API keys cannot be assigned to an LSSM-only\nvault, and air-gapped profiles cannot depend on live central identity or remote\nmanaged data.\n\nThe model subpath re-exports the canonical provider-neutral topology contract\nfrom `@lssm-tech/lib.contracts-integrations`. The Hub accepts an optional\n`integration.topology-evidence` read port for a secret-free, freshness-bounded\nprovider receipt tied to an exact workspace or connection digest. Installing\nthe port does not verify the provider by itself; only an adapter that has\nverified its native durable receipt may project this evidence.\n\n## What this package does NOT include\n\n- CompanyOS-specific chrome or view-models (those live in `bundle.managed-companyos`)\n- `RedactedCredentialChip` (stays in the bundle pending second consumer)\n- Any example fixtures or mock data (see `examples/integration-hub`)\n\n## Development\n\n```bash\nbun test --cwd packages/platform/delivery/integration-hub\nbun run --cwd packages/platform/delivery/integration-hub typecheck\n```\n\n## Feature Hub profile\n\n`./hub` exports `IntegrationFeatureHub`, `defineIntegrationHub`, and\n`installIntegrationHub`. The profile uses the canonical `platform.integrations`\nfeature registry, mounts at `/integrations`, and depends only on the\nprovider-neutral `integration.catalog` and `integration.connection` ports.\nIts route catalog covers detail, connections, syncs, configuration,\ncredentials/secrets, health, audit, and installation; activation supports both\nmanaged credentials and BYOK secret references.\n`integration.topology-evidence` is optional so existing installations remain\ncompatible and missing proof remains explicit.\n","sourcePath":"packages/platform/delivery/integration-hub/README.md","sourceUrl":"https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/platform/delivery/integration-hub/README.md","blobSha":"9d0aa9412f9c034a1ccec6d8617cdcd895944000","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","origin":"README recovered byte-for-byte from pinned aggregate guide","integrity":"exact Git blob match","executionStatus":"not executed"},"provenance":{"repository":"lssm-tech/contractspec","sourcePin":"bcc79fcc27c4d801c2119bef81ddcce7b4e86498","manifestOrigin":"pinned GitHub manifest fetch","manifestComplete":true,"publicationPolicyApplied":false},"areaSlug":"integrations-and-providers","areaTitle":"Integrations and provider selection","displayName":"module.integration-hub","runtimes":["node"],"platforms":["server"],"kind":"module","scope":"Package manifest","canonicalRoute":"/docs/packages/module.integration-hub/","contextUrl":"/docs/packages/module.integration-hub.context.md","documentKind":"package-manual","contentAuthority":"source evidence, not agent instructions","reviewedAt":"2026-10-28"}