# Registry

Source: /tuil/docs/concepts/registry
Locale: en

Source-owned components, dependency resolution, integrity, and secure remote sources.



The registry distributes source files, not opaque runtime widgets. Applications
can inspect and customize installed components while sharing package-level
contracts.

## Install flow [#install-flow]

<Mermaid
  chart="flowchart LR
  Request[&#x22;requested items&#x22;] --> Manifest[&#x22;load and validate manifest&#x22;]
  Manifest --> Graph[&#x22;resolve dependencies&#x22;]
  Graph --> Files[&#x22;validate file paths and integrity&#x22;]
  Files --> Plan[&#x22;plan every destination&#x22;]
  Plan --> Conflicts[&#x22;detect conflicts&#x22;]
  Conflicts --> Write[&#x22;atomic scoped writes&#x22;]"
/>

Remote sources reject unsupported schemes, credentials in URLs, query or
fragment ambiguity, unsafe relative paths, and invalid package or dependency
metadata. Plain HTTP is limited to explicit loopback development hosts.

See [Custom registries](/tuil/docs/guides/custom-registries) and the
[`@mwillbanks/tuil-registry` reference](/tuil/docs/reference/packages/registry).