---
title: "DropletSource, DroppyKit"
description: "Where a droplet's source lives."
canonical: "https://getdroppy.app/docs/droppykit/api/droplet-source"
last-updated: "2026-09-09"
---

# DropletSource

Where a droplet's source lives.

`struct DropletSource`

Community droplets must be open source: the review that gets a droplet into the Store is a review of readable code, and a droplet runs in-process with all of Droppy's permissions. A submission without a public repository is refused at intake, not at review.

## Initializers

### init(from:)

`init(from decoder: any Decoder) throws`

### init(repository:commit:license:)

`init(repository: URL, commit: String, license: String)`

The 1.0 initializer, kept for droplets already built against it.

### init(repository:license:)

`init(repository: URL, license: String)`

Creates a source. The commit is not part of it; see `commit`.

## Properties

### commit

`let commit: String`

Legacy. Leave it out.

A manifest cannot name the commit that contains it: writing the SHA in changes the tree, which changes the SHA. Whatever a droplet put here was therefore a value that accepted any string, was never read by anything that mattered, and could not be right by construction. The commit comes from the submission, and review, build and publish pin that one.

Kept as a property, and empty when the manifest omits it, so a droplet that reads it still compiles.

### license

`let license: String`

SPDX identifier of the droplet's own licence, for example `"MIT"`. This covers your code, not the SDK.

### repository

`let repository: URL`

Public repository URL. Must be reachable without credentials.

## Methods

### encode(to:)

`func encode(to encoder: any Encoder) throws`