The registry spec has defined specific endpoints for querying and fetching package manifests (which are needed during package resolution, so potentially for many versions), so SwiftPM won't need to download the actual sources for a version until it has determined the concrete one to use.