Check three things before adding source: the framework baseline, any extra packages and any service you must connect. A component can need an email service without importing an extra package.

## Framework prerequisites

Svelte 5, Tailwind CSS 4 and, for `sveltekit` components, SvelteKit 2 are prerequisites that your project already provides. They are not listed as dependencies and do not affect the dependency filter. A `sveltekit` component may import `@sveltejs/kit` (and its subpaths) or `$app/*` without declaring a dependency; a `svelte` component may not import either.

## Third-party packages

When a component imports a package, its `dependencies` list declares:

- `name`: the npm package name.
- `range`: the supported semver range to install, for example `^2`.
- `purpose`: why the component needs it.
- `testedVersion`: the exact version resolved in the catalogue repository when the release was built, or `null`. It records what was installed at build time, not a compatibility test.

Install declared packages with your own package manager before importing the component:

```bash
npm install <name>@"<range>"
```

A component that uses a package but does not declare it is a bug. Please [report it](/docs/reporting-issues).

## External services

A `service-required` component declares each service it expects:

- `category` and `description` of the service, such as email delivery.
- `configuration` you must provide, such as an endpoint or a key held on your server.
- `responsibilities`: backend work the component **does not** implement.

The component handles its interface. Storage, delivery, validation on the server, spam protection, authentication and anything else listed under responsibilities are yours to build or connect.

> [!WARNING]
> Do not ship a form or checkout component whose submission goes nowhere. If the service is not connected yet, leave the component out of production.

## The dependency filter

Browsing, search, the API and the MCP server share one dependency filter with three values, combined with OR when you choose more than one:

| Value              | Meaning                                                 |
| ------------------ | ------------------------------------------------------- |
| `none`             | No third-party runtime package and no external service. |
| `third-party`      | Declares at least one package.                          |
| `external-service` | Needs a connected service.                              |

## Assets

Images, icons and fonts that a component needs are exported as files with the `asset` role. Each asset can carry its own license entry with the license name and, where required, attribution and source. Keep assets at their relative paths, because component code references them that way, and keep their license information. See [license](/docs/license).

Binary assets are never delivered as inline text. The MCP server and the API return their URLs and checksums instead, and the ZIP bundle contains them directly.